Box Battle Championship
Privacy Policy
Version 1.4 · Last updated September 11, 2026
In short: we collect what is needed to run a free creator competition, we use no analytics or advertising trackers, we never sell data, and you can ask to access or delete your data at any time.
Box Battle Championship is run by its organizer, a private individual based in Dubai (United Arab Emirates) who operates without a registered company. The organizer decides why and how the personal data described here is used: the organizer is the “controller”. In this policy, “we” and “us” mean the organizer. More details in the Legal Notice.
Questions or requests about your data: support@boxbattle.live or the contact form.
- Creator registration: TikTok username, email address, country, your answer to “Why you?”, a photo (framed in your browser, then re-encoded on our servers, which removes hidden metadata such as location), optional social links (TikTok, Instagram, YouTube, X), the dates you accepted the rules and confirmed you are 18 or older, whether you verified your email, and the organizer's decision (with any rejection reason).
- Approved creators: your public profile (display name and bio written by the organizer, @username, country, photo, social links), your points and ranking, and a one-time snapshot of your public TikTok follower count and profile picture, taken when you are approved. The winners page shows each winner's name, @username, points and prize.
- Winners: the payment details you choose to give the organizer to receive a prize, and a record of the payment. These are exchanged directly with the organizer, not through the site.
- Messages: what you send through the contact form (name, email, topic, message, language) and the emails you exchange with support@boxbattle.live, including attachments, plus technical email delivery logs.
- Next-season waitlist: your email address, language, sign-up date and the version of the consent text you saw.
- Event night: public TikTok LIVE data relayed in real time — the coins received by each creator's box and, for viewers who like the live, their TikTok @handle, nickname and a sample count of the likes captured.
- Technical and security data: your IP address, used by short-lived rate-limit counters and sent to Cloudflare to run the anti-bot check; technical logs kept by our hosting providers; and, for the organizer's admin account only, sign-in data and a log of admin actions.
We use no analytics, advertising or tracking tools, we do not profile anyone, and we collect no sensitive data (such as health or religion). Registrations are reviewed by people, with no automated decision-making.
- To review registrations and run the competition — publishing approved profiles, scores, rankings and results, contacting winners and paying prizes: performance of the contract formed when you register (the Official Rules and Terms of Service), including the publication of your photo described in the Terms.
- To show your public TikTok follower count and profile picture on your creator card, and to display the live boards on event night: our legitimate interest in presenting the competition; you can object at any time.
- To keep proof of prize payments: our legitimate interest in being able to prove a payment, and any legal obligation that applies.
- To protect the site (rate limits, anti-bot check, admin audit log): our legitimate interest in keeping the service secure.
- To answer your messages: our legitimate interest in replying to you, or steps you asked for before registering.
- To send the single next-season email: your consent, which you can withdraw at any time from the contact page.
Access is limited to the organizer and, for the photos and names needed to create the championship's visuals, the graphic designer who works with the organizer. The organizer relies on these service providers:
| Provider | Role |
|---|---|
| Vercel Inc. | Hosts the website; its servers for this site run in Frankfurt (Germany) and pages are delivered through Vercel's worldwide network. |
| Supabase | Database, file storage and sign-in to the admin area, in the European Union (Frankfurt, Germany). |
| Resend | Sends our emails and receives replies sent to our support address. |
| Upstash | Short-lived rate-limit counters that protect our forms (they expire within 24 hours). |
| Cloudflare | Turnstile anti-bot check, loaded only when you start filling in a form. Cloudflare also uses some technical signals to improve Turnstile, as a separate controller: see the Turnstile Privacy Addendum (opens in a new tab). |
| Euler Stream | Relays public TikTok LIVE data during the event, and provides the one-time public profile snapshot (follower count, profile picture) taken when a creator is approved. |
| Render | Runs the program that receives the live data during the event, in Frankfurt (Germany). |
| Payment services chosen by winners | Receive only the details needed to pay a prize. |
TikTok: the live itself takes place on TikTok, which processes your data under its own privacy policy. We do not send your registration data to TikTok.
We never sell or rent personal data. We may disclose data to authorities when the law requires it.
On event night, the live board can show the TikTok @handles and nicknames of viewers who like the live, with a sample count of likes. This information is public and already visible in the TikTok LIVE room. It is shown only while the live board is switched on, and deleted no later than 90 days after the event.
To have your handle removed sooner, use the contact form or email support@boxbattle.live: removal happens within 7 days.
| Data | Retention |
|---|---|
| Registrations that are not accepted | Deleted 90 days after the decision. |
| Withdrawn registrations | Deleted 30 days after the withdrawal. |
| Approved creators (registration data and public profile) | Kept until 12 months after the end of the season entered, then deleted or anonymized (the published results keep the scores without identifying you). |
| Email verification links | Deleted 7 days after they expire or are used (only a hash of the link is stored). |
| Contact messages and support emails, including attachments | Deleted 12 months after your request is closed. |
| Next-season waitlist | Deleted right after the single opening email is sent, and no later than 12 months after you signed up. |
| Live-board data (coins per box, @handles and like samples) | Deleted no later than 90 days after the event. |
| Rate-limit counters (IP address or email) | Expire automatically within 24 hours. |
| Prize payment records | Kept as proof of payment for up to 7 years. |
| Admin action log | 24 months. |
| Email delivery logs | 12 months. |
You can ask to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw a consent at any time (without affecting what was done before). Depending on where you live, laws such as the EU General Data Protection Regulation (GDPR), the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021), Nigeria's Data Protection Act 2023 or Cameroon's Law No. 2024/017 may give you these rights; we apply them to everyone.
To make a request, use the contact form (topic “Privacy & data requests”) or write to support@boxbattle.live. We may ask you to confirm that you control the email address or TikTok account concerned. We answer within one month; if a request is complex, this can be extended by two months and we will tell you why.
You can also complain to a data protection authority — in the EU, the authority of the country where you live or work (in France, the CNIL (opens in a new tab)).
The organizer runs the championship from Dubai (United Arab Emirates) and accesses the data from there. The European Commission has not adopted an adequacy decision for the United Arab Emirates, which means the EU has not recognised that country as offering a level of data protection equivalent to its own.
The database and file storage are located in the European Union (Frankfurt). Some of our providers are US companies and may process data in the United States or elsewhere; where required, we rely on the safeguards in their data processing terms, such as the European Commission's standard contractual clauses. Public TikTok LIVE data relayed by Euler Stream may be processed outside the EU.
We only use browser storage that is strictly necessary for features you ask for: remembering your language or theme choice, and the anti-bot check on our forms. There are no advertising, analytics or cross-site tracking cookies, which is why we don't show a consent banner. Details in our Cookie Policy.
We protect data with encrypted connections (HTTPS), access limited to the organizer's account, protected by two-factor authentication, database access rules, photos re-encoded to remove hidden metadata, and verification links stored only as hashes. No system is perfectly secure: if a breach puts your rights at risk, we will inform you and the authorities as the law requires.
The competition is for people aged 18 or over, and the site is not directed at children. If we learn that we hold data about a minor, we delete it.
We may update this policy. Each version is published here with its number and date; the version of the consent text you saw stays recorded with the data it applies to.
Box Battle Championship is an independent event and is not affiliated with, endorsed by, or sponsored by TikTok.