Privacy Policy

FootballPlazza is operated by Tech Improvement Inc (trading as FootballlPlazza), Philadelphia, Pennsylvania, United States. We decide how and why your personal data is used, which makes us the "controller" under the EU and UK General Data Protection Regulations (GDPR and UK GDPR) and the "business" under US state privacy laws. For any privacy question or request, contact [privacyEmail — set in Administration].

This policy applies to everyone who uses FootballPlazza, wherever they live. Additional information for residents of certain US states is in the US State Privacy Notice.

We are based in the United States and have no establishment in the European Union or the United Kingdom. You can always contact us directly at [privacyEmail — set in Administration]. Our representative in the EU under Article 27 GDPR is: [euRepresentative — set in Administration]. Our representative in the UK under Article 27 UK GDPR is: [ukRepresentative — set in Administration].

• We collect only what we need to run your account, your membership and the site securely.
• We do not sell your personal data, and we do not share it for cross-context behavioural advertising unless you switch on Marketing cookies. We honour the Global Privacy Control signal.
• We show no advertising. Analytics and advertising-measurement cookies (Google Analytics through Google Tag Manager) are used only while we have switched them on and you accept them.
• Card payments are handled by Stripe; we never see your full card number.
• Our football data supplier, Sportmonks, and the AI service we use for drafting site texts receive no personal data about you.
• You can download your data and delete your account yourself, in Account → Privacy & data.

Account data: your name, email address, password (stored only as a salted scrypt hash, never in readable form), account role and the date you registered.

Consent records: the policy version you accepted when you registered, your confirmation that you meet the age requirement, the terms you agreed to at checkout (with the wording version) and, if you are signed in, the cookie choices you make, each with a timestamp.

Security data:

• active sign-in sessions: a browser and operating system summary such as "Firefox on Windows", when the session started, when it was last active and when it expires. We do not store your full IP address or full browser identifier with sessions.
• two-factor sign-in, if you turn it on: an encrypted authenticator secret and one-way hashes of your recovery codes
• a security audit log of events such as sign-ins, failed sign-ins, password changes and administrative changes to your account
• short-lived rate-limit counters, keyed by a one-way hash of your IP address or email address, to stop password guessing

Membership data: your plan, subscription status, renewal and end dates, the leagues you chose, any promotion code and complimentary access, and the customer and subscription references Stripe gives us. Your payment card details go directly to Stripe.

Community data, if you take part: your public nickname, your crowd votes and your leaderboard results.

Favourites, alerts and notifications, if you use them: the teams you follow, the fixtures you save while signed in, your notification and email settings, your in-app notifications, the private link of your calendar feed, records of the alerts and emails we sent and, if you switch on browser notifications, the push subscription of each device (an address at your browser's push service and its encryption keys, with a label such as "Chrome on Android").

Messages: what you write to us, for example in support emails.

Technical data: our hosting provider's web servers may log requests (including IP address, time, page requested and browser) for security and troubleshooting.

Stored only on your device: fixtures you save while signed out, your slip builder, dismissed announcements, your cookie choice and, if you allow it, your preferences. These are kept in your browser's storage and are not sent to us (see the Cookie Policy). When you sign in, fixtures saved on that device are added to your account once so they appear on your other devices.

We do not ask for sensitive data such as health data, and we do not use your data for profiling or automated decisions that have legal or similarly significant effects on you. Our predictions are about football matches, not about people.

• To provide your account and the features you use (sign-in, saved settings, community features, notifications you switch on) — performance of our contract with you, GDPR Article 6(1)(b).
• To sell and manage memberships (checkout, renewals, plan changes, cancellations, renewal reminders you ask for) — contract, Article 6(1)(b).
• To keep tax and accounting records — legal obligation, Article 6(1)(c).
• To keep FootballPlazza and your account secure (sessions, two-factor sign-in, rate limits, audit log, preventing fraud and abuse) — our legitimate interest in a secure service, Article 6(1)(f).
• To keep proof of what you agreed to (policy acceptance, age confirmation, checkout consent, cookie choices) — legal obligation and our legitimate interest in demonstrating compliance, Articles 6(1)(c) and 6(1)(f).
• To remember optional preferences in your browser and to run analytics or advertising measurement — your consent, Article 6(1)(a). You can withdraw it at any time with Cookie settings in the site footer.
• To send service messages (security notices, billing and important changes) — contract and legitimate interests.
• To send alerts, digests and announcements you switch on — your choice in your notification settings (consent where the law requires it); you can switch them off at any time.
• To answer your questions and requests — legitimate interests, and legal obligation for data protection requests.

