Polo Social Verse

Privacy Policy

Updated on October 20, 2026

Under review: this version is a draft and needs legal review before it is treated as final. The [PREENCHER: ...] items (PREENCHER means "fill in") will be completed by the company.

Who is responsible

Polo Social Verse is operated by Metaquantics Consultoria e Tecnologia Empresarial LTDA, CNPJ (Brazilian company ID) 45.636.626/0001-27, headquartered at Rua Itatiba, 155, Pacaembu, São Paulo, SP, 01248-060, Brazil. This company is the controller of your personal data (the "business" under the CCPA) and acts under Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and, where applicable, the EU General Data Protection Regulation (GDPR), the UK GDPR and California law (CCPA/CPRA).

Data Protection Officer (DPO): [PREENCHER: DPO name], at [PREENCHER: DPO email]. For any privacy matter you can also write to contact@metaquantics.com.

Representative in the European Union and the United Kingdom (if required): [PREENCHER: name and address of the EU and UK representative, or "not applicable"].

What we collect and why

Account: name, email and, if you sign in with Google, your Google profile photo. We use it to create and protect your account and to perform our contract with you.

Profile: @username, photo, country, state and city, club, position and handicap. We use it to build your player profile and the ranking.

Optional contact: WhatsApp and Instagram, only if you fill them in. We use them so that other signed-in players can arrange matches with you. You can delete them at any time.

Content: photos, videos, posts, comments, horses, mallets, teams and tournaments. We use it to show what you choose to publish.

Game statistics: matches, validation stamps, scores, points, Elo, XP, achievements and predictions. We use them to run the game and the ranking.

Field location: coordinates you mark on the map when you add or edit a field, or your device position if you tap to use it.

Security and moderation: reports, blocks and review records. Technical connection data (such as IP address) is processed by our providers to deliver the service and protect against abuse.

We do not use advertising, we do not sell data and we do not use third-party trackers or analytics SDKs.

Legal bases

LGPD (art. 7) and GDPR/UK GDPR (art. 6): we process your data on the basis of (a) performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)): account, profile, content, game statistics and ranking; (b) consent (LGPD art. 7, I; GDPR art. 6(1)(a)): optional contact details (WhatsApp and Instagram) and use of your device location, which you may withdraw at any time without affecting earlier processing; (c) legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)): ranking integrity, security, fraud and abuse prevention, and moderation; (d) legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)): when a law or court order requires it.

When we rely on legitimate interests, we assess that they do not override your rights and freedoms. You can object (see "Your rights (LGPD)" and "Users in the EU and UK").

When you use "Continue with Google" we receive only your name, email and photo. We do not access your contacts, emails, files or other data from your Google account.

When you use "Continue with Apple" we receive your Apple account identifier, your email (which may be Apple's private relay email) and, on first sign-in, the name you authorize. When you delete your account, we revoke the access granted to Apple.

Photos and videos

Every photo you upload is re-encoded on your device before sending: it is resized and saved again as a JPEG, without the original metadata (EXIF), which includes the photo's GPS location.

Note about videos: the video is uploaded as is and may contain metadata, including location, recorded by the device that shot it. If that is sensitive, turn off camera location tagging before recording.

Published photos and videos sit at a public address: anyone with the link can open the file, even without an account.

We ask for camera and gallery access only when you choose a photo or video. The app does not use the microphone to record audio.

Location

The app only asks for your device location when you tap to use your position while marking your field on the map, and only while the app is open. We do not track you, we do not use background location and we do not store your route.

The field coordinates you save are visible on the map and on the field page. You can deny the permission and type the address or pick the point on the map manually.

What is public and what only signed-in users see

Your player profile, teams, horses, mallets, posts, validated matches and fields you added are visible to other users. Your email is never shown.

WhatsApp and Instagram appear only to signed-in users, never to visitors without an account.

Ranking: you can hide yourself from the ranking in your profile settings. When hidden, you no longer appear identified in the standings, but your matches still count for those who played with you.

We do not sell your data, we do not share it for cross-context behavioral advertising and we do not use it for advertising. We use providers that process data on our behalf (processors):

Supabase: database, authentication and file storage, on servers in the São Paulo region (Brazil).

Vercel: hosting for the website and the web app (polosocialverse.com), with global infrastructure and processing in the United States.

Google and Apple: only if you choose to sign in with their account; each has its own privacy policy.

ViaCEP: when you type a Brazilian postal code (CEP) while adding a field, the CEP is sent to the ViaCEP service to fill in the address. No account data goes with it.

Map provider: when you open the map, your browser or device downloads map tiles from the configured provider (today, CARTO, with OpenStreetMap data), which receives your IP address and the region you are viewing. The provider may change; if it does, we will update this policy.

We may also share data if a law or court order requires it, or to protect rights, safety and the integrity of the platform.

International data transfers

Your data is stored with Supabase in São Paulo (Brazil), and the website and web app are delivered by Vercel, which may process data in the United States and other countries. If you are outside Brazil, your data will be transferred to those countries.

