Privacy Policy

Last updated: July 14, 2026

Baron Buff ("Baron Buff," "we," "us," or "our") provides game-related software and online services, including our website, application, desktop connector, accounts, subscriptions, premium features, and related features (collectively, the "Services").

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data when you use the Services. Baron Buff operates from Brazil. Our infrastructure and certain service providers may process personal data in the United States and other countries.

1. Scope

This Privacy Policy applies to personal data processed when you:

visit our website;
create or use a Baron Buff account;
sign in with email/password or Google;
connect eligible game-related features;
use profile, history, preference, premium, or billing features;
make a purchase, subscribe, manage a subscription, or use a billing portal;
contact us; or
subscribe to product updates or marketing communications.

This Privacy Policy does not apply to third-party websites, products, or services that are not operated by Baron Buff.

2. Controller

For purposes of applicable data protection law, the controller of the personal data described in this Privacy Policy is Guilherme Monteiro da Silva Lanna, trading as Baron Buff and operating from Brazil.

Privacy contact and data-subject request channel: [email protected]

3. Personal Data We Collect

We collect only the personal data reasonably necessary to provide, secure, support, and improve the Services.

3.1 Data you provide directly

Depending on how you use the Services, this may include:

email address;
display name or profile name;
marketing communication preferences;
billing name, billing address, country, tax or invoice details, where applicable;
messages, requests, or support communications you send to us.

3.2 Account and authentication data

If you create an account or sign in, we may process:

account identifiers;
sign-up, sign-in, verification, and password-reset events;
authentication, token, and session data needed to secure and operate the Services.

If you sign in with Google, we may receive basic account information made available through that sign-in flow, such as your email address, profile identifier, and profile information needed to authenticate you and create or access your Baron Buff account.

3.3 Payment, billing, and transaction data

If you make a purchase, subscribe, or use paid features, Baron Buff and the payment provider identified at checkout may process:

purchase and subscription records;
billing and invoicing information;
payment status, transaction identifiers, renewal dates, and cancellation status;
country, currency, tax information, and tax identifiers where required for billing or invoicing;
limited payment-method details or metadata made available to us by the payment processor, such as card brand, card expiration month/year, funding type, country, or last four digits, where applicable.

We do not store full payment card numbers or payment security codes in our own systems.

3.4 Game account and feature data

If you use connected product features, we may process:

linked game account information detected through the connector flow, such as summoner name, tag, region, Riot PUUID or another connector-verified identifier;
League Client data needed for supported features, including draft state, selected champions and roles, ranked tier, champion mastery, and sanitized live-game data such as champion, items, gold, level, team, game time, role fields, and rune identifiers;
saved preferences, including custom champion-pool and learning-focus settings;
match history, post-game analyses, saved coaching outputs, and related metadata associated with your Baron Buff account;
entitlement and access status for free or premium features and subscriptions.

3.5 Technical and usage data

We may automatically collect limited technical data, such as:

IP address and approximate location inferred from IP;
browser, device, and operating system information;
timestamps, log data, and security events;
usage events, feature interactions, and navigation data;
visitor or session identifiers, referring page, campaign attribution, and advertising click identifiers where present;
cookie and similar technology data;
anti-fraud, abuse-prevention, and risk signals associated with account, authentication, or payment activity.

3.6 Data we do not request

Baron Buff does not intentionally request or design the Services to collect:

Riot Games account credentials;
in-game chat content;
GPS or other precise device location; we may infer an approximate country or region from an IP address;
full payment card numbers or payment security codes in our own systems;
special-category or sensitive personal data unrelated to payment, account security, or a request you initiate. Please do not include unnecessary sensitive information in support or feedback messages.

4. How We Use Personal Data

We use personal data to:

create, maintain, and secure Baron Buff accounts;
authenticate users and manage login sessions;
enable Google sign-in and account recovery flows;
operate core product features;
link eligible game accounts detected through the connector flow;
save profile settings, communication preferences, entitlements, and game history;
process purchases, subscriptions, renewals, cancellations, invoices, taxes, refunds, credits, and related billing operations;
provide customer support and respond to requests;
send service-related notices, including billing, account, security, and transactional communications;
send product updates or marketing communications where permitted by law and, where required, based on consent; you can change the Email Updates preference in your profile or use the unsubscribe option in a marketing email;
monitor, prevent, and investigate fraud, abuse, unauthorized access, payment risk, chargebacks, and other security issues;
analyze product usage, performance, reliability, and commercial operations;
comply with legal obligations and enforce our terms.

