Partners & Beneficiaries
View All Partners
Applicable to all competitors, registrants, viewers, and visitors, including data subjects in the European Union, the United Kingdom, and Brazil.
Version 2.0 · Effective 1 October 2026 · Adopted 28 September 2026 · Supersedes Version 1.1 (1 July 2026)
Version 2.0 · Effective 1 October 2026 · Supersedes Version 1.1 (1 July 2026)
This notice explains what personal data Strike Fighter League Inc. collects, why, on what legal basis, how long we keep it, who receives it, and your rights. It is written to be read once. The sections most pilots ask about are section 3 (what we collect), section 9 (your rights), section 18 (how long we keep data) and section 5 (a data-licensing program we are preparing, which is not offered today). What changed from Version 1.1 is listed at the end, with the version register.
Strike Fighter League Inc. ("SFL", "we", "us") is a Delaware corporation. Our mailing address, for notices, requests and legal service: 800 N King Street, Suite 304-3164, Wilmington, DE 19801, United States. We are the controller of the personal data described in this notice. Our website is the-sfl.com and our pilot portal is pilots.the-sfl.com. Our privacy contact address is at strikefighterleague.com (section 2). Treat any other similarly named website as unaffiliated with us.
You register once as an SFL competitor and enter each Online Tournament Series (OTS) event separately. Here is what we collect at each stage. Fields marked required on the registration form are needed to run your account and your competition; without them you cannot register. Optional fields are your choice, and leaving them blank changes nothing about your eligibility.
Registration (pilots.the-sfl.com/signup).
Verification. Before you can enter an event we verify your game-account identifier and your Discord identity. Each is checked once and then locked. We keep the identifiers and the date of verification.
Entry (each event). Your acceptance of the competition terms presented at entry, recorded with the version you accepted and the date and time.
Qualification. If you reach a qualification run: payment and tax documentation; identity documents, used to verify you as the payee, to screen against sanctions lists and, where a prize or payment requires it, to confirm your country of residence; and your separate consent to a face camera, which is for the broadcast only (section 6).
Competition and practice on SFL servers. Flight telemetry and event data from our servers (your aircraft's position, orientation, speed and state over time, your scoring and adjudication results), keyed to your game-account identifier; anti-cheat and competitive-integrity checks of your game installation and your connection when you enter and while you fly on SFL servers (never your passwords or the credentials of any account); your voice on the competition communication channels we tell you are recorded; broadcast video and audio; match results and standings; and practice-session clips, which we publish on SFL channels identified by your callsign.
Your account page. Your login, technical logs and IP addresses, your preferences, and the news-and-events email opt-in where it is offered to you (section 11 states the age floor).
Website (the-sfl.com). The enthusiast sign-up box collects your email only. The partnership and investor inquiry forms collect your name, work email, organization, phone, country and message, and, on the investor form, the investor type you select. These forms post to a third-party form processor that delivers them to us (section 7). Like any website, ours records basic technical data about each visit (IP address, browser and pages requested) in server logs used for security. Analytics runs only if you accept it in the cookie bar (section 16).
We collect data from you directly and from your gameplay on SFL-operated servers. We do not buy data about you from third parties.