For users in the European Union, the European Economic Area and the United Kingdom, these transfers rely on an adequacy decision, where one exists, or on the Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Addendum/IDTA, which are included in the data processing agreements with our processors, together with technical measures such as encryption in transit (HTTPS). [PREENCHER: confirm the transfer mechanism currently in force with each processor.]

Under the LGPD (arts. 33 to 36), transfers go to countries or organizations with an adequate level of protection or are covered by contractual clauses and equivalent safeguards. You can ask for a copy of the applicable safeguards using the contact below.

Reports, blocks and moderation

Anyone can report posts, comments and profiles and block other users. We keep the report, the reported item and the decision, to review the case and prevent abuse of the system.

We review reports within 24 hours. We may remove content and suspend or delete accounts that violate the Terms of use. Content reported by several people may stay hidden until it is reviewed.

Your list of blocked people is private and can be undone at any time.

How long we keep data and how to delete it

We keep your data while your account exists. You can edit your profile and delete your posts at any time.

To delete your account, use Settings > Delete my account (or polosocialverse.com/en/delete-account). Your profile, posts, comments, horses, mallets, contacts and uploaded files are erased and the access granted to Apple is revoked.

Matches already validated by other players stay in their history and in tournament results as "Removed player" (an anonymous tombstone), with no name, photo, contact or other data that identifies you. This preserves the integrity of other people's ranking (LGPD art. 16; GDPR art. 17(3)).

Report and security records may be kept for as long as needed to protect the platform and meet legal obligations.

Provider backups may retain data for a short, limited period until they are overwritten.

Your rights (LGPD)

Under the LGPD (art. 18) you can confirm that we process your data, access it, correct it, request anonymization, blocking or deletion, request portability, know who we share it with, be informed about the option to refuse consent and its consequences, withdraw consent and object to processing. You may also complain to the Brazilian National Data Protection Authority (ANPD).

To exercise any right, write to contact@metaquantics.com or to the DPO listed above. We reply within 15 days. You can edit your profile, hide yourself from the ranking and delete your account directly in the app.

Users in the European Union and the United Kingdom (GDPR and UK GDPR)

If you are in the EEA or the United Kingdom, in addition to the above you have the right of access, rectification, erasure, restriction of processing, data portability and objection to processing based on legitimate interests (GDPR arts. 15 to 21). You may withdraw consent at any time. We do not make decisions based solely on automated processing that have legal effects on you; the ranking is calculated by public game rules.

We reply to requests within one month, extendable in the cases provided by law. Write to contact@metaquantics.com.

You have the right to lodge a complaint with the data protection authority of the country where you live, work or where the alleged infringement occurred (see the European Data Protection Board list of authorities) and, in the United Kingdom, with the Information Commissioner's Office (ICO). We would appreciate the chance to resolve it with you first.

California residents (CCPA/CPRA)

In the last 12 months we have collected these categories of personal information: identifiers (name, @username, email, account ID); personal information from sign-up (such as phone/WhatsApp and Instagram, if you provide them); photos and videos you upload; activity in the app (matches, points, posts, comments); location (field coordinates you mark and, if you allow it, the device position); and data you add to your profile (city, club, position, handicap). We collect it from you, from Google or Apple sign-in and from your use of the app, for the purposes described above.

We do not sell or share personal information for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the data of people under 16. We use location only for the map feature you asked for and not to infer characteristics about you.

You have the right to know what information we collect, use and disclose, to request deletion, to correct inaccurate data, not to be discriminated against for exercising your rights and to use an authorized agent. To exercise them, write to contact@metaquantics.com (we may verify your identity through the account email). We reply within 45 days, extendable as the law allows.

Minimum age

The app is not intended for children under 13 in any country. Where local law requires a higher age to consent to data processing without parental authorization (for example, 16 in parts of the European Union), you must be that age or have a parent or guardian's authorization. [PREENCHER: final decision on the minimum age per region (13 globally; 16 where the law requires parental consent) and whether there will be age verification.]

In Brazil, the processing of children's and teenagers' data follows their best interests (LGPD art. 14). If we learn that an account belongs to someone below the applicable minimum age, it will be deleted. Parents and guardians can ask for deletion using the contact below.

Cookies and local storage

We use essential storage only. In the app and on the web version we keep on your device your sign-in session, your chosen language and usage preferences (for example, theme and filters). Your browser may also cache the app files so it opens faster and works on a weak connection.

On the website, when you tap "Open the app", we set a functional cookie named psv_app that lasts one year and only serves to open the app directly on your next visits.

We do not use cookies or identifiers for advertising, audience analytics or third-party tracking. For that reason we do not show a cookie banner. You can clear this data in your browser or device settings; you will be signed out.

Security and changes

We use an encrypted connection (HTTPS) and database access control so that each person can only change what is theirs. No system is completely immune to failures; in case of a relevant incident, we will notify you and the competent authority (such as the ANPD) as required by law.

We may update this policy. When there are relevant changes, we will notify you in the app and update the date at the top of this page.

Governing law and contact

This policy is governed by the laws of Brazil, without prejudice to the data protection and consumer rights guaranteed by the law of the country where you live.

Questions, access requests or data deletion requests: contact@metaquantics.com.