Franchise Portal1. SCOPE AND ACCOUNTABILITY
This Privacy Policy explains how Franchise Portal, operated under the Patriot Royalty brand ("Franchise Portal," "Patriot Royalty," "we," "us," or "our"), collects, uses, discloses, retains, and protects personal information when you use patriotroyalty.ca, our web applications, APIs, Discord integration, E.L.I. features, commissioner tools, and related services (the "Service").
The Privacy Officer is accountable for the privacy program and can be contacted at:
Privacy Officer, Franchise Portal / Patriot Royalty
https://patriotroyalty.ca
This Policy is intended to reflect applicable Canadian private-sector privacy requirements, including PIPEDA where it applies and Quebec private-sector privacy requirements where applicable. Additional rights may apply based on where you live.
2. INFORMATION WE COLLECT
We collect information in the following categories, depending on the features you use.
A. Account and authentication information. This may include your Google-authenticated email address, authentication user ID, sign-in/session metadata, and basic profile information made available by the authentication provider where used. We do not ask you to create or store a separate Franchise Portal password for normal Google sign-in.
B. League membership and identity information. This may include league IDs, team assignments, role/permission information, gamertag or display name, commissioner/staff status, recruiting status, and records showing when you joined, claimed, left, or were assigned to a league or team.
C. Discord integration information. If you or your commissioner enable Discord features, we may process Discord user IDs, Discord usernames/display names, guild/server IDs and names, channel/category IDs, role IDs, webhook configuration status, OAuth connection metadata, member-link status, timestamps, and automation/audit records. We use this information to verify the correct server and user, create/manage authorized league channels, deliver league notices, and mention linked owners for configured league workflows.
Current Franchise Portal Discord functionality does not require access to ordinary server message content. We do not use Discord API data for advertising, unrelated profiling, employment/housing/insurance/credit eligibility, or sale to data brokers. If we materially expand the categories of Discord API data we access, we will update this Policy and obtain any required permissions or consent before enabling that use.
D. Madden and franchise-league data. Commissioners may import rosters, schedules, standings, transactions, contracts, salary/cap data, stats, draft-pick data, team identities, franchise settings, and other game-derived league data. Much of this is gameplay or league data rather than personal information, but it can become personal information when associated with an identifiable league member, commissioner decision, team assignment, account, or communication.
E. User-provided league content. This may include custom league/team logos, league descriptions and rules, recruiting applications, commissioner notes, roster requests, evidence links, trade proposals and communications, draft-board inputs, Hall of Fame nominations/votes, committee actions, feedback, bug reports, media content, and other information you choose to submit.
F. Subscription and billing information. Stripe or another disclosed payment processor may process your payment card and billing information. Franchise Portal may receive transaction identifiers, customer/subscription identifiers, billing email, plan, status, timestamps, amounts, currency, and limited payment status information needed to unlock and administer paid features. We do not intentionally receive or store full payment-card numbers or card security codes.
G. Technical, security, and device information. Our hosting, authentication, security, and API infrastructure may process IP addresses, request timestamps, routes, HTTP status, user-agent/browser information, authentication/session events, rate-limit information, error logs, security events, and similar technical data. Franchise Portal also uses essential localStorage/sessionStorage or equivalent browser storage for authentication state, active league/team context, session-security timestamps, PWA behavior, and user preferences. We do not currently operate third-party behavioural advertising cookies on the Service.
H. E.L.I. and AI feature information. When you use E.L.I., we may process your request, limited conversation context, verified league facts relevant to the request, deterministic baseline output, and generated response. When OpenAI's API is used, the request may include only the league facts and user content necessary for the feature. Franchise Portal's current implementation sends a pseudonymous safety identifier derived from a one-way hash of the user's email rather than the raw email for that safety field, and requests that supported model responses not be stored as application state (store=false). Certain draft-video extraction features may send commissioner-provided image frames to the AI provider to extract visibly readable prospect identity fields while instructing the system not to return hidden ratings or private scouting information.
I. Legal acceptance records. When you explicitly accept the Terms and acknowledge this Privacy Policy, we may retain your authenticated user ID, email, acceptance timestamp, document versions, document hashes, and acceptance method so we can demonstrate which terms were presented and accepted. We do not need to store your raw IP address for this acceptance record.
