Privacy Policy

1. About This Policy

Valor Esports Pty Ltd ABN 94 648 832 080 (Australia) and Valor US Operations, Inc. (Delaware, United States) are referred to together in this Privacy Policy as Valor, we, us or our. The Valor entity responsible for a particular school service is identified in the applicable order, service agreement or data privacy agreement.

Valor provides a browser-based esports training and educational platform used by schools, teachers and students (the Platform). We also operate the website at valoresports.com (the Website). The Platform and Website are referred to together as the Services.

This Privacy Policy explains the categories of information we receive, generate, use, disclose, store and retain through the Services. It also explains the choices and rights available to schools, parents, students, account holders and Website visitors.

Valor handles information having regard to applicable privacy and student-data laws, which may include the Children’s Online Privacy Protection Act (COPPA), the Family Educational Rights and Privacy Act (FERPA), United States state student-privacy laws, the General Data Protection Regulation (GDPR), the UK GDPR, the Privacy Act 1988 (Cth) and the Australian Privacy Principles. The law that applies depends on the user, school, location, contracting entity and particular processing activity.

Questions and rights requests may be sent to:
Email: corporate@valoresports.com
Post: Privacy Officer, Valor Esports, PO Box 1977, Sunnybank Hills QLD 4109, Australia

2. Account and Access Arrangements

2.1 Standard School Accounts

Teachers and authorised school personnel create and manage Standard school accounts. Students cannot independently register a school account.

A Standard student account normally includes:

1. a persistent Valor user identifier;
2. a school or organisation membership;
3. a randomly generated username;
4. a sign-in PIN; and
5. a selected preset avatar or character identifier.

Schools can change usernames and may include identifying information, such as a name or identifier. We treat this information as Student Data.

Schools should avoid entering unnecessary personal information into student usernames and should use the generated pseudonymous format where practicable.

We do not ask students to provide their date of birth, age, home address, telephone number, parent contact information, photograph, voice recording, biometric identifier or government identifier when creating a Standard school account.

2.2 Clever Single Sign-On Accounts

Where a school or district authorises Clever single sign-on, we receive the user’s Clever identifier, district identifier, role, email address, first name and last name.

For a Clever student account:

1. Valor retains the Clever user ID and district ID;
2. the student’s real email address is received during the sign-in process but is not retained as the Valor account email;
3. the Valor account uses an internally generated email address rather than the student's real email address; and
4. the username contains the student’s first name and last initial.

We do not receive date of birth, physical address, telephone number, grade, homeroom, course schedule, or parent or guardian contact information through Clever sign-in.

3. Information We Process

3.1 Account, School and Identity Information

Depending on the account arrangement, Valor processes:

1. persistent Valor user ID;
2. account email address, including internally generated addresses for school students and real email addresses for other account holders;
3. username, including generated, school-entered or Clever-derived usernames;
4. account group, organisation membership, role, status and permissions;
5. school-assigned group and class labels;
6. school or organisation identifiers, name, country and related account settings;
7. hashed student PIN where used;
8. authentication and session information;
9. preset avatar or character identifier; and
10. for Clever single sign-on, the identifiers and identity information described in Section 2.2.

3.2 Learning, Assessment, Performance and Engagement Information

Valor generates and stores Platform records linked to a persistent Valor user ID, including:

1. learning-path enrolment, progress, status and completion;
2. practice-session activity and completion;
3. drill, quiz, interactive-activity, interactive-game and assessment answers, results and scores;
4. skill ratings and performance measures;
5. game rewards, Valor Coin or wallet balances and content favourites;
6. timestamps, activity counts, session ratings and local timezone; and
7. other structured records necessary to deliver the educational activities and show progress to authorised school users.

3.3 Wellbeing Check-Ins

The Platform may ask students short questions about excitement, challenge, confidence and focus. Responses are stored individually and linked to the student’s account.

