Privacy Policy

This policy covers BracketFlow (“BracketFlow,” “we,” “us”). The service is offered in and directed at the United States. It is not directed at, and should not be used by, residents of the European Union, the United Kingdom, or other jurisdictions with data protection laws we do not address in this policy.

BracketFlow plays two different roles depending on whose data is involved, and it matters which one applies to you:

• For Organizer account data — the login, name, email, and billing information of the staff who build and manage Forms — BracketFlow is the controller. We decide how that data is used and this policy governs it directly.
• For Submission and Participant data — the information collected through a Form an Organization builds (a registrant’s name, a player’s date of birth, a guardian’s signature, and so on) — BracketFlow is a processor acting only on that Organization’s instructions. The Organization is responsible for telling its own registrants how their information will be used, and for obtaining any consent required to collect it — including a parent or legal guardian’s consent when the Participant is a minor. If you filled out a form and have questions about how your information is used, your first point of contact should be the Organization that sent you the form, not BracketFlow.

This section 2 explains the entire structure of this policy; the sections below fill in the details.

Organizer accounts. When someone creates an account to use BracketFlow, we collect their name, email address, and password (or, if they sign in with Google, the profile information Google shares with us). We also store which Organization they belong to and their role within it.

Submission and Participant data. Each Organization configures its own Forms, so the exact fields vary, but they commonly include a Submitter’s or Participant’s name, email, phone number, date of birth, uploaded files, and an electronic signature. A signature record also stores the signer’s IP address, browser/device information, a timestamp, and the exact consent statement they agreed to, which together form the audit trail behind a legally binding e-signature.

Payment information. When a Form collects payment, card details are entered directly into Stripe’s checkout — we never see or store full card numbers. We do store the resulting payment record (amount, line items, and Stripe’s transaction identifiers) tied to the Submission.

Public event and roster features. BracketFlow also includes tournament and league management features — brackets, schedules, team rosters, and public event pages — that are built but not yet enabled for every Organization. When an Organization turns these on, a Participant’s name, team, and age division may be displayed on a public page as part of a bracket, schedule, or roster. Organizations choose whether and how these public pages are used.

• To operate the service — hosting Forms, processing Submissions, generating signed PDF documents, and routing them by email or to an Organization’s connected Google Drive.
• To process payments through Stripe, on an Organization’s behalf, into that Organization’s own connected Stripe account.
• To maintain the security and audit trail of electronic signatures.
• To communicate with Organizer account holders about their account and billing.
• To improve and troubleshoot the service.

We do not use Submission or Participant data for advertising, and we do not sell it. See Section 5.

We do not sell personal information. We share it only as needed to run the service, with the following categories of service providers, acting as our sub-processors:

• Amazon Web Services — Cognito (account authentication), S3 (file and document storage), SES (transactional email), and Bedrock (AI-assisted form generation, see Section 11).
• Stripe — payment processing. When a Form collects payment, funds go directly into the Organization’s own connected Stripe account, not into a BracketFlow-controlled account.
• Google — if an Organization connects Google Drive, we request only the drive.file scope, meaning we can only see files BracketFlow itself creates in that Drive, not the rest of the account. See “Google user data” below.

Google user data. If an Organization connects Google Drive, BracketFlow uses that access only to create and update the files it generates (such as signed PDFs and uploaded attachments) in the Drive account the Organization chose. We store the connected account’s email address and the access credentials Google issues, encrypted at rest, and use them for nothing else. We do not read, index, or use other files in that Drive. An Organization can disconnect at any time from Settings → Integrations, which revokes our access with Google and deletes the stored credentials, or by removing BracketFlow at myaccount.google.com/permissions. Files already saved to the Drive remain there; they belong to the Organization and are managed through its Google account.

BracketFlow’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide and improve the user-facing features described above; we do not transfer it to others except as needed to provide those features, to comply with law, or as part of a merger or sale of assets; we do not use it for advertising; and our personnel do not read it unless we have the Organization’s consent, it is necessary for security or abuse investigation, or the law requires it. We do not use Google user data to develop, improve, or train generalized AI or machine-learning models.

We may also disclose information if required by law, to protect the rights and safety of BracketFlow or others, or in connection with a merger, acquisition, or sale of assets.

BracketFlow is not directed at children, and we do not knowingly collect personal information directly from children through our own interfaces — Organizer accounts must be adults, and Forms are designed to be filled out and signed by an adult Submitter, including on behalf of a minor Participant (for example, a parent or legal guardian completing and signing a youth sports waiver).

Because BracketFlow acts as a processor for this data (Section 2), the Organization using BracketFlow to run its youth programs is responsible for complying with applicable children’s privacy laws, including obtaining any required parental or guardian consent before submitting a minor’s information through a Form. If a public roster or bracket feature is enabled (Section 3), a Participant’s name, team, and age division — not their date of birth, contact information, or other sensitive fields — may be displayed publicly; the Organization controls whether this feature is used.

If you are a parent or guardian and believe a minor’s information was submitted incorrectly or without appropriate consent, please contact the Organization that operates the relevant program first. You may also contact us at the address in Section 14 and we will work with the Organization to address it.

We retain Organizer account data for as long as the account is active, and Submission and Participant data for as long as the Organization’s BracketFlow account is active, or as needed to comply with legal, tax, or audit obligations (for example, retaining signed waivers and payment records). If an Organization deletes its account, its Forms, Submissions, and related data are deleted along with it, subject to any copies retained where required by law.

California residents. We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of in that respect. If you are a California resident and want to know what personal information we hold, or want it corrected or deleted, contact the Organization that collected it first, since they control that data; if you are unable to reach them, contact us at the address in Section 14 and we will assist as your request relates to our role as a processor.

Organizer accounts. An account owner can request deletion of their Organization’s account and all associated data directly from their account settings.

We use industry-standard safeguards to protect information, including encryption in transit, role-based access within an Organization (owner, admin, editor, viewer), and scoped, least-privilege access to connected third-party accounts like Google Drive. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

BracketFlow uses only the cookies necessary to run the service: a session cookie that keeps you signed in, and a small preference cookie that remembers your dashboard display theme. We do not use advertising or third-party tracking cookies, so we do not display a cookie-consent banner.

BracketFlow offers an optional feature that lets an Organizer describe a Form in plain language and have a draft generated automatically, using Amazon Bedrock. Only the Organizer’s prompt text is sent to generate the draft — existing Submission or Participant data is not used to train any AI model. The Organizer reviews and can edit the generated Form before it is published.

BracketFlow is intended for use within the United States and stores data in United States-based infrastructure. If you access the service from outside the United States, you do so at your own discretion and are responsible for compliance with local laws.

We may update this policy from time to time. If we make a material change, we will update the “Last updated” date above and, for significant changes, notify Organizer account holders by email.

Questions about this policy can be sent to hello@bracketflow.live.