1. Introduction
FPL Copilot ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal data when you use our Service.
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Data We Collect
We collect the following types of personal data:
Account Information
- Email address (required for account creation)
- Display name (optional)
- Password (stored securely using industry-standard hashing)
Team Data (Created in App)
- Fantasy teams you create within our app
- Squad selections and captain choices
- Chip usage history
Usage Data
- Chat conversations with our AI assistant
- Feature usage patterns
- Email engagement (opens, clicks)
Technical Data
- IP address
- Browser type and version
- Device information
- Cookies and similar technologies (see Section 8)
3. How We Use Your Data
We use your personal data for the following purposes:
- Service Delivery: To provide AI-powered analysis and recommendations
- Personalization: To tailor insights based on your team and preferences
- Communications: To send weekly strategy reports and service updates
- Account Management: To manage your subscription and preferences
- Improvement: To analyze usage patterns and improve the Service
- Security: To detect and prevent fraud or abuse
4. Legal Basis for Processing
We process your data based on:
- Contract: Processing necessary to provide the Service you requested
- Consent: For optional communications like marketing emails
- Legitimate Interests: To improve our Service and ensure security
- Legal Obligation: To comply with applicable laws
5. Third-Party Services
We use the following third-party services to operate FPL Copilot:
- OpenAI: Powers our AI chat assistant. Chat conversations are processed by OpenAI's API. See OpenAI's Privacy Policy
- Supabase: Database hosting and authentication infrastructure. Data is stored securely in their EU data centers
- Resend: Email delivery for strategy reports and transactional emails
- Vercel: Website hosting and analytics
- Stripe: Payment processing for subscriptions (if applicable). We do not store your full payment card details
6. Data Retention
We retain your data for as long as your account is active or as needed to provide the Service. Specifically:
- Account data: Retained until you delete your account
- Chat history: Retained for 12 months, then automatically deleted
- Usage logs: Retained for 90 days for security and debugging
- Email preferences: Retained until you unsubscribe or delete your account
After account deletion, we may retain anonymized data for analytics purposes.
7. Your Rights
Under UK GDPR, you have the following rights:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your personal data
- Portability: Receive your data in a structured, machine-readable format
- Restriction: Request limited processing of your data
- Objection: Object to processing based on legitimate interests
- Withdraw Consent: Withdraw consent at any time (where applicable)
To exercise these rights, contact us at privacy@fplcopilot.com. We will respond within 30 days.
8. Cookies
We use cookies and similar technologies to:
- Essential cookies: Required for authentication and security
- Preference cookies: Remember your settings and preferences
- Analytics cookies: Understand how you use the Service (anonymized)
You can manage cookie preferences through your browser settings. Note that disabling essential cookies may affect Service functionality.
9. Data Security
We implement appropriate technical and organizational measures to protect your data, including:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of sensitive data at rest
- Regular security assessments
- Access controls and authentication
While we strive to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security.
10. International Transfers
Some of our third-party service providers may process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as:
- Standard Contractual Clauses approved by the ICO
- Adequacy decisions by the UK government
- Certification schemes (e.g., EU-US Data Privacy Framework)
11. Children's Privacy
The Service is not intended for children under 13 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through the Service. The "Last updated" date at the top indicates when the policy was last revised.
13. Contact Us
For privacy-related inquiries or to exercise your rights, contact us at:
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk