Privacy Policy

Who we are

StageOne Systems ("StageOne", "we", "us"), Kråkstad, Norway, operates the platform and is the data controller for the processing described in this policy.

For any privacy question or to exercise your rights, contact us at privacy@stageone.systems. General support is at support@stageone.systems; a request sent to either address is treated as validly made.

Your club and federation as controllers

Your club and federation decide which member data they record and are independent controllers for their own member register, member numbers, invoices, forum and the documents they upload, and for how they use the platform. StageOne is the controller for the platform itself: accounts, competition records, security and audit data, and the support and billing relationship with you and your organisation.

Some data reaches us from your organisation rather than from you, for example when a club imports its member register or historical series results. Where that creates or changes a membership for you, we email you, name the organisation the data came from, and link you to your privacy settings.

The personal data we collect

We collect the following categories of personal data:

• Account data: your name, email address, phone number, postal address, date of birth, competition category (senior, junior or ladies), country, preferred language, a profile picture if you upload one, and the club and federation memberships and member numbers linked to your account. Your name, phone number, postal address and country are mandatory: we ask for them once, on a setup screen after you sign up, and the account cannot be used until they are given. Date of birth is optional, and the only consequence of leaving it out is that you cannot be placed in an age-based membership rate. Everything else in this list is optional or is created by using the service.
• Competition data: match registrations and invitations, squad assignments and check-in, scores and the shot log, published results, disciplinary cards (severity, stage, date, the written reason and the issuing official), classifications and grades, series standings and Series Wrapped recaps.
• Organisational data: membership invitations, forum posts, replies and attachments, board and committee offices you hold, governance documents your organisation uploads, match roles and staff entries, and member records imported by your organisation.
• Payment data: payments are processed by Stripe and we never store your full card number. We keep invoice and credit-note records, payment references, refund and dispute records and, if you consent to saved-card charges for an organisation, the Stripe references for that card together with your consent record.
• Equipment data: if you use the inventory feature, the firearms, barrels and other components, round counts, range sessions, load recipes, component lots, brass and ammunition you record. This is private to you and visible to no other user, and any serial number you enter is stored encrypted.
• Security data: two-factor authentication settings, hashed recovery codes, trusted-device records, the links behind your digital membership card and personal calendar feed, and hashed API keys issued to your organisation.
• Technical data: IP address, browser and device information and request paths in server logs, and an audit log of significant actions (for example score submissions, role changes, payments and state transitions), kept for security and accountability.
• Notifications: the in-app notifications and emails we have sent you, including whether they were delivered.

Why we process your data, and our legal bases

We rely on the following legal bases under the GDPR:

• To provide the service - creating your account, registering you for matches, recording scores, publishing results, calculating grades and standings, issuing invoices and sending the reminders they require, and notifying you about the matches and organisations you belong to (Art. 6(1)(b), performance of a contract). The mandatory account data named above rests on the same basis: entry lists, results, membership records and invoices identify a person rather than a username, so we collect it once at the start rather than asking again at each step.
• To meet legal obligations - retaining invoices and accounting records as required by the Norwegian Bookkeeping Act (bokføringsloven), and keeping the consent record for saved-card charges (Art. 6(1)(c)).
• For our legitimate interests - keeping the platform secure, preventing fraud, abuse and payment disputes, maintaining audit and server logs, and improving the product through privacy-respecting analytics (Art. 6(1)(f)).
• With your consent - where we ask for it specifically, such as saved-card charges for an organisation or the public Series Wrapped share cards; you may withdraw consent at any time (Art. 6(1)(a)).

Public information

Some information is intentionally public so that competitions work. Anyone, including people who are not signed in, may see your shooter profile with your name, profile picture, clubs and federations, federation member number, grade and category, country, and your published results and series standings. Exposing a federation member number is comparable to a sporting licence. Club member numbers are not public; they are visible only to administrators of that club and to you.

If a match official issues a disciplinary card against you, its severity (warning or disqualification) is shown wherever your zeroed score is shown, including published results, the live standings and your public profile. The written reason and the deciding official are not public.

While a match is in progress, anyone may follow its provisional live standings; viewers who are not signed in see first names and countries only.

For public matches and completed series we generate shareable image cards showing your name and placement, served from a public link so they can be posted on social media. You can opt out of the public Series Wrapped cards in your privacy settings.

If you enable your digital membership card, its QR code opens a page that anyone holding the card can view, showing your name, organisation, federation member number and grade. You can turn the card off or rotate its link at any time.

The names of board and committee office holders are shown on the organisation’s public page, and a match director’s name and any phone number they choose to provide are shown on the public match page.

We offer a read-only public API that lets approved third parties retrieve published match and stage information. It contains no names, contact details or other personal data.

Information visible to other members

Some information is shared within the organisations you belong to without being public. In a club or federation member directory, your name, email address and phone number are visible to other active members of that same organisation, so that members can contact one another. It is not shown to people who are not signed in, and not to members of organisations you do not belong to. You can hide yourself from the directories of other clubs in your federation under Settings, then Privacy and data.

When you post in an organisation’s forum, your posts, replies, attachments and profile name are visible to the members who can access that forum. If you mention another member with "@", they are notified by email and in the app.