| Purpose | Legal basis: EU and UK GDPR | Legal basis: Brazil LGPD |
|---|---|---|
| Creating and running your account; verifying your Discord identity and game-account identifier; running, scoring and adjudicating the events you enter; running practice on SFL servers | Contract, Art. 6(1)(b) | Contract, Art. 7 V |
| Holding a parent or guardian's name and email for a pilot under 18, to obtain and record guardian consent and to contact the guardian about the pilot's participation | Legitimate interests, Art. 6(1)(f): protecting pilots under 18 and applying the guardian rules in section 11 | Legitimate interest, Art. 7 IX |
| Broadcasting and promoting SFL events, including your callsign, gameplay, voice and likeness in event content and practice clips | Contract, Art. 6(1)(b) (the media terms you confirm at registration and accept at entry); legitimate interests, Art. 6(1)(f), for archival and promotional reuse | Contract, Art. 7 V; legitimate interest, Art. 7 IX |
| Publishing or licensing aggregated, anonymized statistics about the competitive field (the research-statistics checkbox) | Consent, Art. 6(1)(a); withdraw at any time (section 10) | Consent, Art. 7 I |
| Face-camera capture at qualification (broadcast only) | Consent, Art. 6(1)(a) | Consent, Art. 7 I |
| Anti-cheat and competitive integrity | Legitimate interests, Art. 6(1)(f): fair competition for every pilot | Legitimate interest, Art. 7 IX |
| Prize payment, tax documentation and withholding, sanctions screening, and identity and residence verification (duties under United States law) | Legitimate interests, Art. 6(1)(f) (compliance with legal duties outside the EU and the UK) | Legitimate interest, Art. 7 IX |
| Payment execution itself | Contract, Art. 6(1)(b) | Contract, Art. 7 V |
| News-and-events email to pilots who opt in on the account page, and SFL news to enthusiasts who sign up on the website | Consent, Art. 6(1)(a) (unsubscribe at any time) | Consent, Art. 7 I |
| Answering partnership and investor inquiries and keeping in touch about them | Legitimate interests, Art. 6(1)(f) (responding to a request you made) | Legitimate interest, Art. 7 IX |
| Measuring how the website is used, with the analytics service named in section 16 | Consent, Art. 6(1)(a), given in the cookie bar, together with the ePrivacy rules on storing information on your device | Consent, Art. 7 I |
| Running the website and your session (essential cookies), security logging and abuse prevention | Legitimate interests, Art. 6(1)(f); for your session, contract, Art. 6(1)(b) | Legitimate interest, Art. 7 IX |
| Legal claims and disputes | Legitimate interests, Art. 6(1)(f) | Art. 7 VI |
Where we rely on legitimate interests you may object (section 9). Where we rely on consent, refusing or withdrawing it carries no penalty (section 10).
SFL does not sell your account, identity, payment, tax or anti-cheat data, and never has.
SFL is preparing an optional data-licensing program. Under it, pilots who choose to take part would license some of their competition data, with names and identifiers removed, and would receive a royalty. The program is not offered today. Nothing of yours is licensed unless and until you opt in under a future version of this notice that you accept affirmatively. Silence never opts anyone in: not registering, not entering, not answering and not reading a new version are never treated as a yes. When the program is ready it will arrive as a new version of this notice with its own separate choice, and saying no will change nothing about your entry, standing or prizes. It will not be offered to anyone under 18 or under the age of majority where they live, and anti-cheat and system-inspection data will never be part of it.
Aggregated, anonymized statistics that cannot identify any individual pilot may be published or licensed today, but only under the research-statistics choice described in sections 3 and 4.
We are a US company. Data you give us and data generated on SFL servers is processed in the United States. Under EU and UK data-protection guidance, your own direct interaction with us is not a restricted transfer. Our onward flows are protected as follows:
If you are in the EU/EEA or the UK (and, under similar laws, elsewhere), you have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection to processing based on legitimate interests (Art. 21), and withdrawal of any consent you have given (Art. 7(3)). Each is free of charge.
You can withdraw any consent you have given us (the face camera, news-and-events email, the research-statistics choice, or any other consent) at any time, from your account page or by writing to [email protected]. Withdrawing is as easy as giving consent. It never affects your entry, standing or prizes.
Withdrawal is prospective. It stops the processing that rested on the consent from the moment we act on it, which we do without undue delay, and it does not undo processing that lawfully happened before. Two things cannot be unpicked: aggregated statistics already published, because they contain nothing that identifies you; and face-camera footage already in a published broadcast cut, which section 9 (erasure and the broadcast archive) covers. If you withdraw face-camera consent, we stop capturing you from the moment you tell us. If you unsubscribe from email, we keep your address on a suppression list so that we do not email you again (section 18).