3. HOW WE COLLECT INFORMATION
We collect information: directly from you; from commissioners or league administrators acting within their league roles; from Google/Supabase during authentication; from Discord when you authorize a server or link your Discord account; from Madden exports or commissioner-provided league files; from Stripe or another payment processor; automatically from our hosting/security infrastructure when you use the Service; and from other users when the nature of a shared league workflow requires it, such as a trade, committee action, nomination, matchup, or team assignment.
If a commissioner provides another person's personal information, the commissioner is responsible for having authority to provide it and for using Franchise Portal consistently with applicable law and league rules.
4. PURPOSES FOR USING INFORMATION
We use personal information only for reasonably necessary and identified purposes, including to: authenticate users; provide league membership and team access; enforce league and role isolation; administer permissions; import and hydrate league data; provide rosters, schedules, contracts, trades, draft, recruiting, Hall of Fame, media, and commissioner features; connect and operate Discord automation; create owner-tagged matchup channels; provide E.L.I. assistance; process subscriptions; prevent fraud and abuse; enforce session security and MFA; investigate errors and security incidents; maintain audit and integrity records; respond to support, privacy, and legal requests; improve the Service using aggregated or de-identified information where appropriate; comply with law; and establish, exercise, or defend legal rights.
We do not use personal information for a new materially incompatible purpose without obtaining consent or another lawful basis where required.
5. CONSENT AND CHOICES
Where consent is required, we seek consent in a manner appropriate to the sensitivity and purpose of the information. Some processing is necessary to provide a feature you request, such as using your authenticated account ID to provide a private league workspace or using a linked Discord user ID to mention you in an authorized matchup channel.
Optional integrations and non-essential uses are intended to be user- or commissioner-controlled. You can decline to link your individual Discord identity. An authorized commissioner can disconnect the league's Discord server. You can withdraw consent for optional processing, subject to legal or contractual restrictions and reasonable notice; doing so may prevent the related feature from working.
6. PUBLICATION AND LEAGUE VISIBILITY
Franchise Portal separates public and role-restricted information. Public features may display information such as a league name/logo, published rules, open teams, standings, published draft class, power rankings, Hall of Fame information, or commissioner-approved league news. Private or role-restricted areas may contain membership emails, private GM boards, trade communications, committee materials, administrative settings, or security data.
Commissioners are responsible for deciding what league content they publish using commissioner-controlled publishing features. We design role controls to limit access, but users must not copy or disclose information they encounter through unauthorized access or a defect.
7. WHEN WE DISCLOSE INFORMATION
We may disclose personal information only as reasonably necessary for the Service or as permitted or required by law, including:
A. Within your league. Information is shared with other league members, commissioners, or committee members according to the feature and role permissions. For example, a matchup may identify the two linked team owners, and a trade workflow may be visible to the parties and authorized reviewers.
B. Publicly at your or a commissioner's direction. Information deliberately published to a public league page or approved public news post can be viewed by others.
C. Service providers. We use providers that process information on our behalf or provide infrastructure. Depending on enabled features, these may include Supabase for authentication/database services, Vercel for hosting/serverless delivery, Google for authentication, Discord for the Discord platform and API, Stripe for billing/payment processing, OpenAI for certain E.L.I. AI functions, and database/infrastructure providers used by the platform. Providers receive only the information reasonably necessary for their role and are subject to their own contractual, security, and privacy obligations.
D. Legal, safety, and security reasons. We may disclose information if we reasonably believe disclosure is required by law, valid legal process, court order, or regulator; necessary to investigate fraud, abuse, threats, or security incidents; or necessary to protect the rights, safety, and security of users, the public, Franchise Portal, or third parties.
E. Business transfers. If the Service or its operator is involved in a merger, financing, reorganization, acquisition, sale, or transfer of assets, information may be disclosed subject to applicable privacy law and confidentiality safeguards.
We do not sell personal information. We do not sell Discord API data. We do not disclose Discord API data to advertising networks or data brokers.