Where we rely on legitimate interests, you may object; see "Your rights" below.

We use these service providers. They process personal data on our behalf under data processing terms, except where stated:

• Stripe — payment processing, subscriptions, tax calculation, invoices and fraud prevention. Stripe also acts as an independent controller for some purposes, such as fraud prevention and meeting its own legal obligations; see stripe.com/privacy.
• Hosting provider: [hostingProvider — set in Administration] — runs our servers and stores our database and backups.
• Email provider: [emailProvider — set in Administration] — delivers account, security, billing and alert emails.
• Browser push services (for example Google, Mozilla, Apple or Microsoft, depending on your browser) — deliver browser notifications if you switch them on. The content is end-to-end encrypted to your browser.
• Google — Google Analytics and advertising measurement, only with your consent (see below).

Sportmonks, our football data supplier, receives no personal data: our server requests football data from Sportmonks, and your browser does not connect to Sportmonks. OpenAI, whose AI models may help our administrators draft site texts, receives no personal data about members or visitors (see the Advertising, Affiliate & AI Disclosure). When we tell search engines about new public pages (Google Search Console and the IndexNow protocol used by Bing and others), we send only page addresses.

We may also disclose data where the law requires it (for example to a court or authority), to professional advisers bound by confidentiality, or to a buyer of our business, who would have to respect this policy. We never sell personal data.

The cookie banner offers Analytics and Marketing only while we have switched on Google Tag Manager. While it does not show them, none of the processing below happens and nothing from Google is loaded. When it does, nothing is loaded until you accept, and only for the categories you accept:

• What is collected: Google Tag Manager loads Google Analytics 4 and, if you accept Marketing, Google's advertising measurement. Google receives your IP address (used to derive an approximate location), browser and device details, the pages you view and events such as searches, sign-ups and sign-ins, checkouts started, memberships bought (plan, price, currency and an order reference), promotion codes applied, crowd votes, teams followed, fixtures saved, notification opt-ins, value-finder filters and links shared. We never send your name, email address, account ID or payment details, and we remove tokens and email addresses from page addresses before anything is sent.
• Who receives it: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC in the United States. For Google Analytics, Google acts as our processor (service provider); for advertising measurement, Google may act as an independent controller under its own terms.
• Why, and the legal basis: to understand how FootballPlazza is used so we can improve it, and to measure whether our own adverts on other sites work — your consent, GDPR Article 6(1)(a).
• How long: the cookies are kept as listed in the Cookie Policy (_ga up to 2 years, _gcl cookies 90 days). Event data is kept for the retention period set in our Google Analytics property, at most 14 months; aggregated reports without personal data may be kept longer.
• Global Privacy Control: if your browser sends the Global Privacy Control signal, Marketing stays off in that browser even if you accept all cookies.
• Withdrawing your consent: choose Cookie settings at the bottom of any page, then Reject all or switch off a category. It is as easy as accepting: we tell Google's tags that consent is denied, delete the Google Analytics and advertising cookies, stop sending data and reload the page. If you are signed in, each choice is kept in your consent records. Withdrawal does not affect processing before it.

FootballPlazza is operated from the United States, so if you use it from another country your personal data is transferred to and stored in the United States, and some providers may process it in other countries. For visitors from the European Economic Area, the United Kingdom and Switzerland, transfers to our service providers are protected by an adequacy decision where one applies (such as the EU–US Data Privacy Framework and its UK extension, for certified companies) or by the European Commission's Standard Contractual Clauses (and the UK addendum) with additional safeguards where needed. Data you give us directly, for example when you register, is transferred to us in the United States because it is necessary to provide the service you asked for. You can ask us for more information at [privacyEmail — set in Administration].

