Privacy policy

1. Data controller

MINTIVE STUDIO LLC, Wyoming entity ID 2026-001855750, with an address at 30 N Gould St Ste N, Sheridan, WY 82801, United States, operates RETO and is the principal controller of the personal data described in this policy.

MINTIVE STUDIO EIRL, Costa Rican corporate ID 3-105-943551, with an address in San José, Escazú, San Rafael, Trejos Montealegre, Costa Rica, provides local operational support and receives requests from people in Costa Rica. Contact us at support@reto.lat or +506 7187-8299.

2. Data we process

The specific data depends on how you use RETO. We may process these categories:

• Account and identity: email, authentication identifier, name, username, phone number, and verification date.
• Sports profile: photo, biography, city, sports, level, positions, history, statistics, badges, and visibility preferences.
• Community activity: groups, memberships, matches, invitations, responses, waitlists, attendance, no-shows, teams, results, shared costs, connections, blocks, and reports.
• Invited-person information: name, phone number, and the relationship to the organiser who entered it, even if that person does not yet have an account.
• Device and usage: IP address, device type, system, language, approximate country, sessions, screens and technical actions, internal identifiers, and error or security logs.
• Data covered by device permissions: precise location while you use a nearby feature, the individual contact you select to invite, the photo you choose, and a notification identifier.
• Venue and organisation data: business name, location, phone numbers, opening hours, prices, photos, contacts, and evidence used to claim a listing.
• Communications: support messages, rights requests, surveys, and information you choose to send us.

3. Where data comes from

We receive data directly from you, organisers who invite you, venues or organisations, public sources used to build the directory, permissions you enable on your device, and providers that operate parts of the service.

When someone adds your phone number before you have an account, we use it only for the invitation, group or match coordination, and your ability to claim your own history.

4. How we use data

We process personal data to:

• create and protect accounts, verify email or phone ownership, and prevent impersonation;
• display profiles under the chosen visibility and connect people, groups, matches, and venues;
• send invitations, codes, confirmations, reminders, operational notices, and requested notifications;
• manage attendance, statistics, results, waitlists, costs, and community safety features;
• maintain and verify the venue and event directory;
• handle support, privacy requests, complaints, and legal obligations;
• detect fraud, abuse, faults, security incidents, and uses contrary to the terms;
• measure and improve RETO under the analytics preference that applies to each surface.

5. Consent and other applicable grounds

We request informed, express, and specific consent when it applies to a feature, including initial account processing and optional analytics in the application. On the public website, analytics uses the opt-out preference described in section 9. Before requesting permission, the feature explains the processing it covers; we will request fresh permission if the purpose changes materially.

We may also process data when necessary to provide a feature you requested, comply with a legal obligation, protect rights or safety, or pursue a legitimate interest permitted by law that is not overridden by your rights. You may withdraw consent for the future; withdrawal does not make earlier lawful processing unlawful.

6. People without accounts and invitations

An organiser may create an unclaimed record with a name and phone number to invite you and record participation. That record does not create a public profile. The number is visible only to the organiser who entered it, on the relevant management surface, while the profile remains unclaimed.

After verifying the same number, you may claim the record and connect it to your account. If you do not recognise an invitation, need to correct a number, or object to the processing, email jugadores@reto.lat.

7. Public information and visibility controls

The venue directory and some claimed profiles may be viewed without signing in. A profile shows only fields permitted by its visibility setting; phone numbers are never public. Match locations, groups, and detailed history are restricted according to context and access permissions.

When you share a link, image, or content outside RETO, the recipient or platform may retain it. Changing visibility later does not remove copies third parties have already stored lawfully.

8. Device permissions

Location is requested only in the foreground to centre the map or show nearby options; we do not track background location. Contact access lets you choose one person to invite: RETO receives only the selected contact and does not copy your full address book. Photo-library access is used only for the image you select to upload.

You may revoke permissions in device settings. Some related features will stop working, but you may continue using the rest of RETO.

9. Analytics and diagnostics

On the public website, Amplitude and Vercel Analytics start on the first visit to understand, under pseudonymous identifiers, which pages and features are used, where journeys fail, and how the site performs. You can disable them from the analytics notice or Privacy preferences in the footer; after that choice, we stop new optional events. We store the preference on the device so we can respect it on later visits.

In the application, Amplitude remains off until you choose to allow analytics. We do not use advertising identifiers, your address book, message content, or invitation links for analytics. Sentry receives technical error and performance information needed to detect faults and protect the service; we configure it to exclude default personal information and filter invitation credentials.

10. Providers and recipients

We share only what is necessary with providers that operate RETO under contracts and protective measures. Current categories include:

• Supabase for authentication, database, realtime, and storage;
• Railway, Vercel, and Expo/EAS for hosting, deployment, and application distribution;
• Amazon Web Services for email and verification messages;
• Google, Apple, and application stores for maps, optional sign-in, distribution, and platform services;
• Meta/WhatsApp when an invitation or reminder is sent through that channel;
• Amplitude for pseudonymous product analytics under the applicable preference;
• Sentry for error, security, and performance diagnostics.

11. Other disclosures

We may disclose data when required by a competent authority, to exercise or defend rights, respond to an emergency, investigate fraud, or protect safety. Data may also transfer as part of a reorganisation, investment, merger, or sale, subject to equivalent confidentiality obligations and notice where required.

We do not sell personal data or share it for cross-company behavioural advertising.

12. International transfers

MINTIVE STUDIO LLC and several providers operate outside Costa Rica, so data may be processed in the United States or other countries. We disclose those transfers in this policy, request consent where applicable, and use contracts, access controls, and other reasonable safeguards to protect the information.

13. Retention

We keep each category only as long as needed for the stated purposes, security, dispute resolution, and legal obligations. The period depends on whether an account remains active, whether data forms part of a shared record, legal periods, and provider configuration.

Operational email and verification contents are removed on short schedules; security, support, analytics, and diagnostic records are kept for limited periods configured for their purpose. Tax or contractual records are retained for the applicable legal period.

When you request account deletion, a 30-day restoration period begins. Afterwards, we delete or anonymise identifiers, authentication, and photos. Shared historical facts may remain attached to an anonymous record to preserve other people's matches, attendance, and cost splits. Backups expire through their normal cycle and are not used to restore a deleted account.

14. Security

We apply technical and organisational controls proportionate to risk, including encryption in transit, access controls, environment separation, security logging, minimisation, and deletion of sensitive credentials. No system is infallible; if an incident occurs, we will investigate, mitigate, and notify people or authorities where required.

15. Your rights

Subject to applicable law, you may request confirmation and access, update or correction, deletion, objection or restriction, withdrawal of consent, and information about transfers or recipients. In Costa Rica, access, correction, and deletion requests are handled free of charge within the applicable legal period.

Email jugadores@reto.lat with your request and a way for us to verify your identity. We will ask only for what is needed to avoid disclosing or deleting another person's data. If you believe we did not handle your request properly, you may complain to Costa Rica's data protection authority, PRODHAB, or the competent authority in your country.

16. Children

RETO accounts are intended for people aged 18 or older. We do not knowingly collect data to create accounts for children. If you believe a child provided data or was improperly added to an invitation, email jugadores@reto.lat so we can investigate and remove it where appropriate.

17. Changes and contact

We may update this policy to reflect legal, technical, or service changes. We will publish the new date and provide notice of material changes. If a new purpose requires consent, we will enable it only after requesting that consent.

For support and requests about your account or your data, email jugadores@reto.lat. For legal matters or complaints, email support@reto.lat. Those channels are administered by the RETO team and the local affiliate in Costa Rica.