Privacy Policy

The operator of NXL App (Individual micro-entrepreneur France), established in France, is the data controller for personal data processed through NXL App.

Privacy requests: [email protected]. General contact: [email protected].

We are not required to appoint a Data Protection Officer (DPO) under Article 37 GDPR. For all privacy matters, contact the address above.

• Account (optional): email address, password (stored securely), email verification status, plan tier (Free / Plus), and account creation date. We send a confirmation link before the account becomes active.
• Riot profile link (RSO, optional): when you claim your profile via Riot Sign-On, we store your PUUID, Riot ID (game name + tag), region, link timestamp, and optional rank-up email preferences.
• Profile analysis: Riot ID, PUUID, ranked match statistics, GPI / Nex Score outputs, loss patterns, coaching recommendations, and match data retrieved from Riot's API — including data for profiles you search without an account.
• Saved progress (RSO claim): season goals, pre-game commitments, and related coaching session metadata tied to your linked account.
• Coach: aggregated stats and coaching context from your analysis are sent to our AI coaching providers to generate coaching text. Follow-up chat is processed to answer your questions but is not kept as a full conversation history. We may keep a short coaching memory per profile for continuity, and optional like/dislike ratings with a short response preview for quality monitoring.
• Billing (Plus, optional): Stripe customer and subscription identifiers, billing interval, and subscription status. Card details are handled by Stripe — we do not store full payment card numbers.
• Patch newsletter (optional): email address and optional champion/role context used to personalise patch emails.
• Usage analytics (server): pseudonymous usage identifiers, coarse page groups, optional profile keys for viewed profiles, and optional user ID when signed in — for service metrics and abuse prevention.
• Audience measurement (Plausible, first-party): cookieless pageviews via our first-party proxy on nxl-app.com (/js/script.js, /api/event) — page URL, referrer, browser/device type, and coarse location (country/region). No advertising identifiers and no cross-site tracking profiles.
• Technical & security logs: connection and request metadata needed to operate and protect the service (short retention).
• Device (browser): favorite profiles and recent searches in local storage if you use those features; essential session cookies when signed in.
• Feedback: message content, optional reply email, page URL, and limited technical metadata for abuse prevention.
• Automatic bug reports: when a critical client error is shown, we may send page URL, app version, error category, and limited technical context (no free-text from you) so we can fix issues — linked to a pseudonymous identifier or your account when signed in.

• Provide the service (profile analysis, Coach, Live, History, Progress) — contract when you create an account or subscribe; legitimate interest when you browse without an account.
• Account & Riot link management — contract.
• Subscription billing — contract and legal obligation (tax/accounting records).
• Patch emails — consent (you subscribe; you can unsubscribe at any time).
• Secure the service, prevent abuse, and measure aggregate usage — legitimate interest.
• Improve Coach quality (ratings, admin review) — legitimate interest.

Coach output is generated by AI from your game data. It is coaching assistance, not an automated decision with legal or similarly significant effects under Article 22 GDPR.

• Account & linked Riot profile: until you delete your account, unlink, or request erasure.
• Match data & analyses: retained for service operation (typically up to 90 days); some coaching state may persist longer while tied to the same profile window.
• Coach session memory & ratings: until overwritten by a newer session or erasure request.
• Billing records: for the duration of the subscription and as required by applicable tax and accounting law.
• Patch newsletter: until you unsubscribe or request deletion.
• Usage events (server): aggregated retention for internal analytics (admin); raw events are not kept indefinitely.
• Plausible audience data: retained on our first-party analytics instance for product measurement until deleted or rotated by the operator.
• Feedback emails: kept in the operator's mailbox according to their email retention practices.
• Security logs: short retention (typically days to weeks).

We use the following categories of recipients. We do not sell your personal data.

• Riot Games — API access to public ranked match data.
• Hosting provider (IONOS SARL) — application and database hosting in the EU/EEA where configured.
• Google and Anthropic — AI coaching providers (processing of aggregated coaching inputs).
• Stripe — payment processing and customer portal for Plus subscriptions.
• Brevo — transactional email (verification, password reset, feedback relay, optional patch and rank-up emails).
• Plausible Community Edition — privacy-friendly audience measurement self-hosted; public pageviews go through our first-party paths on nxl-app.com (no advertising network). The analytics dashboard is not publicly exposed.

Some processors (Google, Anthropic, Stripe) may process data in the United States or other countries outside the EU/EEA. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses and the processor's compliance programme. You may request more information about safeguards via [email protected].

Depending on your situation, you may request access, rectification, erasure, restriction, portability, or objection to processing based on legitimate interest. To withdraw consent (e.g. patch emails), use the unsubscribe link or contact us.

Delete your account: sign in and use account deletion when available, or email [email protected]. Deleting your account removes linked Riot data, saved progress, and billing linkage we hold; Stripe may retain payment records under its own legal obligations.

Without an account: searching a Riot ID does not require registration. To remove retained profile data tied to your Riot ID, contact us with your Riot ID and region. Browser local storage can be cleared in your device settings.

You may lodge a complaint with your supervisory authority. In France: CNIL.

We apply technical and organisational measures appropriate to the risk to protect personal data. No method of transmission or storage is 100% secure; report suspected issues to [email protected].

When you sign in, we use essential session cookies required for authentication. We use local storage for favorites and recent searches. See the on-site notice when you first visit. No third-party advertising trackers are used.

Audience measurement uses Plausible Community Edition via first-party paths on nxl-app.com (/js/script.js, /api/event). It does not set analytics cookies; pageview data is processed under legitimate interest for aggregate product measurement. You may object via [email protected] or by blocking the script in your browser.

Essential cookies do not require consent under the ePrivacy framework; you can block them in your browser, but signed-in features may not work.

See also Terms of Use and Legal notice.