Competition results, rankings, eligibility and standing are determined in part by automated scoring of telemetry against a standardized rubric. GDPR Art. 22 and LGPD Art. 20 give you rights in relation to decisions based solely on automated processing that produce legal or similarly significant effects. A human reviewer is involved in any decision that materially affects your standing, prizes or eligibility, and you may request human review of, contest, and obtain an explanation of such a decision by contacting us. We will provide clear information about the criteria and logic applied, to the extent it does not compromise competitive integrity or trade secrets.
We apply technical and organizational measures appropriate to the risk (GDPR Art. 32): encryption in transit, access controls and role separation on the competition data store, logging, and the provider controls described in section 7. The competition data store is access-restricted. No system is perfectly secure. If a breach affects you, we notify you and the authorities as the law requires (Arts. 33 and 34).
This section is for pilots who live outside the United States, the European Economic Area and the United Kingdom. Everything else in this notice applies to you too; the paragraphs below add what the law where you live asks us to say. Wherever you live, your personal data reaches the United States in two ways only: you send it to us when you register, enter and compete, and we use service providers in the United States (section 7) to host the pilot portal and the competition servers, to run registration and electronic signature, to deliver email, to process website forms and to make payments. Every request under this section goes to the section 2 contact, [email protected].
Brazil. The LGPD gives you the rights in its Articles 18 to 20: to confirm that we process your personal data and to access it, to correct it, to have data that is unnecessary or excessive anonymized, blocked or deleted, to receive it in a portable form, to know with whom we have shared it, to know what refusing consent would mean, to revoke consent, and to ask for a review of any decision made solely by automated means (we make none; see section 12). Use the section 2 contact for all of them. We confirm whether we hold your data and give you access within 15 days of your request, and you may also petition the National Data Protection Authority (ANPD). Sending us your data yourself is a direct collection by a controller located abroad, not an international transfer, and Brazilian law applies to it. Passing your data to our service providers in the United States is an international transfer, and it is permitted because it is necessary to perform the registration agreement you asked us for (LGPD Article 33, item IX, with Article 7, item V). We have no representative in Brazil. The section 2 contact is our public channel for data-protection matters, including anything you would raise with a data-protection officer (encarregado). If you are under 18, section 11 applies to you.
Canada. We collect, use and disclose your personal information with the consent you give when you register, for the purposes in section 4, and you may withdraw that consent as section 10 describes; withdrawing the consent we need to run your registration ends your registration. Your personal information is transferred to the United States and held there by us and by the service providers in section 7. There it is subject to United States law, including access by courts, law enforcement and national security authorities. You may ask for access to your personal information and for its correction through the section 2 contact; we answer within 30 days. You may complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec: your personal information is communicated outside Quebec, to the United States, only for the processing this notice describes, and only after our assessment under section 17 of the Act respecting the protection of personal information in the private sector that it receives adequate protection there. Our chief executive officer is our person in charge of the protection of personal information; reach that person through the section 2 contact. You may also ask for the information you gave us in a structured, commonly used technological format, and you may complain to the Commission d'accès à l'information du Québec.
Switzerland. The country to which your personal data is disclosed is the United States, where we and our service providers process it. We rely on Article 17(1)(b) of the Federal Act on Data Protection: the disclosure is directly connected with the performance of your registration agreement with us. You may ask for information about the personal data we hold on you, for its correction or deletion, and for the data you gave us in a common electronic format, through the section 2 contact, and you may complain to the Federal Data Protection and Information Commissioner.
Japan. Your personal data is handled in the United States by us and by our service providers, who act only on our instructions. The information you are entitled to about that handling is this: the country is the United States; the United States has no single national law on the protection of personal information, and the Personal Information Protection Commission of Japan publishes a summary of the United States system on its website; and your data is protected there by the measures in section 13 and the provider terms described in section 7. You may ask us to disclose your retained personal data, to correct, add to or delete it, and to stop using it or providing it to others, through the section 2 contact, and you may complain to the Personal Information Protection Commission of Japan.
