PAIRLY: PRIVACY POLICY

Pairly operates the website at pairly.gg and the boosting, Duo Finder, and Discord services connected to it. We decide what personal data the platform collects and why, which makes us the controller for that data under the GDPR.

Write to contact@pairly.gg for anything in this policy, including access requests, erasure requests, and complaints. Our registered operator details are on the Imprint page.

You may also complain to the data protection authority in the country where you live or work.

Account data: username, email address, hashed password where you sign in with credentials, role, avatar, short account ID, and any optional profile fields you fill in.

Order data: the game, service, and rank range you buy, add-ons, order notes, and the delivery preferences you set at checkout.

Duo and game profile data: server, language, rank, lane, champion preferences, voice-chat preference, and the game account you link when you connect one.

Communication data: order chat messages, support requests, reviews you publish, and anything you send us by email.

A solo boosting order needs the credentials of the account being played. We store them encrypted and bound to that one order.

The booster assigned to that order can reveal them, and only while the order is active. Pairly support can also reveal them, while the order is active or after delivery until they are deleted, to resolve a problem with the order. We delete the credentials within 24 hours of delivery.

Every reveal and the deletion are written to the order history. That history stays readable in your account after the credentials themselves are gone, so you can see who opened them and when.

Stripe processes your card. We never receive or store your full card number; we hold the payment identifiers Stripe returns, the amount, the currency, the status, and the last four digits shown on your receipt.

We record refunds we issue, the reason for each one, and the compensation vouchers we credit to your account under the Refund & Cancellation Policy, including the voucher amount, currency, expiry, and the order it was later spent on.

When you tick the acceptance box at checkout, we record the moment you ticked it, the version of the policies on screen, and the IP address and browser the acceptance came from. We keep it with the order for as long as the order record itself, and we rely on it when a bank asks what terms you agreed to.

When a bank opens a chargeback on your payment, we process the dispute record Stripe sends us and the order evidence we submit in response: the checkout snapshot, timestamps, order history, delivery records, and the relevant chat. We do this to establish and defend a legal claim, and we keep it until the dispute and any arbitration close.

Security and session data: session identifiers, login history, user agent, IP address records, CSRF and session protection data, rate-limit counters, and anti-abuse signals.

We look up the country, region, city and network provider of the IP address you sign up from, and the country, city and network provider of each address you sign in from, and show them to our staff on your account record and sign-in history to spot fraudulent signups and account takeovers and to answer chargebacks. The location comes from the MaxMind GeoLite2 databases on our own server; for a signup address those databases cannot place at city level we ask ipinfo.io over an encrypted connection, and only if neither can place it, ip-api.com. To tell whether a signup address belongs to a VPN, proxy, hosting or mobile network, we send the address alone, with nothing else about you, to ip-api.com. The results place an address at city level and are never used to find a person or a street address. This product includes GeoLite data created by MaxMind, available from https://www.maxmind.com.

Operational metadata: timestamps, order history entries, moderation actions, audit entries, cached state, and infrastructure logs.

We receive profile data from services you choose to connect, such as a linked game account, limited to what that service exposes for the permissions you grant.

Signing in with Google: your Google account ID, name, email address, whether Google has verified that address, and your profile picture.

Signing in with Discord: your Discord user ID, username and display name, avatar, email address and whether Discord has verified it. The permission you grant also lets us add you to the Pairly Discord server, which we do when you sign in.

Signing in with Twitch: your Twitch user ID, display name, profile picture, email address and whether Twitch has verified it. Using the same permission, we also read from Twitch your login name, whether your channel is a Twitch Partner or Affiliate, your follower count and the date your Twitch account was created, and we read them again each time you sign in with Twitch. We show them to our staff on your account record to judge whether a new account is genuine and to recognise streamers. Legal basis: our legitimate interest in preventing fraudulent accounts (Article 6(1)(f)); object at contact@pairly.gg.

Signing in with Microsoft: your Microsoft account object ID, name, email address, the directory (tenant) the account belongs to, which tells us whether it is a personal or a work or school account, and, where Microsoft provides it, your country. Using the same permission ("Sign you in and read your profile") we also read your Microsoft profile (display name, preferred language and job title, where set), and we read it again each time you sign in with Microsoft. While your Pairly avatar is still the default one, we also read your Microsoft profile photo and make it your avatar. We show them to our staff on your account record to judge whether a new account is genuine. Legal basis: our legitimate interest in preventing fraudulent accounts (Article 6(1)(f)); object at contact@pairly.gg. For a work or school account, we treat the email address as verified only when Microsoft confirms that its domain owner verified it.

For every sign-in provider: an email address becomes your Pairly account email only if the provider has verified it. When the provider has a profile picture for you, we copy it to our own storage as your Pairly avatar; otherwise you get the default Pairly avatar. You can revoke Pairly’s access at any time in that provider’s own account settings.

To create your account, take your order, deliver the service, run order chat, and handle support. Legal basis: performance of the contract between you and Pairly (Article 6(1)(b)).

To take payment, issue refunds, credit vouchers, and answer chargebacks. Legal basis: performance of the contract, and our legitimate interest in defending legal claims (Articles 6(1)(b) and 6(1)(f)).

To secure accounts, detect fraud, moderate content, and keep the platform running. Legal basis: our legitimate interest in a safe service, balanced against your rights (Article 6(1)(f)).

To keep accounting and tax records of what you bought and what we charged. Legal basis: our legal obligations (Article 6(1)(c)).

