Auto Tournament
Sign inSelf-host(opens in a new tab)

Privacy Policy

Last updated 9 October 2026

This policy covers autotournament.gg and buying or asking about a commercial license.

Gullberg Hansen Consulting (ENK), owned by Sivert Gullberg Hansen
Org. nr. 938 566 674 (Enhetsregisteret) · Not VAT-registered
Fredengvegen 15, 2817 Gjøvik, Norway
[email protected]

1. Who is responsible

Gullberg Hansen Consulting (ENK), owned by Sivert Gullberg Hansen, is the controller for your personal data. Contact: [email protected].

2. What we collect

When you buy a license or email us about one:

  • your name, and the company or organization name
  • billing address, email and phone number
  • organization number or VAT ID
  • event details: name, dates, venue or city, and website
  • what you order: pack, number of servers, period and price
  • payment data from Stripe: whether you paid, the amount, and limited card details such as the brand and last four digits (never the full card number)
  • what you write to us

The event or client name you give us at checkout is only for us, to know who a license is running for: it is never printed on the license key, the invoice or the public license check (see below).

Your license key. When you pay by card, we issue a signed license key that you paste into the software. It contains a license id, your Stripe customer id, the business name you gave at checkout, the product, pack and server limit, the period, when it was issued, how long updates run and, for one event, the event dates. It doesn't contain your email, name or address, but anyone you give the key to can read what it contains. We keep the issued keys on our server with a one-way hash of your email (not the email itself), so you can sign in to the console and see it again. The software checks the key offline. With a key saved, it also checks in once a day (see the next paragraph).

The license check-in. Only an installation that has a license key saved checks in with us: the Auto Tournament platform and CS2 Server Manager at startup, once a day, and when the key is changed; Ready Up on each game server at startup and every 15 minutes while it runs. Without a key (free non-commercial use) it sends nothing. It sends exactly:

  • the license key, so we can check its signature. We keep only the license id from it, never the key;
  • a random instance id that the instance made for itself (it says nothing about you or your machine);
  • which product it is, the number of game servers set up, and its version;
  • its public web address, if it has one (for the platform, the address players open). Only the address, never what is on it;
  • for Ready Up, the game server’s port. We turn its instance id, port and the internet address it connects from into one id, so each game server counts once; we keep that id, not the address;
  • since the last check-in, three numbers: finished matches, tournaments with a finished match, and the largest of those tournaments in teams. No names, teams, players, matches or ids;
  • for an event license used outside its dates, the answer an admin gave to our question (testing, a new event, or the dates moved), if any;
  • the time it was sent.

Why: a license covers a number of servers. The check-in lets us see that a key is used within that, lets your installation and the console show you where your key is in use, keeps one key to one platform installation, and brings your installation the license's current end date and server count and whether the license is paid (see the Commercial License Terms, sections 4 and 8). An installation that can't reach us (offline, LAN) uses the last answer it got and the dates in the key. Removing the key stops the check-in.

What we do with it: we keep, per license, which platform installation it belongs to (its random id and public address). We keep, per license and installation, when it was first and last seen, the product, the server count, the version and the public address, and the daily activity numbers, for 90 days after the instance was last seen. We don't keep the IP address it came from (it is held in memory for up to an hour, to limit abuse). Members of the license's organization see its instances in the console. When the servers of the instances seen in the last 3 days add up to more than the pack covers, your instance and the console tell you so. For an event license, testing and setting up before and after the event is expected: up to 2 finished matches a day with no tournament is ignored, and the day before and after the dates count as the event. More than that outside the dates shows a note in your instance and may ask an admin what it is; we email ourselves (never you) only when it looks like a whole event (more than 20 matches in a day, or a tournament of 8 or more teams) and you haven't told us your dates moved, or when the servers are above the pack, at most once a day per license, so we can follow up personally.

Recorder benchmark results. After a benchmark, a highlight recorder sends us its result so we can publish what hardware renders how fast. It is on by default, says so when it starts, and you turn it off with AT_TELEMETRY=0 or in the admin panel. The recorder works the same without it. It sends:

  • a random install id that the recorder made for itself (it says nothing about you or your machine);
  • the GPU model and its memory, the CPU model, the driver and recorder versions;
  • the benchmark version, the resolution and how many recorders share the GPU;
  • the time it took, frames per second, peak GPU memory and failed tries.

No player, match or server names, Steam IDs, license keys or file paths. We don't keep the IP address it came from (it is held in memory for up to an hour, to limit abuse). We publish combined numbers only.

The license email. We email your license key to the address you paid with, once, right after payment. The email contains the key, the license details above, the order reference and the invoice number. We send it through Postmark (see section 5). We keep when it was sent and, if sending failed, the error, but not your address.

The console. At console.autotournament.gg you sign in to see your licenses and manage your organization. There is no password. You sign in either:

  • with a link we email you (through Postmark). We keep a one-way hash of the link for 15 minutes, until it is used; or
  • with Google. Google tells us your name, email address, whether Google has verified that address, and your profile picture address. We keep the name, email and picture link, and which Google account is yours; we don't keep Google's access tokens and we don't read anything else from your Google account. We accept only addresses Google has verified.