South Korea. The personal information described in section 3 is transferred to the United States, over the internet, when you submit it and as it is generated while you compete: to us (section 1) and to our service providers for hosting and infrastructure, registration and electronic signature, email delivery, website forms and payments (section 7; their names are available through the section 2 contact), who use it only for the purposes in section 4 and keep it for the periods in section 18. We cannot run the league without processing in the United States, so the only way to refuse this transfer is not to register, or to close your account, which ends your participation. You may ask for access to your personal information, for its correction or deletion, and for suspension of its processing, through the section 2 contact, and you may complain to Korea's Personal Information Protection Commission.
Australia. Your personal information is disclosed to, and held by, recipients in the United States: us and the service providers in section 7. You may ask for access to it and for its correction through the section 2 contact, and you may complain to the Office of the Australian Information Commissioner.
Everywhere else. Wherever you live, the rights in section 9 are honored for every pilot as a matter of policy: write to the section 2 contact. Section 11 applies to every pilot under 18, whatever the age of consent where you live.
This section uses the words "sale", "sell" and "share" the way the California Consumer Privacy Act defines them. They are defined terms, and they do not match everyday English. We honor the core rights in section 9 for every pilot, whatever state or country you live in. This section adds what California law requires us to say, and it describes SFL as it operates today.
SFL does not sell or share personal information. As of the effective date of this notice, SFL does not sell personal information as California defines that word. SFL does not "share" personal information for cross-context behavioral advertising, and it runs no advertising trackers (sections 6 and 16).
Aggregated statistics are not personal information. Statistics built from groups of at least 10 pilots, with identifiers removed, meet California's definitions of aggregate consumer information and deidentified information, and California does not treat either as personal information. SFL publicly commits to keep those statistics in deidentified form and not to attempt to reidentify them. Anyone who receives them under a license is bound by contract to the same commitment.
The optional program described in section 5. If SFL launches the optional data-licensing program described in section 5, California law would treat licensed disclosures under it of session-level data (data from your own sessions, as opposed to group statistics) as a "sale"; the version of this notice that introduces the program will say so and say how to stop it; and no one is in the program without opting in affirmatively first.
The "Do Not Sell or Share My Personal Information" link. California requires this link on the homepage of a "business", as the Act defines that word, if it sells or shares personal information. As of the effective date of this notice SFL is not a "business" under the Act, because it does not meet any of the Act's thresholds. SFL checks every quarter whether it has become one. On the day it does, the link appears on the-sfl.com and leads to the privacy contact in section 2, whether or not SFL sells or shares anything by then. Nothing else in this section waits for that day: SFL honors the rights below now, whether or not the Act applies to it.
Your other California rights. If you live in California you may ask what personal information SFL has collected about you, where it came from, what it is used for and who it has been disclosed to; ask SFL to delete it or to correct it; and use these rights without being treated differently for doing so. Write to [email protected]. SFL confirms receipt within 10 business days and answers within 45 days. If a request needs more time, SFL tells you within those 45 days and takes at most 45 more. An authorized agent may act for you with your written permission. SFL may ask you to prove who you are before it discloses, corrects or deletes anything; if it cannot verify who you are, it will tell you why.
Sensitive personal information. The Act gives that term a specific meaning. The only sensitive personal information SFL collects about pilots is: the tax and identity documents needed to pay you, which SFL uses only to pay you and to meet its legal duties; the password that protects your account, which SFL uses only to sign you in; and the nationality you choose to compete under, which appears next to your callsign in rosters and brackets. SFL does not use any of it to infer anything about you.
Under 16. SFL does not sell or share the personal information of anyone, of any age. California sets a stricter rule for anyone under 16, and SFL's practice goes further than that rule: the optional program described in section 5, if it launches, will not be offered to anyone under 18.
Our website uses two kinds of cookies and similar storage. First, the cookies needed to run the site and your session, including the setting that remembers your cookie choice; these are set without asking because the site does not work without them. Second, measurement, which runs only after you accept it in the cookie bar: Google Analytics, which we use to measure how the site is used, and our own visit counter, which sets one first-party cookie (named sfl_sid, a random visitor identifier kept for 12 months) so that repeat visits are not counted twice. If you have not accepted, or your browser sends a Do Not Track or Global Privacy Control signal, the counter records the visit with no cookie and no identifier. This applies to every visitor, wherever you are. You can decline, and declining changes nothing about the site. You can change your choice at any time from the "Cookie choices" link in the site footer. We do not use advertising cookies, and we do not share site data for advertising.
