Legal information

Stig F. Olsen, operating RivalLeague Nova under the NorthVektor Labs brand, is the controller responsible for the account personal data described here.

Address: Rostockgata 24, 0191 Oslo, Norway. For privacy questions and requests, contact privacy@northvektorlabs.com.

RivalLeague Nova provides sports predictions, pools, results and related news. We use your email address, display name, protected password hash and account identifiers to create and operate the account you request. We also use verification status and account timestamps to protect access and send necessary account messages, including email verification and password recovery.

Account creation is for people aged 18 or over. We record your actual adult confirmation and the account Privacy notice presented to you. These records are private. They do not declare your residence, accept a paid subscription, or consent to optional processing. Existing accounts may retain historical acknowledgements; we do not rewrite those records when the notice changes.

You may add profile information and preferences, including an avatar, biography, favourite teams, language, time zone and country. Participation creates records such as pool membership, invitations, predictions, results, scores, rankings and achievements. A profile or leaderboard country is not a declaration of legal residence.

Account fields marked required, a valid email address, a password and the adult confirmation are necessary for signup. Additional profile information is optional. Some participation requires email verification. Password confirmation is used to check your entry; it is not a separate profile field.

For new accounts presented with General Terms of Use, we separately record your affirmative acceptance, its time and the exact document version and text to document the account agreement. This evidence is used for agreement administration, not optional marketing or analytics consent. Existing accounts are not treated as having accepted a later version merely by using the service.

We process the information necessary to provide your requested account and features to perform the account-service agreement (GDPR Article 6(1)(b)). Limited session, request, security and diagnostic information is used for our legitimate interests in preventing abuse, protecting accounts and reliable operation (Article 6(1)(f)), subject to a necessity and balancing assessment. This may include browser information, a hashed network identifier, verification/recovery events and rate-limit records. You may object to processing based on legitimate interests. Report vulnerabilities and security incidents to security@northvektorlabs.com.

We retain the notice presented and your adult confirmation to document account creation and the information provided. Acknowledging a notice is not blanket consent. Optional analytics and automatic preferences require their own choices; account creation supplies neither consent.

Profile, pool and leaderboard features can show your display identity, participation, results, rankings and selected profile details. Relevant pool administrators can see information needed to administer their pools. Supported profile visibility settings let you control optional disclosures. Current defaults hide biography, profile country and your pool-membership listing, and show achievements, premium badge and team allegiances. They do not make all game participation private.

Your email address, password hash and private signup evidence are not part of the public-profile projection.

We use Vercel for web hosting, MongoDB Atlas for account and application storage, Railway for background services, and Resend for transactional email. Email delivery sends the recipient address and message content, including the verification or recovery link, to Resend. Editorial images use Vercel Blob; this is distinct from account-password storage.

Providers operate internationally. Resend's published GDPR information describes US storage of messages and delivery information, including when email is sent from Europe, and EU Standard Contractual Clauses in its DPA (https://resend.com/security/gdpr). You can request relevant recipient information and copies of safeguards at the privacy address above. We do not promise storage exclusively in Norway or the EEA.

Payment processing is separate from free account creation. This notice does not activate paid subscriptions or replace the information and agreements required for them.

A necessary HttpOnly session cookie supports sign-in for up to 30 days or until logout or revocation. Explicit appearance, navigation and spoiler choices remember the settings you request. Browser-storage expiry does not mean all related server data or backups have been deleted.

Only if you allow automatic preferences do we read your device time zone and store up to five recently opened search results in this tab. The recent-results record also contains the signed-in account ID to keep different accounts' histories separate. The time-zone cookie lasts at most 180 days, bounded by the choice's expiry; recent results last for the tab session. Withdrawal removes these optional records.

Vercel Web Analytics starts only after your separate page-statistics choice. Before transmission, the application removes URL query strings, fragments and dynamic route identifiers. This does not guarantee anonymity. Optional choices start off and can be changed or withdrawn in Cookie settings. Your choice record lasts 180 days and does not contain an account ID; this is distinct from the optional recent-results record. See Cookies and browser storage (/legal/cookies?locale=en) for details. Hosting and security requests necessary to deliver the service are separate from optional analytics.

We retain account and profile information while providing your account and the features you use. Requests to close an account or delete information are handled manually through the privacy contact; there is no general self-service account-erasure button. On a request, we assess which records can be deleted and which remain necessary for completed game records, security incidents, legal obligations or the establishment, exercise or defence of claims. We explain any applicable retention reason and period or criterion when responding.

Verification links expire after 24 hours; their token records are marked for retention expiry 30 days after issue. This is not a universal 30-day deletion rule. Session expiry, provider logs and backups have separate lifecycles. We do not promise immediate deletion from every provider or backup.

You can change supported profile and preference settings in the service. You can also contact privacy@northvektorlabs.com to request access, correction, deletion, restriction or portability, or to object to processing where those rights apply. We may ask for proportionate information to verify that a request relates to your account. If processing relies on consent, you may withdraw that consent without changing the lawfulness of earlier processing. support@northvektorlabs.com remains the main customer entry point. We route requests internally; you do not need to resend your request to another address.

You have the right to complain to a data protection supervisory authority. In the European Economic Area (EEA), this may in particular be the authority where you normally live, work, or where you believe a breach of data protection law occurred.

Norway’s authority is Datatilsynet (https://www.datatilsynet.no/). Other EEA authorities are listed at https://www.edpb.europa.eu/about-edpb/our-members_en.

You can also contact us to request a human review of an account-access or privacy concern. This does not limit your right to complain to a supervisory authority.

Scores, rankings and achievements are calculated from game information. Security rules may restrict requests or account actions.

We must respond to rights requests without undue delay, normally within one month of receipt. Where legally justified by complexity or the number of requests, we may extend this by up to two further months, explaining the reason within the first month.

We identify the notice by its version and actual effective date. We preserve the version and text presented when an account is created. A later update does not invent an acknowledgement by an existing user. Material changes will be explained before the changed use takes effect.