• Account, consent and membership data — while your account exists. When you delete your account it is erased, except as listed below.
• Sign-in sessions — each session expires 7 days after sign-in (the token is renewed daily while you use the site) and is then removed. Signing out or deleting your account removes it at once.
• Password-reset links — 30 minutes. Two-step sign-in challenges — 5 minutes.
• Rate-limit counters — removed when their window ends, at most 1 hour.
• Security audit log — 180 days, then automatically deleted. Entries about a deleted account refer only to its internal identifier, never to your name or email, and expire on the same schedule.
• In-app notifications — 90 days. Notification and alert delivery records — 60 days. Email delivery log — 90 days; on account deletion your address and the subjects are removed at once.
• Payment records — when you delete your account we delete our membership and checkout records, but Stripe keeps invoices and transaction records for as long as tax, accounting and anti-money-laundering law requires.
• Community votes and nickname — while your account exists; on deletion they are deleted or irreversibly anonymised so that leaderboard history stays consistent.
• Support emails — as long as needed to deal with your request and any follow-up.
• Backups — database backups may contain your data until they are replaced under our backup routine.
• Data in your browser — until you remove it or clear your browser's site data.

Depending on where you live, you have some or all of these rights. We offer them to every member, wherever you live:

• access your data and receive a copy — use Download my data in Account → Privacy & data to get a JSON file with your profile, consents, sessions, two-factor status, security events and the data held by each feature
• data portability — the same download is in a structured, machine-readable format
• erasure (deletion) — use Delete account in Account → Privacy & data; this erases your personal data straight away, apart from the records we must keep (see "How long we keep data")
• rectification (correction) — ask us at [privacyEmail — set in Administration] to correct your name or email address
• restriction and objection — ask us to limit how we use your data, or object to use based on legitimate interests
• withdraw consent at any time with Cookie settings in the footer, without affecting earlier use
• opt out of the sale or sharing of personal data and of targeted advertising — see the US State Privacy Notice; we do not sell personal data
• not be discriminated against for using any of these rights

For anything you cannot do in the app, email [privacyEmail — set in Administration] from the address on your account. We reply within one month (EU and UK) or 45 days (US states), and may extend this where the law allows for complex requests; we will tell you if that happens. We may ask you to confirm your identity. You may use an authorised agent where your local law allows; we may ask for proof of the agent's authority. If we refuse a request, we tell you why and how to appeal.

Passwords are hashed with scrypt; session cookies are HttpOnly, Secure and SameSite and cannot be read by page scripts; state-changing requests are protected against cross-site request forgery; two-factor sign-in is available; authenticator secrets and integration keys are encrypted at rest with AES-256-GCM; recovery codes are stored as hashes; and administrative actions are recorded in an audit log. Administrators can only see what they need to run the service.

No system is perfectly secure. If we learn of a breach of security that affects your personal data, we will notify you and the authorities as the applicable law requires (for example the GDPR, UK GDPR and US state breach-notification laws such as Pennsylvania's Breach of Personal Information Notification Act).

FootballPlazza is only for adults aged 18 or over (21 or over where the law where you live sets that age for sports betting). It is not directed at children, and we do not knowingly collect personal data from anyone under 18, including children under 13 as defined by the US Children's Online Privacy Protection Act (COPPA). If you believe a child has given us personal data or created an account, contact [privacyEmail — set in Administration] and we will delete it.

If you are unhappy with how we handle your data, please contact us first at [privacyEmail — set in Administration]. You also have the right to complain to a data protection authority: the data protection authority of the EU or EEA country where you live or work, or in the United Kingdom the Information Commissioner's Office (ICO). In the United States you can contact the Attorney General of your state, or for California the California Privacy Protection Agency.

We will update this policy when our processing changes. The version and effective date are shown at the top of the page. We will tell signed-in members about material changes before they take effect, and we will ask for your consent where the law requires it.