Every change produces a new version number and effective date, with a change summary in the version register at the end of this notice. A change that expands what we collect or how we use it never takes effect for you by silence: it requires your affirmative acceptance, collected at your next entry gate or account-page prompt. Narrowing or neutral changes take effect on notice. The records of the consents and confirmations you give us carry the version of this notice in force when you gave them, the date and time, and the legal basis we recorded. Previous versions stay available at their own web addresses; Version 1.1 is at the-sfl.com/Privacy/sfl-privacy-v1.html.
We keep personal data no longer than needed for the purpose, then delete it or irreversibly anonymize it. Periods per category:
| Category | Period | Why |
|---|---|---|
| Account and registration data, including your profile, experience, hardware, creator and referral answers, your Discord identity and game-account identifier, and any parent or guardian name and email | Life of the account, then 24 months after it closes | dispute window; reactivation |
| Competition results and standings (published) | Indefinite | the sporting and editorial record (section 9 explains how erasure interacts with it) |
| Telemetry in identifiable form (keyed to your game-account identifier) | 36 months from the event | scoring integrity; dispute resolution |
| Broadcast footage and practice clips (published) | Indefinite archive | editorial and archival record of the sport; freedom-of-expression balance (Art. 17(3)(a); Art. 85) |
| Raw voice and communications recordings | 12 months from the event, unless preserved for a specific dispute, then until that dispute closes | adjudication window |
| Raw face-camera media (from qualification onward) | 24 months after the event, except footage that appears in a published broadcast cut (which follows the broadcast line above) and footage under a dispute hold (kept until the dispute closes). Never licensed; never enters any dataset | production and dispute window |
| Payment, tax and withholding records | As required by tax law; at least 7 years | statutory retention |
| Tax-identity documents (identity documents supporting a tax form or a payment) | 7 years from the last payment they support, then deleted | tax audit |
| Residence-check images | Deleted within 30 days of the check; we keep a dated record that the check happened | eligibility proof without holding the document |
| Consent, release and eligibility records, including the version of this notice you saw | 6 years after the processing they authorize ends | proof of consent (GDPR Art. 7(1)); proof of eligibility decisions; limitation periods |
| Anti-cheat and security logs, including website server logs | 12 months from the event, or from the visit for website logs, unless preserved for a specific investigation | abuse investigation; never licensed |
| Marketing preferences (news-and-events opt-in; enthusiast sign-up) | Until you opt out; the suppression record is kept indefinitely | honoring the opt-out |
| Website form submissions (enthusiast, partnership and investor inquiries) | Until you ask us to stop, or 24 months after our last contact with you, whichever comes first | answering and following up your inquiry |
| Website analytics data (section 16) | At most 14 months in the analytics service, then deleted or reduced to aggregate reports | measuring site use |
Withdrawal or account deletion triggers a review of every category against this table; what must be kept (tax records, consent proofs, the published archive) is kept under its stated line, and the rest is deleted.
| Version | Adopted | Effective | Summary |
|---|---|---|---|
| 1.1 | 29 June 2026 | 1 July 2026 | First published notice: GDPR and LGPD bases, contact address, rights, automated-scoring statement. |
| 2.0 | 28 September 2026 | 1 October 2026 | Current processing described in full and matched to the registration form; real retention periods; minors rule; cookies and analytics as the site runs them; transfers as they happen; California section; the data-licensing program disclosed as being prepared, not offered. |
| 2.0, corrected | 2 October 2026 | 2 October 2026 | Correction, no change to what is collected or how it is used: section 1 gives one address, the Wilmington mailing address; section 16 describes the site's own visit counter, which now sets its cookie only after you accept; one spelling fix in section 12. |