5. Legal Bases for Processing

Where the LGPD applies, we process personal data under one or more of the following legal bases, as applicable:

performance of contract or preliminary procedures related to a contract, when processing is necessary to provide the Services you request;
consent, including for marketing communications where consent is required;
legitimate interests, including service security, fraud prevention, abuse prevention, product improvement, customer support, billing administration, and operational management, provided that such interests are not overridden by your rights and freedoms;
compliance with legal or regulatory obligations, including tax, accounting, consumer, and recordkeeping obligations, where applicable;
regular exercise of rights in judicial, administrative, or arbitration proceedings, where applicable.

You may withdraw consent at any time where processing is based on consent. Withdrawal does not affect prior lawful processing.

6. Cookies and Similar Technologies

We may use cookies and similar technologies for:

essential site and security functions;
authentication and session continuity;
remembering preferences;
analytics and performance measurement, including Google Analytics 4;
billing, checkout continuity, fraud prevention, and account security;
advertising and conversion measurement, including Google Ads measurement for page views, download clicks, account creation, and completed upgrades.

We use Google Analytics 4, Google Ads conversion measurement, Google Tag Gateway through Cloudflare, and advertising measurement tools from Meta, Reddit, and Microsoft. Depending on your consent choices and how you reached the Services, browser tags may process page URL, browser and device data, IP-derived approximate location, cookie or visitor identifiers, ad click identifiers such as gclid, gbraid, wbraid, fbclid, or rdt_cid, and measured events such as page views, download clicks, account creation, and upgrade completion.

For consented or otherwise lawfully permitted ad-conversion measurement, Baron Buff may also send Google, Meta, or Reddit hashed account identifiers (including a one-way hash derived from an email address or Baron Buff user ID), IP address, user-agent data, attribution data, and the relevant conversion event. Baron Buff does not send those providers your Baron Buff password, temporary local League Client credential, in-game chat, or full payment-card number. The desktop connector reads the temporary League Client credential only on your computer to communicate with the local client and is designed not to transmit or log it.

Where required by applicable law, we request consent before using non-essential analytics or ads-measurement cookies or similar technologies. You can accept or reject these optional uses through the cookie choices shown on the website.

7. Authentication and Payment Providers

We use Amazon Web Services Amazon Cognito to support account authentication and identity management. This may include email verification, password-reset flows, token-based session management, and related security features.

If you choose to sign in with Google, Google and Cognito may process your information to authenticate you and return you to the Services.

Baron Buff is transitioning billing providers, so active subscriptions may be administered through either Stripe or Paddle. The checkout and billing portal identify the provider that applies to your transaction.

For Stripe transactions, Stripe (stripe.com) acts as a payment-processing service provider to Baron Buff and processes checkout and payment data, including billing name, billing address and country, payment-method metadata, transaction identifiers, and related records. Stripe also acts as an independent controller for certain purposes, such as fraud prevention, security, and compliance with its own legal obligations. See Stripe's Privacy Policy.

For Paddle transactions, the applicable Paddle entity identified at checkout acts as the merchant of record, authorized reseller, and separate controller for its checkout, billing, tax, invoicing, fraud-prevention, and compliance processing. Paddle may process billing name, billing address and country, tax identifiers where applicable, payment-method metadata, transaction identifiers, and related records. See Paddle's Privacy Notice.

8. Sharing of Personal Data

We do not sell personal data for money. Subject to your consent choices and applicable law, our use of advertising measurement may disclose identifiers or event data to Google, Meta, Reddit, or Microsoft. Some privacy laws may describe certain advertising disclosures as "sharing," targeted advertising, or cross-context behavioral advertising even when no money is paid for the data. You can reject optional ads measurement through the cookie choices on the website.

