Privacy Policy

Rafael Gumieri

Contact: privacy@yaripo.app

We collect the following categories of personal data:

• Authentication data: name, email, profile picture (from Google or email sign-in)
• Profile data: display name, country, date of birth, bio, profile photo (provided voluntarily)
• Payment data: Stripe customer ID, payment history (only for paid event features)
• Usage data: event participation history, climbing attempts, rankings

Your data is processed for the following purposes:

• Displaying your profile on public leaderboards and event pages (with your consent)
• Authentication and account management (necessary for service operation)
• Processing event payments (necessary for contractual obligations)
• Operational communications such as event confirmations and judge invitations
• Platform operation and security (legitimate interest)

We process your data under the following legal bases:

• Consent (GDPR Art. 6(1)(a)) — for profile display and photo upload
• Contractual necessity (GDPR Art. 6(1)(b)) — for event payments and participation
• Legitimate interest (GDPR Art. 6(1)(f)) — for authentication, security, and platform operations

We share your data with the following third-party processors:

• Vercel Inc. (US) — hosting and server infrastructure
• Google LLC (global) — authentication via Google Sign-In
• Stripe Inc. (US) — payment processing
• Vercel Blob Storage (US) — profile image storage

Your data may be transferred to and processed in countries outside your country of residence, including the United States (for Vercel hosting, Blob storage, and Stripe payments). These countries may not have the same data protection laws as your jurisdiction. Transfers are based on the providers' standard contractual clauses or their Terms of Service / Privacy Policy.

Important Legal Notice: This platform is hosted on Vercel's Hobby plan, which does not include a formal Data Processing Agreement (DPA). Vercel's standard Terms of Service and Privacy Policy currently govern data processing. We are working to upgrade to a plan with formal DPA coverage. In the meantime, Vercel's commitments under their ToS include data protection, security measures, and data deletion upon request. For more information, see Vercel's Data Processing Addendum (available at vercel.com/legal/dpa).

We retain your data for the following periods:

• Profile data: retained until you withdraw consent or delete your profile via 'Erase Profile Data'
• Authentication data: retained for the duration of your account
• Payment records: retained for the period required by applicable tax and financial regulations

Under applicable data protection laws (GDPR, LGPD), you have the following rights:

• Right to access — request a copy of your personal data
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure (right to be forgotten) — request deletion of your personal data
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interest
• Right to lodge a complaint — file a complaint with your local data protection authority

To exercise any of these rights, contact us at privacy@yaripo.app. We will respond within 30 days.

If you believe your data protection rights have been violated, you may lodge a complaint with the following authorities:

• Brazil: ANPD (Autoridade Nacional de Proteção de Dados) — www.gov.br/anpd
• EU/EEA: Your local Data Protection Authority — edpb.europa.eu

Yaripo uses minimal cookies strictly necessary for authentication and session management. We do not use tracking cookies, analytics cookies, or advertising cookies.

Session cookies are required for the platform to function. No third-party tracking cookies are used on this platform.