Match directors and range officers of a match you are registered for see your registration, squad, check-in, payment status and scores; a range officer can also issue a disciplinary card and see its reason.

Who we share data with

We use carefully selected service providers ("processors") who act on our instructions. We do not sell your personal data, and we share data with public authorities only where legally required. Our processors are:

• Fly.io - application hosting in Frankfurt (EU).
• Supabase - authentication and database hosting (EU).
• Upstash - job queues and caching (EU). Job payloads can briefly contain email addresses, one-time codes and the text of emails about to be sent, and are kept for up to 24 hours.
• Stripe - payment processing, payouts to organisations and saved-card mandates. Vipps is offered as a payment method through Stripe.
• Resend - transactional email delivery.
• Tigris - file and document storage in Frankfurt (EU), for example invoice PDFs, profile pictures and forum attachments.
• Better Stack - storage of server logs (which include IP addresses and request paths) and our public status page.
• Sentry - error monitoring (EU), with personal data removed from reports before they are sent.
• PostHog - product analytics (EU).
• Google - if you choose to sign in with Google, Google processes your sign-in and shares your email address and name with us.

Where your data is stored

We store and process personal data within the EU/EEA. We choose service providers and regions that keep data inside the EU/EEA, and we do not transfer your personal data outside the EU/EEA without a lawful transfer mechanism.

How long we keep your data

We keep account and competition data while your account is active and for as long as needed for the purposes above. Published results are records of events and are retained as part of the service.

Invoices, credit notes and accounting records are retained for five years as required by the Norwegian Bookkeeping Act, even after you delete your account. Records of automated payment reminders and charge attempts are kept for one year after they are settled.

When you delete your account, the change takes effect immediately and cannot be undone. We pseudonymise your profile, removing identifying details such as your name, email, phone, address, date of birth, profile picture and security secrets, while retaining the records the law or the integrity of published results require. Audit-log entries are retained indefinitely for accountability, with personal data redacted when they are displayed.

Trusted devices expire after 90 days, membership invitations after 14 days, and queued job data after at most 24 hours. Server logs and error reports are kept for a limited period for security and troubleshooting.

Encrypted database backups are kept for 7 days and allow us to restore the service to any point in that window. If a restore is ever needed, we re-apply every account erasure that fell inside the restored window.

Cookies and similar technologies

We use a small number of strictly necessary cookies: a session cookie that keeps you signed in, a language-preference cookie (kept for one year), a trusted-device cookie for two-factor authentication (kept for 90 days) and a short-lived cookie used during password reset. All are HttpOnly and cannot be read by scripts.

In the signed-in part of the service, our analytics tool PostHog stores an identifier in a cookie and in your browser’s local storage so that visits can be linked to your account. It records page paths and a small set of product events keyed to your account identifier, with all text and form inputs masked; it never records your name, email, phone, scores or payment amounts. You can block these cookies in your browser without losing any function.

Security

We protect your data with measures including encryption in transit, access controls enforced in the application on every request so that organisations can only reach their own data, encryption at rest for particularly sensitive fields such as firearm serial numbers and two-factor secrets, hashing of recovery codes, API keys and feed links, mandatory two-factor authentication for administrative roles, audit logging, and EU-based hosting. No system is perfectly secure, but we work continuously to safeguard your data.

If a personal-data breach is likely to result in a high risk to your rights, we will notify you without undue delay, and we will notify the Norwegian Data Protection Authority within 72 hours as the GDPR requires.

Automated grade calculation

Your classification grade is calculated automatically from your best results in a federation’s series, using the grade ladder that federation has set. The calculation is started by a federation administrator, it never lowers an existing grade, and the result is shown on your public profile. If you think your grade is wrong, contact your federation; you can also contact us at privacy@stageone.systems.

Children and young athletes

Shooting sport includes junior competitors. We do not verify age at sign-up and we do not collect a separate parental consent. If you are under the age at which you can consent to online services on your own under Norwegian law, a parent or guardian must set up and manage your account and agree to this policy on your behalf; in practice this normally happens through the club that registers you. Date of birth is optional. We use it for competition category and eligibility, and a federation may use it to place you in an age-based membership fee band - so giving it can change the fee you are invoiced, and withholding it means junior and senior rates cannot apply to you. You can add or remove it at any time from your profile.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to processing, and receive a copy in a portable format. Much of this you can do directly: edit your profile, download a machine-readable copy of your data and request erasure under Settings, then Privacy and data, where you can also opt out of public Series Wrapped cards and of federation directory listing. Very long lists in the download are capped at 5,000 entries per category, and we supply the remainder on request. For anything else, contact privacy@stageone.systems.

Erasure is refused while you are the only administrator of an organisation or the match director of a match in progress; hand over first and try again.

You also have the right to lodge a complaint with the Norwegian Data Protection Authority (Datatilsynet, www.datatilsynet.no).

Changes to this policy

We may update this policy from time to time. When we make material changes we will update the "Last updated" date and, where appropriate, notify you.

Contact

Privacy requests: privacy@stageone.systems. General support: support@stageone.systems. StageOne Systems, Kråkstad, Norway.