Privacy Policy

What this notice covers

This notice explains personal-data processing when you browse Flashback, create an account, connect game accounts, upload demos, use analysis or video tools, participate in community features or contact us. A demo may contain information about other players as well as the person uploading it. Third-party platforms and independent event hosts provide their own notices for processing they control.

Data and sources

We process account identifiers, email addresses, profile names, avatars and settings; connected Steam or FACEIT identifiers and authorised connection credentials; match history, player identifiers, game events, positions, statistics and chat contained in available demos; uploaded demos, rendered videos, books, comments and tactical content; subscription and transaction references; and support correspondence. Requests to our services also involve technical data such as IP addresses, timestamps, browser details and security events.

Data comes from you, your use of the service, the game accounts you connect, demo providers, public esports sources and, where relevant, challenge organisers. Publicly available player information may still be personal data. If information about you appears in a match or catalogue without you having an account, you can contact us to ask about its source and exercise your rights.

Purposes and legal bases

We process account, connection, demo, analysis and requested content data to provide the services you request and administer your subscription: Article 6(1)(b) GDPR. Supplying the information required for those features is necessary to use them; optional profile details are voluntary.

Service delivery, security logging, abuse prevention, troubleshooting and the processing of relevant public esports information may rely on Article 6(1)(f) GDPR. The interests pursued are reliable operation, protection of accounts and infrastructure, and a useful match-analysis and esports catalogue. Data about other players in demos is assessed separately from the uploader’s contract; the uploader’s request is not treated as those players’ consent.

Optional analytics relies on your consent under Article 6(1)(a) GDPR and, where device storage or access requires it, Section 25(1) TDDDG. Necessary device storage or access is assessed under Section 25(2) TDDDG. Accounting, tax and other mandatory disclosures rely on Article 6(1)(c) GDPR. Contact requests rely on Article 6(1)(b) when related to a contract, or Article 6(1)(f) for responding to other enquiries.

Connected accounts and demo processing

Connecting Steam or FACEIT allows the service to retrieve the data needed for the selected match features. Depending on the integration, this includes profile and match identifiers, match history, demo access and authorisation information. Do not send passwords or game authentication codes through support channels.

Uploaded or retrieved demos are parsed into match events and can be used to generate radar replays, statistics and requested POV videos. Sharing content or participating in public features can make associated nicknames, gameplay and metadata visible to other people. Disconnecting an integration does not automatically erase previously processed matches or content; contact us for an erasure request.

Public content, challenges and recipients

Public profiles, comments, shared books and published videos may be visible to others according to the feature’s sharing settings. Public challenge standings can show nicknames, avatars, relevant statistics, scores and ranks. Read the event’s rules before joining.

For partner-hosted events, the named host may receive information necessary for eligibility, administration, disputes and prize delivery. Independent hosts are responsible for their own processing and privacy notices. We may also disclose necessary information to authorised service providers, professional advisers or public authorities when required or permitted by law.

Processing outside the EEA

Infrastructure and integration providers operate internationally. Depending on the service, personal data may be processed or accessed outside the European Economic Area, including in the United States. Where this is a restricted transfer, the GDPR requires an applicable adequacy decision or appropriate safeguards such as Standard Contractual Clauses, together with any necessary supplementary measures. Contact us for information about the recipients, locations and safeguards applicable to your data, or to request a copy of the relevant safeguards. A provider’s privacy-policy link alone is not a transfer safeguard.

How long data is kept

Retention depends on the purpose and the content type. Account and connection data is needed while the account or feature remains in use. Uploaded files, derived match data and rendered media can have different lifecycles; the current plan and any stated retention or deletion settings also apply. Saving a reference in a book does not guarantee permanent storage of the source video.

Support correspondence is kept for handling the enquiry and any related claims. Registration records, rule acceptance and challenge outcomes may be needed to administer the event or resolve disputes. Accounting records remain subject to statutory retention obligations. Security logs and backups serve incident investigation and recovery. When assessing deletion, we consider whether the purpose has ended, a legal retention obligation applies or specific data is needed for an outstanding claim. You can ask for the retention criteria applicable to your account or request deletion; we will explain any applicable exception.

Your analytics choice is stored for 180 days. Optional analytics providers apply their configured retention settings. Contact us for the current retention information for a particular service; browser storage can also be removed through your browser settings.

Automated analysis

Flashback automatically derives statistics, recommendations and, for challenges, provisional scores from match data and published rules. Such outputs can be incomplete or affected by missing source data. They do not establish facts about a person outside the game. If an output is incorrect or a challenge decision affects you, contact us or the named host using the event’s review process. Where the conditions of Article 22 GDPR apply, the associated safeguards and rights also apply.

Your rights and how to exercise them

Subject to the applicable legal conditions, you can request access and a copy of your data, correction, erasure, restriction and data portability under Articles 15–20 GDPR. You may object to processing based on legitimate interests for reasons arising from your particular situation under Article 21 GDPR. You may withdraw consent at any time for the future; earlier lawful processing is unaffected.

Email the controller using the contact details below. Identify the account and describe your request without sending a password. We may request proportionate information to verify your identity. Under Article 12 GDPR, requests are generally answered within one month; a permitted extension must be explained within that period. Deletion can be limited where legal obligations or other statutory exceptions apply.

Age and account security

Flashback’s account terms are intended for users aged 16 or older; individual prize events can impose a higher minimum age. If you believe a child has supplied personal data contrary to these conditions, contact us so we can investigate. We use technical and organisational measures to protect the service, but no internet service can guarantee absolute security.

Changes to this notice

We update this notice when the service or its processing changes. The date below identifies this version. Changes that require a new consent choice will not be treated as consent merely because you continue browsing.