Privacy Policy

The data controller for FPL Terminal is [TRADER NAME], a sole trader trading as FPL Terminal, [TRADING ADDRESS]. For any privacy question or to exercise your rights, contact [CONTACT EMAIL]. This policy is written to the UK GDPR and the Data Protection Act 2018.

• Account details: your email address and a securely hashed password (we never store your password in readable form).
• Your FPL team ID — the public entry number that tells the Service which squad to read.
• Your written opinions. The free-form text you type about players, and the structured claims, prediction snapshots, and calibration history derived from it.
• Usage counts — how many reads you have logged in a gameweek, so we can enforce tier limits.
• Billing metadata from Stripe (your plan and its status). We never receive or store your card details.

The opinions you write are free-form content and personal data, and we treat them as such. They are stored so the Service can structure them, adjust your expected-points figures, and score your predictions against real results over time. They are private to your account — no other user can see them — and are retained until you delete the opinion or your account, after which they are removed.

To interpret and structure your written opinions, the text you enter is sent to our AI provider, Anthropic, for processing. Anthropic acts as our processor for this purpose. You can read Anthropic’s terms at anthropic.com/legal/commercial-terms. We send only the opinion text needed to structure it, not your identity.

• To provide the Service — accounts, squad reads, structuring your opinions and scoring them: performance of our contract with you.
• To enforce tier limits, secure the Service, and prevent abuse: our legitimate interests.
• For any non-essential analytics: your consent, which you can withdraw at any time.

Under UK GDPR you have the right to access, correct, delete, and export your personal data, to object to or restrict certain processing, and to withdraw consent.

• Deletion. You can delete your account and all associated data yourself from the Account page — this is a working in-app path, not just a request address.
• For access, correction, or export, contact [CONTACT EMAIL] and we will respond within one month.
• You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

We use these sub-processors:

• Supabase — authentication, database, and hosting of your account data.
• Anthropic — AI structuring of your opinion text.
• Stripe — payment processing and billing.
• Our error-monitoring and analytics providers — see [SUB-PROCESSOR LIST / DPA LINKS] for the current list.

We may produce and publish aggregate, community-level trends (for example, the most-discussed players in a gameweek) on the condition that no individual user is identifiable from them. This is derived data about the community as a whole, never your individual opinions.

We keep your data for as long as your account is active, and delete it when you close your account, save where we must retain limited billing records to meet legal obligations. Access is protected by authentication and database row-level security so that your data is reachable only by you.

We use only the cookies necessary to keep you signed in. If we ever add non-essential analytics cookies, we will ask for your consent first.

If we change how we handle your data, we will update this policy and its version and effective date above.