We may share personal data only as reasonably necessary with:

cloud and infrastructure providers, including AWS;
security, CDN, and networking providers, including Cloudflare;
authentication providers, including Amazon Cognito and, where you choose that method, Google;
Google, for Google Analytics 4 and Google Ads conversion measurement, where enabled and subject to applicable consent choices;
advertising measurement providers, including Meta, Reddit, and Microsoft, where enabled and subject to applicable consent choices;
Stripe, as payment-processing service provider for Stripe transactions and an independent controller for certain fraud-prevention, security, and compliance processing;
the applicable Paddle entity, as merchant of record, authorized reseller, and separate controller for Paddle transactions;
analytics, communications, customer-support, fraud-prevention, tax, invoicing, or operational service providers, if used;
professional advisors where reasonably necessary;
authorities or third parties where required by law, legal process, or to protect rights, safety, and security.

We may also disclose information in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar transaction, subject to applicable confidentiality and legal requirements.

9. International Transfers

Baron Buff operates from Brazil, and our main technical environment is hosted in the United States. As a result, personal data may be transferred to and processed in the United States and other countries where our service providers operate.

Where applicable, we will adopt appropriate safeguards and measures required by law for international transfers of personal data.

10. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to:

maintain active user accounts;
provide requested features, purchases, subscriptions, support, and account administration;
preserve security, audit, fraud-prevention, and abuse-prevention records for a limited period;
maintain billing, tax, accounting, chargeback, refund, and legal compliance records as required or permitted by law;
resolve disputes and enforce agreements.

Retention periods may vary depending on the type of data and the purpose of processing. If you delete your account or a subscription ends, we may retain certain information for legitimate business purposes and where required or permitted by law, including security, fraud prevention, billing, tax, accounting, dispute resolution, and legal compliance purposes.

Current product controls automatically expire certain operational records: diagnostic event records in the Baron Buff event store expire after approximately 7 days; advertising-conversion ledger records expire after approximately 180 days; and the short-lived hashed-IP lookup used to reconnect a paid download with a same-day account creation expires after approximately 24 hours. These periods do not apply to account profiles, match history, saved analyses, subscription records, first-party funnel records, provider records, backups, or records that must be retained for legal or dispute purposes.

When personal data is no longer required, we will delete, anonymize, or securely isolate it, unless retention is legally required or permitted.

11. Your Rights

Subject to applicable law, including the LGPD where relevant, you may have the right to:

confirm whether we process your personal data;
access your personal data;
request correction of incomplete, inaccurate, or outdated data;
request anonymization, blocking, or deletion of unnecessary or excessive data, or data processed unlawfully;
request portability, where applicable;
request information about shared use of data;
request information about consent and the consequences of refusing consent;
withdraw consent, where processing is based on consent;
request deletion of personal data processed based on consent, subject to legal exceptions;
object to certain processing, where permitted by law;
request review of decisions made solely on the basis of automated processing, where applicable under law.

To exercise these rights, contact us at [email protected]. We may request information necessary to verify your identity before processing a request.

12. Account and Billing Management

If you have a Baron Buff account, you can access, update, export, or remove certain information through your profile or the applicable billing flow, including:

profile information;
linked game accounts;
communication preferences;
saved feature preferences;
subscription or billing information, where available.

The profile provides a JSON data export of the Baron Buff profile and match history. It also provides an account-deletion action. If an active Stripe or Paddle subscription is recorded, Baron Buff attempts to cancel it before deleting game history, saved post-game reviews, the profile, and the Cognito identity; if a required cancellation or deletion step fails, the request is stopped so it can be retried instead of leaving an active subscription or orphaned product data.

Account deletion does not require us or an independent payment provider to erase records that must be retained for legal, security, tax, accounting, fraud-prevention, chargeback, or dispute-resolution purposes. To request additional access, correction, deletion, or information about retained records, contact [email protected].

13. Security

We use reasonable technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure. However, no system is completely secure, and we cannot guarantee absolute security.

14. Children

The Services are not directed to children under 13, and children under 13 may not create a Baron Buff account. Users who have not reached the age at which they can consent to data processing or enter into these Terms in their country must use the Services only with valid authorization from a parent or legal guardian. If you believe a child has provided personal data without appropriate authorization, contact us so we can investigate and take appropriate action.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Services, our processing practices, or applicable legal requirements. When we do, we will update the "Last updated" date at the top of this page. If legally required, we will provide additional notice or request consent.

16. Contact

For privacy-related questions or requests, contact:

[email protected]