These check-ins are educational and non-clinical. Valor does not monitor responses in real time or provide counselling, diagnosis, crisis intervention or emergency services. Schools are responsible for interpreting responses in context and should not use a response as the sole basis for a diagnosis, disciplinary decision or other high-impact determination.

Valor treats individual wellbeing responses as restricted Student Data. Depending on the circumstances and applicable law, they may also require heightened treatment as sensitive or health-related information.

3.4 Teacher, Administrator and School-Contact Information

For teachers, administrators and school contacts, Valor may process:

1. name, email address, username and role;
2. school and organisation information;
3. account preferences and email preferences;
4. optional profile information supplied by the adult account holder;
5. support communications; and
6. relationship, subscription, licence, reseller and service-administration information.

3.5 Technical, Cookie, Analytics and Log Information

The Services may process:

1. IP address and network information;
2. browser, device and operating-system information;
3. page views, clicks, inputs, navigation and other usage events;
4. timestamps, referring URLs and session information;
5. cookie or local-storage identifiers;
6. application request, response and diagnostic logs; and
7. a persistent analytics identifier linked to a Valor account.

Valor uses PostHog for product analytics. PostHog may receive a persistent account identifier, account email address, school or organisation information and Platform usage events. School student accounts and other accounts assigned the Member role use internally generated email addresses; other accounts may use real email addresses. This information can be linked to a Valor account and is not anonymous. Valor does not intentionally send PostHog students’ Clever or district identifiers, separate full-name fields or real school-student email addresses.

For organisation members and Clever users, the IP address included in analytics events is replaced with a placeholder. PostHog may process real IP addresses for users who are not organisation members and do not sign in through Clever.

The Website uses a cookie banner to manage choices about non-essential cookies and similar technologies. Essential technologies support security and operation of the Services.

3.6 Student-Generated Content and Communications

The school Platform does not offer student messaging, chat, free-text profiles or portfolios, or allow students to upload images, audio, video or other files.

4. How We Use Information

Valor uses information to:

1. create, authenticate, administer and secure accounts;
2. provide schools with authorised student and class access;
3. deliver training, learning activities, assessments and feedback;
4. record and display progress, performance and completion;
5. provide school-managed wellbeing, analytics, class-management and reward features;
6. maintain, troubleshoot, support and secure the Services;
7. communicate with teachers, administrators, schools and account holders;
8. conduct service analytics and understand feature usage;
9. improve the quality, safety and usability of the Services;
10. manage licences, subscriptions, entitlements and business relationships;
11. comply with law, lawful process and enforceable agreements; and
12. protect the rights, safety, security and integrity of Valor, schools, users and the public.

Valor does not sell Student Data, use Student Data for targeted advertising, send marketing email to school student accounts, or build advertising profiles about students across unrelated services.

5. Aggregated and De-Identified Information

Valor may create aggregate statistics or de-identified information for service improvement, research, reporting and demonstrating Platform outcomes.

Information is not treated as anonymous merely because it uses a pseudonymous identifier. Valor treats information as de-identified only when reasonable measures have been taken to prevent it from identifying or being re-associated with an individual, and Valor does not attempt to re-identify it except to test or maintain the effectiveness of de-identification or as permitted by law.

When we create de-identified information, we aggregate records and delete the underlying individual-level records so that no record that could be re-associated with a student remains. Changing identifiers alone does not make information de-identified.

Where aggregation would produce a group so small that it could effectively identify an individual, Valor will merge the records with a larger group or suppress them.

Where a school agreement restricts the creation, retention or use of de-identified information, the applicable agreement controls for that school’s Student Data.