For your account we keep your email address, your name and picture (from Google, if you used it), when your address was verified, and when you signed up. Once you are signed in, one cookie keeps you signed in for up to 30 days (we keep a one-way hash of it), and a second one remembers which of your organizations you last opened. Both are needed for the console and aren't used for anything else.

Organizations. An organization in the console is the company you buy for: its name, organization number, VAT ID, country and billing address, and its Stripe customer id once it has bought something. It is created from your checkout (see below), or you add it yourself. Its members see its licenses and keys, and each other's names and email addresses. When you invite someone, we email them a link through Postmark, and keep their email address, the role and a one-way hash of the link. The link works once, for 7 days; the invite is deleted 30 days after it is used, withdrawn or expired.

The organization from your checkout. When you buy a license by card, we create the organization in the console from the details you entered at checkout: the company name, VAT or organization number, country and billing address, and the Stripe customer id. If you bought from the console for one of your organizations, or you already belong to an organization with the same VAT or organization number, the license goes there instead. Until you sign in, the organization is linked to the email you paid with only as a one-way hash (the same one as above), not the address. When you sign in with that address, verified, you become the organization's owner and the hash is deleted.

Licenses bought with your email. When you sign in with an address that is verified, the console shows the licenses bought with that address (we match the one-way hash described above) that aren't in an organization yet, so you can add them to yours.

Activity log. To keep the console secure and to answer questions about changes, we log sign-ins and every change made in the console: who did it, what (such as "invited a member" or "added a license"), to which organization, and when. The log holds user and organization ids, not passwords, links or keys.

The console's data and the issued license keys are kept in a database on our own server in Norway.

The public license check. Anyone who has a license id (it is also inside the key) can open its check page, /verify/<license id>, and see the licensee name, the product, pack and server limit, the kind of license, its period and whether it is valid. It never shows the key, your email, your Stripe customer id or the order reference. Share the id only with people who need to check your license, such as an event or a client.

The contact form. On /contact we collect your name, email, organization (if you give one), topic, the number of servers and event dates (if you give them) and your message. We send them to us by email through Postmark (see section 5), and we also keep them in our database, with where the conversation stands (such as "replied") and our own short note, so we can follow up. We delete them from the database 24 months after the last activity on them (your message, or our last update to it), and the email in our mailbox when we no longer need it for the conversation. When we confirm a free LAN, we keep the event's name, the organizer, the dates, the number of servers and the day we confirmed it, as the record of that permission.

The website uses no analytics and no tracking cookies. It remembers your colour theme in your own browser, and sets cookies only when you sign in to the console (see above). To limit abuse, the checkout, the license, sign-in and contact pages, the console and the license check keep your IP address in memory for up to an hour.

3. Why, and on what legal basis

  • To sell and deliver the license and answer your questions about it: the contract, or steps you ask for before one (GDPR art. 6(1)(b)).
  • To keep the accounts the law requires: a legal obligation (GDPR art. 6(1)(c)) under the Bookkeeping Act (bokføringsloven).
  • To give you the console, with your account, your organizations and their members: the contract, or steps you ask for before one (GDPR art. 6(1)(b)).
  • To check that a license key is used within its terms (the license check-in): the license contract (GDPR art. 6(1)(b)) and our legitimate interest in knowing our licenses are used as sold (GDPR art. 6(1)(f)).
  • To stop abuse of the checkout and the console, and to keep the activity log: our legitimate interest in keeping them secure (GDPR art. 6(1)(f)).

4. How long we keep it

Sales records, invoices and the license log: 5 years after the end of the accounting year, as the Bookkeeping Act requires. Emails that don't lead to a sale: deleted when we no longer need them to answer you. Contact form messages in our database: 24 months after the last activity. Your console account and your membership of organizations: until you ask us to delete them. An organization's details: as long as it has members, and after that as long as its licenses and invoices must be kept. Sessions end after 30 days or when you sign out; sign-in links after 15 minutes; invites as described above. The activity log: 2 years. Recorder benchmark results: 2 years. License check-ins: 90 days after the instance was last seen.

5. Who gets your data

  • Stripe processes card payments and invoices. Stripe may transfer data to the United States, covered by the EU-US Data Privacy Framework and Stripe's standard contractual clauses. See Stripe's privacy policy ↗.
  • Postmark (ActiveCampaign, LLC, USA) sends the license email, the sign-in link, invites and contact form messages for us, as our processor. It gets the recipient's email address and the content of those emails. Transfers to the United States are covered by the EU standard contractual clauses. We turn off open and click tracking.
  • Google, only if you choose to sign in with Google: Google learns that you signed in to Auto Tournament. See Google's privacy policy ↗.
  • Our email and hosting providers (Cloudflare carries the traffic to our server), which handle data only to run those services for us.
  • An accountant, if we use one, and public authorities when the law requires it.

We don't sell your data or use it for marketing.

6. Your rights

You can ask for access to your data, and to have it corrected, deleted, restricted or handed over in a machine-readable format. You can object to processing based on our legitimate interest. Email [email protected]. We may need to keep some data to meet the Bookkeeping Act.

You can complain to the Norwegian Data Protection Authority, Datatilsynet ↗.