PRIVACY POLICY

LYRAX Gaming ("LYRAX", "we", "us") operates lyrax.lk, a Sri Lankan esports platform for gaming tournaments, gaming cafes, events, organizations, and competitive communities. This policy explains what personal data we process and why. For any privacy question or request, contact us at info@lyrax.lk or via our contact form.

We process personal data in line with the Sri Lanka Personal Data Protection Act No. 9 of 2022 ("PDPA").

Data you provide directly:

• Account data: username, email address, password (stored as a salted hash), avatar image.
• Sign-in with Google or Discord: name, email, and profile picture shared by those providers.
• Tournament and team registrations: team names, player names/IDs, contact details.
• Gaming cafe and organization registrations: business name, address, phone, owner details.
• Community posts, reviews, support chat messages, and contact form submissions.
• Images and files you upload (logos, banners, proof documents).

Data collected automatically:

• Usage analytics via Microsoft Clarity (session replays, heatmaps, device and browser information, approximate location from IP) — loaded only after you accept analytics cookies in our consent banner.
• Server logs (IP address, request time, user agent) kept for security and abuse prevention.

• To create and manage your account, and authenticate sign-ins (performance of a contract).
• To run tournaments, events, bookings, and registrations you take part in.
• To list approved gaming cafes and organizations publicly.
• To respond to support and contact requests.
• To secure the platform — rate limiting, fraud and abuse prevention (legitimate interest).
• To improve the product through aggregated analytics (consent).

Data is stored in our MongoDB database hosted on our own virtual private server. Account data is kept while your account is active. Tournament, event, and financial records are kept as long as required for dispute resolution and legal obligations. Support conversations and contact messages are kept for up to 24 months. You may request deletion at any time (see Section 6).

We never sell your personal data. We share data only with:

• Microsoft Clarity (analytics processor, consent-gated — see our Cookie Policy).
• Our email delivery provider, to send verification, invite, and notification emails.
• Google / Discord, only when you choose to sign in with them.
• Authorities, where disclosure is required by Sri Lankan law.

Public content — tournament rosters, team names, organization and cafe profiles, community posts, and reviews — is visible to other visitors by design.

Under the PDPA you have the right to:

• Access a copy of the personal data we hold about you.
• Request correction of inaccurate or incomplete data.
• Request erasure of your data ("right to be forgotten"), subject to legal retention duties.
• Withdraw consent for analytics at any time (see the Cookie Policy page).
• Object to processing based on legitimate interest.

To exercise any right, email info@lyrax.lk or use the contact form. We respond within 21 working days.

We use strictly necessary cookies for sign-in sessions and optional analytics cookies for Microsoft Clarity. Full details, including how to withdraw consent, are in our Cookie Policy.

lyrax.lk is not directed at children under 16. Tournament participation may have its own age rules set by organizers. If you believe a child has provided us personal data without guardian consent, contact us and we will delete it.

We may update this policy as the platform evolves. Material changes will be announced on the site. The "Last updated" date above always reflects the current version.