To send one email reminding you of an order you started and did not pay for, while that order can still be paid. We send at most one per order and one per 14 days, never after you unsubscribe, and the email carries no offer. Legal basis: our legitimate interest in helping you finish a purchase you began (Article 6(1)(f)). Object to it through the unsubscribe link in the reminder or at contact@pairly.gg.

To email you about new Pairly services and prices, for example when a new service launches, because you have a Pairly account. Every such email has a one-click unsubscribe link, and we stop sending them for good once you use it, report one of our emails as spam, or ask at contact@pairly.gg. We also do not send them to anyone who has unsubscribed from any other optional Pairly email. Legal basis: our legitimate interest in telling our own users about services like the ones they signed up for (Article 6(1)(f)). You may object at any time, free of charge (Article 21(2)).

To measure usage with analytics beyond what the site needs to function. Legal basis: your consent (Article 6(1)(a)), which you give or withdraw at any time in the cookie choice on the site.

To remember the boosts you set up on the storefront but did not buy (game, service, ranks or levels, region and queue), so your dashboard can list them under "Offers for your account" with today's price and the storefront opens where you left it on any device. For a signed-in account, legal basis: performance of the contract (Article 6(1)(b)); a service is removed from the list once you pay for it. Which service pages you opened without changing anything is recorded only if you allow Preferences cookies, signed in or not, on the basis of that consent (Article 6(1)(a)); switching Preferences off deletes what was saved for a signed-out browser. When you are signed in we also use your Pairly orders (what you bought, where each climb ended and the rank our order tracking last read from the account) and the account you linked on the Duo Finder (its League rank, ranked games played this season, summoner level, top champion masteries and, for Diamond and above, when its last ranked game ended, which is what Riot’s rank decay depends on) to suggest your next services there, and we refresh that data from Riot when you open your dashboard. Offers you mark "Not interested" are hidden on your account for 30 days. We record which offers were shown to you, opened or marked "Not interested" (the kind of offer, game, service and its place in the row) and use those records only added up across all customers, to decide which kinds of offers to show more often; they are deleted after 90 days, or with your account if sooner. Legal basis for these suggestions: our legitimate interest in showing you services that fit your account (Article 6(1)(f)); you may object at contact@pairly.gg. We never use any of this to change the price we charge you.

Strictly necessary: session and authentication cookies, CSRF protection, and load handling. The site cannot keep you logged in without them, and we set them without asking for consent.

Preferences: theme, display, and interface state we store locally so the site renders the way you left it. With your consent this also includes pairly_vid, a random identifier (httpOnly, up to 12 months) that links the boosts you set up while signed out to this browser. It is moved to your account when you sign in from the same browser.

Analytics: usage measurement that helps us find broken flows and slow pages. We set these only where you consent, and you change that choice at any time.

Stripe, for payment processing, refunds, and dispute handling.

Hosting, storage, delivery, and monitoring providers, for running the platform and diagnosing incidents.

Email delivery providers, for account, order, and refund notifications, and for emails about new Pairly services.

Discord, where you use the linked Discord features, and the game-account providers you connect yourself.

Google, Discord, Twitch and Microsoft, when you choose to sign in with them. They learn that you are signing in to Pairly; what they hold about you is governed by their own privacy policies, not by this one.

Each of these acts on our instructions under a data processing agreement, and none of them may use your data for their own purposes. We do not sell your personal data and we do not share it for third-party advertising.

Trustpilot, which receives your username, email address, and order number when an order completes, and sends you a review invitation on our behalf. For that invitation Trustpilot is our processor. A review you choose to write on Trustpilot is governed by Trustpilot’s own terms and privacy policy. We send the invitation on the basis of our legitimate interest in independent customer reviews (Article 6(1)(f)). Object to it at contact@pairly.gg, or through the unsubscribe link in the invitation.

Where a provider processes data outside the EEA, we rely on an adequacy decision or on the European Commission’s standard contractual clauses.

Game account credentials: deleted within 24 hours of order delivery.

Order, payment, refund, and voucher records: kept for the statutory accounting retention period that applies to our operator, counted from the end of the tax year of the transaction.

Account and profile data: kept while your account is open, then deleted or anonymised after closure, except for records the accounting rule above still covers.

Order chat and moderation records: kept for 24 months, or until any related dispute or investigation closes if that takes longer.

Security and infrastructure logs: kept for up to 12 months, then rotated out.

Boosts you set up but did not buy: for a signed-out browser, deleted 90 days after the last change; for an account, deleted 180 days after the last change, and removed once you pay for that service.

We encrypt data in transit, encrypt game account credentials at rest, hash passwords, scope access by role, and log administrative actions to the order history.

We rate-limit sensitive endpoints, protect sessions against forgery, and monitor for abuse.

No platform is free of risk. Tell us at contact@pairly.gg if you find a weakness, and we will look at it.

You may ask us for a copy of your data, correct it, delete it, restrict or object to processing, and receive it in a portable format. Where we rely on consent, you may withdraw it at any time without affecting what we did beforehand.

Send the request to contact@pairly.gg from the address on your account, or from your account if you can still sign in. We answer within one month and tell you if we need longer.

We will refuse to erase records we must keep by law, such as invoices, and records we need to defend an open chargeback. We will say which ones and why rather than refusing the request as a whole.

Pairly is not for children. You need to be at least 16, or the higher minimum age set by the law where you live, and you need your guardian’s consent where that law requires it.

Tell us at contact@pairly.gg if a child has created an account and we will close it and delete the data.

We publish changes on this page with a new effective date. Where a change materially affects how we use data you already gave us, we email you before it takes effect.