8. AI PROVIDER DATA PRACTICES
When an E.L.I. feature uses OpenAI's API, selected user inputs and relevant league facts are transmitted to OpenAI to generate the requested output or perform moderation. OpenAI states that, by default, API/business inputs and outputs are not used to train its models unless the customer explicitly opts in. OpenAI may retain certain abuse-monitoring logs for a limited period under its API data controls unless different approved controls apply. We configure E.L.I. to minimize unnecessary personal information and to request store=false for supported response calls.
Do not submit unnecessary sensitive personal information to E.L.I. E.L.I. is designed for franchise-league operations, not health, financial-account, government-ID, biometric, or similarly sensitive personal data.
9. DISCORD API DATA
Discord API data is used only for the stated Franchise Portal Discord features, such as server authorization, member linking, league-channel management, permissions, posts, and matchup mentions. We do not use Discord API data to build advertising profiles, target ads, determine eligibility for employment/housing/insurance/credit/benefits, or infer protected characteristics.
We update, deactivate, or delete Discord-link information when it is no longer reasonably necessary for the enabled feature, when a user unlinks, when an authorized league disconnects, when Discord requires deletion, or when applicable law requires deletion, subject to limited security, audit, dispute, or legal-retention exceptions. Removing the bot from a Discord server does not itself delete records outside Discord; use the Franchise Portal unlink/disconnect controls or contact the Privacy Officer if you also want related Franchise Portal records reviewed for deletion.
10. CROSS-BORDER PROCESSING
Franchise Portal and its service providers may process or store information in Canada, the United States, and other countries where our providers operate. As a result, information may be subject to lawful access by courts, law-enforcement agencies, or regulators in those jurisdictions.
Where applicable law requires additional assessment or safeguards before a material cross-border transfer, we will take the required steps. Quebec residents may contact the Privacy Officer for information about categories of service providers and processing outside Quebec relevant to their information.
11. RETENTION
We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, to maintain league integrity, to satisfy legal/accounting/security requirements, and to establish or defend legal rights.
Retention varies by category. Active account and membership information is generally kept while the account or league relationship remains active. Discord-link records are deactivated when unlinked or disconnected and are retained only as long as reasonably necessary for audit, security, dispute resolution, or lawful operational needs. Security, import, moderation, and administrative audit records may be retained longer than ordinary feature data where they are necessary to investigate abuse, preserve league integrity, or demonstrate authorized actions. Subscription and payment records may be retained for tax, accounting, fraud-prevention, and legal requirements. Legal-acceptance records may be retained as evidence of the agreement even after account closure where reasonably necessary to establish or defend legal rights. Backups and disaster-recovery copies may persist for a limited period after deletion from active systems.
League history may be preserved in archived form at a commissioner's request. If archived league history contains personal information about you, you can ask us to review whether that information should be deleted, corrected, restricted, or de-identified, subject to other users' rights, league-integrity needs, and legal exceptions.
You may contact the Privacy Officer for more specific information about the expected retention of a category of personal information associated with your account.
12. SECURITY
We use administrative, technical, and organizational safeguards appropriate to the nature of the Service and the sensitivity of the data. These include authenticated access, role and league isolation, server-mediated privileged actions, row-level database security where applicable, restricted service credentials, HTTPS, session controls, rate limiting, audit logging, and additional step-up verification for privileged functions.
No system can guarantee absolute security. You are responsible for protecting your Google and Discord accounts, devices, session access, commissioner credentials, and league import tokens. Do not send us passwords, bot tokens, payment-card details, or unnecessary sensitive information in support requests.
13. PRIVACY AND SECURITY INCIDENTS
We maintain processes to investigate suspected privacy and security incidents. If an incident involving personal information creates a notification obligation under applicable law, we will notify affected individuals and regulators as required. We may also preserve incident records where required by law.
14. YOUR PRIVACY RIGHTS
Depending on where you live and which law applies, you may have rights to: know whether we hold personal information about you; access that information; understand how it has been used and to whom it has been disclosed; correct inaccurate or incomplete information; withdraw consent for optional uses; request deletion or de-identification where applicable; request restriction or objection to certain processing; receive portable information where applicable; request cessation of dissemination, de-indexing, or re-indexing where applicable; and challenge our compliance or complain to a privacy regulator.