6. Service Providers, Integrations and Disclosures

Valor uses service providers to operate and support the Services. Current material providers include:

1. Amazon Web Services (AWS): account authentication, cloud hosting, storage and related application and logging services. AWS processes account, Platform and technical information needed to provide these services. Core production resources are hosted in the United States.
2. Neon: database hosting for learning, performance, assessment, wellbeing, membership and related Platform records. The production database is hosted in the United States.
3. PostHog: product analytics using the account and usage information described in Section 3.5. Valor uses PostHog’s United States service.
4. Bunny Stream: hosting and delivery of Valor’s video content through a global content-delivery network. Valor does not intentionally send student identity to Bunny Stream, although Bunny may receive ordinary network-request information such as IP address and browser metadata when delivering video.
5. FreshDesk: support services using information submitted by the person requesting help. Student records are not automatically transferred from the Platform.
6. Zoho CRM: school and organisation relationship management, including contact details for school managers and coaches. The automated transfer excludes school students and other accounts assigned the Member role.
7. ZeptoMail: transactional email for teacher and staff account communications. It is not used to send marketing email to school student accounts.

Other business providers, including Xero, Google Workspace and SiteGround, may process school or customer contact details, invoicing information, business correspondence, support material or Website traffic information. They are not intended to receive school student records through automated Platform data flows.

Clever acts as a school- or district-authorised identity intermediary where that integration is enabled. The district’s separate relationship with Clever is governed by the district’s arrangements with Clever.

Valor may also disclose information:

1. as directed or authorised by the relevant school, district or account holder;
2. to service providers supporting the purposes described in this Privacy Policy;
3. where required by law, court order or lawful government request;
4. where reasonably necessary to investigate fraud, security incidents or misuse, or to protect rights and safety; or
5. in connection with a corporate transaction, subject to applicable confidentiality, privacy and student-data obligations.

7. Children’s Privacy and COPPA

7.1 School-Managed Accounts

Valor knows that school-managed users may include children under 13. For school-managed educational use, Valor relies on the school or district to provide or obtain the authority required for Valor to collect and use children’s information in the educational context, where COPPA permits the school to act as the parent’s agent.

School authority is limited to the educational context and the purposes authorised by the school. It does not authorise use of children’s information for targeted advertising or unrelated commercial purposes.

A school’s authority to consent to collection and use is distinct from any authorisation required for disclosure to a third party. Applicable school terms, orders or data privacy agreements may record disclosure choices and restrictions.

7.2 Information Collected From or About Children

Depending on the school account arrangement, the categories may include:

1. the account and school information in Sections 2 and 3;
2. persistent identifiers, technical information and cookies;
3. learning, assessment, performance, rewards and engagement records;
4. individual wellbeing check-in responses;
5. Clever identity information described in Section 2.2; and
6. school-entered identifying information in the username field.

7.3 Parent and Guardian Rights

Subject to applicable law, a parent or legal guardian may ask to:

1. review the personal information collected from or about their child;
2. correct inaccurate information;
3. request deletion;
4. refuse further collection or use; or
5. withdraw permission for continued use.

Parents should normally begin with the school or district, which can verify the requester’s relationship to the student and coordinate the request with Valor. A parent may also contact Valor using “COPPA Request” in the subject line. Valor may refer a direct request to the school for identity and authority verification.

Preventing further collection may require the school to disable the student’s Platform account.

8. FERPA and School Education Records

Where a United States school or district designates Valor as a “school official” under FERPA, that designation and the school’s direct control over the use and maintenance of education records are established through the applicable agreement and the school’s own FERPA criteria.

For those services, Valor:

1. performs an institutional service or function for which the school would otherwise use its own personnel;
2. uses education records only for the school-authorised educational purposes;
3. remains under the school or district’s direct control regarding the use and maintenance of education records; and
4. does not re-disclose education records except as authorised by the agreement or permitted by FERPA, including 34 C.F.R. § 99.33.

Parents and eligible students should generally direct FERPA access, correction and complaint requests to the school or district, which maintains authority over the education records.

9. International and Regional Privacy Rights

9.1 European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies, the controller and processor roles depend on the processing activity. A school or district will generally determine the purposes of school-authorised Student Data processing, with Valor acting as its processor. Valor may act as a controller for its own Website, account administration, security, legal compliance and business-contact processing.

