What we hold, and why

Vetta is built and run by one person in Italy. It is not a company, and it is not connected to any other product or business. That person is the data controller for everything described below.

Vetta is free today — no subscriptions, no adverts, and no revenue of any kind. That may change if it ever becomes a company, but if it does, this page changes before anything else does. For now, nothing here is a preamble to selling you something.

For any question, request or complaint about your data, write to [CONTACT EMAIL — CONFIRM BEFORE LAUNCH]. We answer within one month, as the GDPR requires — and that includes asking who the operator is, if you want a name to go with the address.

Game data from Riot. When you or anyone else looks up a summoner, we request that player’s public game data from Riot’s official API: their Riot ID, match history, ranked standing, and the per-game statistics Riot publishes. Because a League match has ten players, the same public data for the other nine appears in any match we analyse.

We also store Riot’s internal account identifier (the PUUID) so we can ask Riot about the right player. It is kept server-side only and is never sent to your browser, in either direction — Riot’s policy requires this and our code enforces it.

Account data, only if you make an account. Your email address and a password hash (argon2id — we never store the password itself), or, if you sign in with Discord or Google, the account identifier and email that provider gives us. We do not receive your password from them.

A session cookie. One cookie, named vetta_session, holding an opaque token that tells us you are signed in. It is not an advertising or tracking cookie, and we do not use it to follow you across other sites. It is the only cookie we set.

Server logs. Like any web server, ours records the requests it receives — including your IP address, the page you asked for, and your browser’s user-agent string. We use these to keep the service up and to spot abuse, and nothing else.

To give you coaching. Analysing your matches and producing verdicts, evidence and drills is the service itself. Where you have an account, this is performance of our contract with you.

To build benchmarks. We keep game data from many players so we can say things like “top 20% of Emerald junglers”. A percentile is meaningless without a population to compare against. Our basis is legitimate interest: the data is public game data published by Riot, it is aggregated into statistical distributions, and the outcome — accurate rather than invented comparisons — is the point of the product.

To run accounts and keep them secure. Sign-in, sessions, and password resets, where you have an account.

The written verdicts on your matches are drafted by a large language model. To do that, we send match context to our AI provider — currently Anthropic and/or Google, depending on configuration — over their API.

Two things worth knowing. First, the analysis itself is deterministic and runs on our own servers; the model narrates conclusions we already computed, it does not compute them. Second, our providers are contracted not to train their models on data sent through their APIs.

We do not send your email address, your password, or your account identity to any AI provider.

Three parties, and no others: Riot Games, whose API is the source of all game data; our AI provider, as described above; and our hosting provider, whose servers are in the European Union.

No advertisers, no analytics companies, no data brokers. Vetta carries no adverts and no third-party trackers, so there is nobody else in the chain.

Vetta runs on servers in the European Union, and that is where your data lives.

One exception: the AI provider that drafts match verdicts is based in the United States, so match context crosses the Atlantic to reach it. That transfer is covered by the data processing agreement and Standard Contractual Clauses we hold with that provider — the mechanism the GDPR provides for exactly this situation.

Nothing else leaves the EU.

No. We do not sell your data, rent it, or trade it. Vetta is free and carries no advertising today, so nothing here trades on who you are.

If that ever changes, this page changes first, and we will say so plainly rather than quietly reissuing it.

Traffic to Vetta is encrypted in transit. Passwords are stored as argon2id hashes, never as passwords. Riot’s account identifiers stay on the server and are never exposed to a browser. The databases are not reachable from the internet — only the application can talk to them.

No system is perfect, and we would rather say so than imply otherwise. If you find a security problem, please write to us before writing about it publicly, and we will fix it.

Game data is retained while it remains statistically useful — a match from several patches ago no longer describes the current game, and we drop it. Analyses of your own matches are kept while your account exists so your history stays intact.

Account data is kept until you delete your account, after which we remove it.

Under the GDPR you can ask us for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict or stop processing it, and ask for it in a portable format. You can object to processing we base on legitimate interest, including the benchmark corpus described above.

Write to [CONTACT EMAIL — CONFIRM BEFORE LAUNCH] and we will act within one month. You can also delete your account yourself at any time from your account page.

If you think we have handled your data badly, you have the right to complain to your national data protection authority.

Riot passes deletion requests to developers who use their API. When Riot tells us that a player has asked for their data to be deleted, we remove that player’s data from our systems — you do not need to contact us separately, and you do not need a Vetta account for this to apply to you.

Vetta is not directed at children under 16, and we do not knowingly hold their personal data. If you believe a child’s data is here, write to us and we will remove it.

We update this notice when what we do changes. The date at the top of this page is the last substantive revision. If a change matters to you, we will say so rather than quietly reissue the page.