To exercise a right, contact privacy@patriotroyalty.ca. We may need to verify your identity before releasing or changing account information. We will not ask you to provide your Google or Discord password. Where PIPEDA applies, we aim to respond to access requests within the statutory timeframe, generally 30 days, subject to lawful extensions and exceptions.
Some requests may be limited by law or by the rights of others. For example, we may need to redact another person's personal information, retain records needed for fraud/security/legal claims, or preserve non-personal gameplay records that form part of shared league history. If we cannot fully comply, we will explain the reason where required.
15. QUEBEC-SPECIFIC INFORMATION
Where Quebec private-sector privacy law applies, the Privacy Officer named in Section 1 is the person responsible for the protection of personal information for Franchise Portal unless that responsibility is formally delegated. We seek clear consent for required purposes, use privacy-protective defaults where applicable, and maintain policies/practices for the lifecycle of personal information.
Quebec residents may have additional rights under applicable law, including rights concerning access, correction, portability in applicable circumstances, and cessation of dissemination or de-indexing/re-indexing in qualifying cases. We will also address confidentiality incidents and privacy-impact obligations as required by applicable Quebec law.
16. EEA/UK AND OTHER JURISDICTIONS
If European Economic Area or United Kingdom data-protection law applies to a particular processing activity, our legal bases may include performance of a contract, consent, compliance with legal obligations, and legitimate interests such as security, fraud prevention, service integrity, and product operation, balanced against your rights. Applicable rights may include access, correction, deletion, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.
If a U.S. state privacy law applies, you may have rights to access, know, correct, delete, or obtain a copy of personal information and to opt out of certain sale, sharing, targeted advertising, or profiling. Franchise Portal does not sell personal information and does not use personal information for cross-context behavioural advertising as those concepts are commonly used in U.S. state privacy laws.
17. CHILDREN AND TEEN USERS
The Service is not directed to children under 13 or a higher minimum digital-consent age required by local law. We do not knowingly use Discord API data of persons below Discord's applicable minimum age. In Quebec, a user under 14 may not create an account or link Discord data unless a legally valid parental/guardian authorization process is available.
If you believe we collected personal information from a person who was not legally eligible to provide it, contact the Privacy Officer so we can investigate and take appropriate action.
18. COOKIES, LOCAL STORAGE, AND TRACKING
We use essential browser technologies such as cookies or local/session storage to maintain authentication, protect sessions, remember active league/team context, support PWA installation, and preserve necessary user preferences. Authentication providers may also use their own essential cookies or tokens.
We do not currently use Franchise Portal personal information for behavioural advertising or sell information to advertising networks. Because of that, browser "Do Not Track" or Global Privacy Control signals do not change a sale/targeted-advertising practice that we do not conduct. If that changes, we will update this Policy and implement legally required choices before the change takes effect.
19. AUTOMATED ANALYSIS AND DECISIONS
Franchise Portal uses automated calculations and AI-assisted analysis for gameplay features such as power rankings, predictions, roster intelligence, E.L.I. responses, and content suggestions. These features are intended for entertainment and league operations. We do not use E.L.I. or gameplay rankings to make solely automated decisions that produce legal or similarly significant effects about employment, credit, housing, insurance, or government benefits.
20. THIRD-PARTY LINKS AND SERVICES
The Service may link to third-party sites or embed third-party functionality. Their privacy practices are governed by their own policies. We encourage you to review the privacy terms of Google, Discord, Stripe, OpenAI, and any other service you choose to connect.
21. CHANGES TO THIS POLICY
We may update this Policy when our practices, providers, legal obligations, or features change. We will update the date at the top. For material changes, we will provide additional notice appropriate to the change and seek renewed consent where required. Versioned authenticated acceptance records may be used when a change should be expressly acknowledged.
22. QUESTIONS, COMPLAINTS, AND REQUESTS
Privacy Officer
Franchise Portal / Patriot Royalty
Email: privacy@patriotroyalty.ca
Website: https://patriotroyalty.ca
Please include enough information to identify your account or league and the nature of your request, but do not send passwords, OAuth tokens, Discord bot tokens, payment-card numbers, or unnecessary sensitive personal information.
If you are not satisfied with our response, you may have the right to complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, or another privacy regulator with jurisdiction over your complaint.