The applicable legal basis may include performance of a contract, compliance with legal obligations, legitimate interests, consent, or a basis identified by the relevant school as controller. Schools are responsible for identifying the legal basis for processing they direct.

Subject to applicable law, individuals may have rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent. Requests involving school-controlled Student Data may be referred to the school.
Personal data may be processed in the United States and other countries where Valor or its service providers operate. Valor will use the transfer mechanism and safeguards required by applicable law and the relevant contractual arrangements. Contact Valor for information about safeguards applicable to a particular transfer.

9.2 Australia

Valor Esports Pty Ltd handles personal information having regard to the Privacy Act 1988 (Cth) and the Australian Privacy Principles where they apply.

Individuals may request access to or correction of personal information and may complain about Valor’s handling of personal information. Valor will respond within a reasonable period and may need to verify identity and authority before acting.

Personal information may be disclosed to recipients outside Australia, including service providers in the United States and other locations described in Sections 6 and 11.

A person who is not satisfied with Valor’s response may be able to complain to the Office of the Australian Information Commissioner at oaic.gov.au.

10. Security

Valor uses administrative, technical and organisational safeguards intended to protect information against unauthorised access, disclosure, alteration, loss and destruction. These include:

1. encrypted connections for core customer-facing Platform and API traffic;
2. one-way hashing of Standard student sign-in PINs;
3. access controls based on user roles and school or organisation membership;
4. managed cloud infrastructure;
5. secure storage of production database credentials; and
6. application and infrastructure logs.

No internet-based service can guarantee absolute security. Schools and users should protect credentials and promptly report suspected compromise to corporate@valoresports.com.

11. Data Location

Core Platform account and database services are hosted in the United States. PostHog uses its United States service. Bunny Stream delivers video through a global content-delivery network.

12. Retention, Account Closure and Deletion

Valor retains information while reasonably required to provide, secure and support the Services, administer the applicable relationship, comply with law and address legitimate operational or legal requirements. Retention may differ by information category, system and school agreement.

Where Student Data is retained in de-identified form under Section 5, the underlying individual-level records are deleted as part of the de-identification process.

Where deletion cannot immediately be completed, Valor may disable account access, remove identifying account information and restrict further use. Any information retained must be reasonably required for an authorised purpose, subject to applicable law and the school’s agreement.

13. Rights and Choices

Depending on applicable law and the relevant relationship, a person may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where processing is based on consent.

For school-controlled Student Data, contact the school or district first where practicable. Valor may refer a request to the school to verify identity, authority and the scope of the education record.

Teachers, administrators and other adult contacts may unsubscribe from marketing communications using the link in the message. School student accounts do not receive marketing communications.

Website visitors can use the available consent controls to manage non-essential cookies and similar technologies. Some Platform technologies are necessary for authentication, security and operation.

To make a request, contact corporate@valoresports.com. Valor will acknowledge and respond within the period required by applicable law and will explain any lawful limitation on the request.

14. Changes to This Policy

Valor may update this Privacy Policy to reflect legal, operational, technical or service changes. The current version will be posted at https://valoresports.com/legal/privacy with its effective date.

Where reasonably practicable and required by an applicable agreement, Valor will notify active school contacts before a material change affecting Student Data takes effect. A material change requiring additional school or parental authorisation will not itself expand Valor’s authority merely because the policy was updated.

15. Contact and Complaints

For privacy inquiries, rights requests, complaints or suspected privacy incidents, contact:

Email: corporate@valoresports.com
Post: Privacy Officer, Valor Esports, PO Box 1977, Sunnybank Hills QLD 4109, Australia

Valor will acknowledge the inquiry and respond within the period required by applicable law. Depending on location and the issue, a person may also be able to complain to:

• Australia: Office of the Australian Information Commissioner, oaic.gov.au;
• European Economic Area: the competent national data protection authority;
• United Kingdom: Information Commissioner’s Office, ico.org.uk; or
• United States: the Federal Trade Commission, ftc.gov, or the relevant state Attorney General.