PRIVACY

This Privacy Policy describes how FPL Handler ("we", "our", or "us") collects, uses, stores, and protects your personal information when you access our website, dashboard, terminal services, and any associated applications (collectively, the "Services").

By creating an account, linking your Fantasy Premier League (FPL) profile, or using any part of our Services, you consent to the data practices described in this policy. If you do not agree, do not access or use the Services.

We are committed to transparency: we only collect what is necessary to run the analytics engine, and we never sell your personal data to third parties.

We process your data for the following lawful bases: contract performance, legitimate interest, and consent (where required).

• —Service Delivery: Running squad optimisation algorithms, price predictions, captaincy modelling, and generating decision briefs tailored to your FPL team.
• —Communications: Sending deadline alerts, price change notifications, gameweek reminders, and account-related updates. You may opt out of marketing communications at any time.
• —Billing & Subscription Management: Processing payments, managing renewals, handling upgrades/downgrades between Essential and Elite tiers.
• —Security & Fraud Prevention: Detecting suspicious login patterns, abuse of API endpoints, and unauthorised account access.

All data is stored on encrypted servers with AES-256 at rest and TLS 1.3 in transit. Our infrastructure is hosted within ISO 27001-certified data centres. Access to production databases is restricted to senior engineering staff via hardware-key multi-factor authentication.

We maintain automated backup protocols with 30-day retention and run continuous vulnerability scanning. In the event of a data breach, we will notify affected users within 72 hours as required by applicable regulations.

Passwords (where applicable) are hashed using bcrypt with a cost factor of 12. Session tokens are rotated automatically and expire after 24 hours of inactivity.

We integrate with the following categories of third-party processors:

• ›Payment Processors: Paystack / Flutterwave (depending on region) handle all card transactions. We receive only a tokenised payment reference and the last four digits of your card.
• ›Fantasy Premier League API: We pull public gameweek data, player statistics, and your team snapshot. This data is governed by the Premier League's own terms of use.
• ›Analytics & Monitoring: We use privacy-focused telemetry tools to track application performance. No personally identifiable information is shared with advertising networks.

All third-party providers are vetted for GDPR and NDPR compliance and bound by data processing agreements.

We use strictly necessary cookies to maintain your session and authentication state. These cannot be disabled without breaking core functionality.

We do not use third-party advertising cookies, tracking pixels, or social media embeds that leak browsing behaviour. Any analytics cookies deployed are first-party, anonymised, and used solely for product improvement.

You may clear cookies via your browser settings at any time; however, you will be required to re-authenticate on your next visit.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• —Access: Request a copy of all data we hold about you.
• —Correction: Update inaccurate or incomplete information.
• —Erasure: Request deletion of your account and associated data (subject to legal retention requirements).
• —Portability: Receive your data in a structured, machine-readable format.
• —Objection: Opt out of certain processing activities, including direct marketing.

To exercise any of these rights, email fplhandler@gmail.com with the subject line "DATA REQUEST". We will respond within 30 days.

We retain your personal data only for as long as necessary to fulfil the purposes outlined in this policy:

• —Active Accounts: Data is retained indefinitely while your subscription is active or your account remains open.
• —Cancelled Accounts: After account deletion, we purge personally identifiable data within 90 days. Anonymised statistical data may be retained for model training and product analytics.
• —Financial Records: Transaction logs are retained for 7 years to comply with tax and accounting obligations.

Our Services are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If you believe a minor has provided us with data, contact us immediately and we will delete the information.

We may revise this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email or a prominent dashboard notice at least 14 days before taking effect.

Continued use of the Services after the effective date constitutes acceptance of the revised policy. The "Last updated" date at the top of this page indicates the most recent revision.