Privacy Policy

1.Data controller

This website is operated by HEROES MOLDOVA — CONTENDER SERIES. The full legal name, registration number and registered address are [to be completed] and will be filled in before launch. We have not invented them.

No Data Protection Officer (DPO) has been appointed. If applicable law requires one, their details will be added here: [to be completed].

2.The contact form

When you submit the contact form we store the following in the contact_submissions table:

• the name you enter and your email address
• the subject (optional) and the message
• the language you filled the form in
• the exact moment you ticked the consent box
• a hash of your IP address (see the IP hash section)

3.The fighter application form

Fighter applications are stored in the fighter_applications table. This form collects the most data of any on the site:

This data is used solely to assess your application and to contact you about it.

The form accepts applicants from the age of 16. A minor competing in a professional event may require parental or guardian consent, and processing a minor's data carries additional rules. Exactly how these cases are handled must be settled with a lawyer: [to be completed].

• first name, last name and date of birth
• email and, optionally, phone number
• country and city
• the disciplines, weight and height you declare
• gym and coach
• years of experience, amateur record and professional record
• a video link (YouTube) and, optionally, your Instagram profile
• your message, the form language, the consent timestamp and a hash of your IP address

4.The partnership enquiry form

Partnership enquiries are stored in the partner_inquiries table: company name, contact person, email, phone, website, estimated budget, partnership type, message, form language, consent timestamp and a hash of your IP address.

A company contact person’s details are still personal data and are treated as such.

5.Newsletter and unsubscribing

If you subscribe to the newsletter we store the following in newsletter_subscribers: your email address, language, the consent timestamp, the signup source (for example the footer form), a hash of your IP address, and a randomly generated unsubscribe token (a UUID).

The unsubscribe token is the only thing linking the email link to your subscription. It does not contain your email address and cannot be guessed. The unsubscribe page requires an explicit confirmation click — a link scanner or an email client that pre-fetches links cannot unsubscribe you by accident.

After you unsubscribe we record when you opted out and stop emailing you. The row stays in the database as a suppression record so you are not accidentally re-added; we delete it entirely on request.

6.The IP hash — what it is and what it is not

We do not store your IP address. For each submission we compute a SHA-256 hash of the IP address combined with a secret salt known only to the server, and keep the result — a 64-character hexadecimal string. It is a one-way function: the IP address cannot be reconstructed from the hash.

We use this hash only for rate limiting and to detect automated abuse. We do not use it for profiling, advertising or geolocation.

To be explicit: a hashed IP address is generally still considered personal data, because it is a stable pseudonym. That is why we document it here instead of treating it as anonymous.

7.Legal basis for processing

• Consent — for all four forms and for the newsletter. Consent is given through an unticked checkbox and recorded with a timestamp. You can withdraw it at any time.
• Legitimate interest — for anti-spam and rate limiting (IP hash, honeypot, submission-timing check), strictly as needed to keep the forms usable.
• Pre-contractual steps — for fighter applications and partnership enquiries, where the conversation moves toward a contract. The final characterisation must be confirmed legally.

8.Who else processes the data

Supabase (PostgreSQL database, file storage and admin authentication) is the main processor: everything described here is stored in our Supabase project. The project's hosting region is [to be completed].

Resend is used, when configured, only to send the HEROES team an internal notification that a submission arrived. That notification can include the details you filled in.

The site's hosting and CDN provider, and the region where HTTP requests are processed: [to be completed].

We do not sell your data and we do not use it for advertising. There are no ad networks, data brokers or cross-site tracking tools.

If any of these providers process data outside your country, the transfer needs a legal basis (for example standard contractual clauses). Documenting those transfers: [to be completed].

9.Cookies and similar technologies

• We use no advertising cookies and load no third-party analytics scripts on the public pages.
• The only first-party cookie is the Supabase session cookie, set solely when a team member signs in to the /admin panel. An ordinary visitor never receives it.
• Forms include a hidden field with the time the form was rendered and an invisible honeypot field. Both exist only to filter bots and do not track you.
• Rate-limit counters live on the server, keyed by the hash described above, not in your browser.

10.YouTube videos

Videos on this site do not load automatically. Until you press play you only see a preview image, fetched from YouTube’s image server (i.ytimg.com). The YouTube player — with its scripts and cookies — loads only after your click, through youtube-nocookie.com. From that point Google’s privacy policy also applies.

One exception, for transparency: if an administrator sets a YouTube video as the background of the homepage hero, that background loads with the page, without a click.

11.How long we keep data

There is currently no automatic deletion job. Form data stays in the database until an administrator deletes it from the admin panel. The exact retention period for each form type is still to be settled legally: [to be completed].

A newsletter subscription is kept until you unsubscribe; after that only the suppression record described above remains. Rate-limit counters are tied to short time windows and are meaningless once the window passes.

You can ask us to delete your data at any time, regardless of these periods.

12.Your rights

In relation to your personal data you have the following rights:

To exercise them, write to the email address in the contact section below. We may ask for reasonable proof of identity so we do not disclose one person's data to another. We reply within the period set by applicable law. If you are unhappy with our response you can complain to the competent supervisory authority — in the Republic of Moldova, the National Center for Personal Data Protection; in the European Union, the authority in your country of residence. Contact details of the authority applicable to the controller: [to be completed].

• right of access — to know what data we hold about you and receive a copy
• right to rectification — to have inaccurate data corrected
• right to erasure — to have data removed when there is no lawful reason to keep it
• right to restriction of processing
• right to object — including to processing based on legitimate interest
• right to data portability — to receive your data in a structured, commonly used format
• right to withdraw consent at any time, without affecting the lawfulness of earlier processing
• right to lodge a complaint with the supervisory authority

13.How we protect the data

• The submission tables have Row Level Security enabled in PostgreSQL: the site’s public key may insert a submission but cannot read a single row. Not even your own message can be read from the browser.
• The Supabase service key exists only on the server and never reaches code delivered to the browser.
• Admin access is checked at several independent layers: middleware, a server-side role check when rendering, a role check inside every writing action, and finally the database policies.
• Editorial rich text is sanitised before it is stored and again when it is rendered, so stored content cannot execute code in a visitor’s browser.
• Traffic is served over HTTPS.

14.Changes to this policy

This text is a working draft and does not yet have an effective date. After legal review, the version, the last-updated date and how we announce changes will be added: [to be completed].