Privacy policy

This page explains what data fpldatamoves collects and who processes it. The operator is FplDataMoves, Dublin, Ireland. Contact: hello [at] fpldatamoves [dot] com.

Data we collect

• Account data: your email address and password, or your Google sign-in details. Supabase Auth stores these.
• Your name, if you give one when you sign up.
• Your FPL Team ID and mini-league ID, if you link them to your account.
• Your watchlist and your alert settings.
• Your subscription plan and billing dates. We do not store your card number.
• Your purchase record: see the section on emails below.
• Your AI analysis use for each gameweek, so we can apply your quota.
• Page views and page speed: the page, the site you came from, your country, browser and device type, and how fast the page loaded. Vercel Web Analytics and Vercel Speed Insights record these without a cookie. They do not record the parts of a page address that can hold personal data, such as a sign-in code.

Rating a team without an account

You can rate a team from a Team ID without an account. We read the public squad from the FPL website. Your Team ID goes into the page address.

AI analysis and screenshots

When you ask for an AI analysis, we send your squad data to Anthropic. This data includes the players in your squad, your gameweek, and your bank, free transfers and chip when we have them. Anthropic returns the analysis. When you upload a screenshot of your squad, we send the image to Anthropic to read the player names. Both features need an account.

We do not claim anything here about how long Anthropic keeps this data. See Anthropic's own policy for that.

Payments

Stripe handles all payments. Stripe collects your card details on its own pages. fpldatamoves never sees or stores your card number. We store your Stripe customer and subscription references so we can show your plan and open the Stripe Customer Portal for you.

Emails

We use Resend to send emails. These are a welcome email and, if you turn on Smart Alerts, a digest email before each gameweek deadline. Each digest email has an unsubscribe link.

When you buy a plan, we also send a purchase confirmation email. It repeats what you agreed at Checkout about your 14-day right to cancel. We keep a record of each purchase: your email address, the plan, the amount, the dates, your Stripe customer and Checkout session references, the link to your account, and whether the email was sent. When you delete your account, we remove the link to your account. We keep the rest of the record, to show what you agreed. We keep the purchase record for 6 years after the purchase. Then we delete it. We keep it for this time because the law asks us to keep records of our sales, and because it helps us to answer a claim or a dispute. The first reason is our legal duty. The second reason is our legitimate interest.

Services that process your data

• Supabase: sign-in and our database, in Ireland.
• Anthropic: AI analysis and screenshot reading.
• Stripe: payments.
• Resend: email delivery.
• Vercel: hosting of the website, in Dublin, Ireland, and page view and page speed statistics.
• Railway: hosting of our backend server, in Amsterdam, the Netherlands.

Legal basis, retention and transfers

The law asks us to have a legal basis for each use of your data. These are ours.

• Your account, your sign-in, your name, your team and league IDs, and your watchlist: contract. We need them to give you the service that you signed up for.
• AI analysis and screenshot reading: contract. You ask for these features, and we need your squad data to provide them.
• Your plan, your payments and your welcome email: contract. We need them to sell you a plan and to give you access to it.
• Your purchase record and the purchase confirmation email: legal duty, because the law asks us to keep records of our sales. Also legitimate interests, because we need to answer a claim or a dispute.
• The digest email for Smart Alerts: consent. You turn it on. You can turn it off at any time with the unsubscribe link in each email.
• Your count of AI analyses for each gameweek: legitimate interests. We need to apply your quota and to stop misuse that costs us money.
• Page view and page speed statistics: legitimate interests. We need to know how people use the site and to find slow pages.
• Security and misuse checks: legitimate interests. We need to keep the service safe for all users.

When we rely on legitimate interests, we weigh them against your rights. You can object to this use. See the section on your rights.

We keep each kind of data for this time:

• Your account, your name, your team and league IDs, your watchlist, your alert settings, your plan and your count of AI analyses: until you delete your account. Then we delete them.
• Our log of AI requests (the gameweek, the type of request, the model, the size and cost of the request, and your Team ID): 12 months. Then we delete it. When you delete your account, we remove the link to your account. The Team ID stays in the log until the 12 months end.
• Your purchase record: 6 years after the purchase, as the section on emails says.
• Page view and page speed statistics: Vercel keeps them for the time that our Vercel plan allows.
• Emails that we send: Resend keeps a log of them for the time that our Resend plan allows.
• Payment data: Stripe keeps it for as long as the law asks Stripe to keep it.
• Backups: data that we delete can stay in the backups of our database for the backup time of our Supabase plan.

We store your data in Europe. Our database (Supabase) is in Ireland. The website (Vercel) is in Dublin, Ireland. The backend server (Railway) is in Amsterdam, the Netherlands. UK law lets data go to these countries without extra steps.

Some of our providers process data outside the UK and the European Economic Area, mostly in the United States. These are Anthropic (AI analysis and screenshot reading), Stripe (payments) and Resend (email). Our other providers can also reach your data from other countries, for example to give support.

When data goes to a country that the UK has not approved, we use a safeguard that UK law accepts. For a US provider that is certified under the UK-US data bridge, this is the data bridge. For other providers, it is a contract with standard data protection clauses: the UK addendum to the EU standard contractual clauses, or the UK international data transfer agreement. You can ask us for more information at any time. Send an email to hello [at] fpldatamoves [dot] com.

Your rights

The law gives you these rights over your data:

• See the data that we hold about you, and get a copy.
• Correct data that is wrong.
• Delete your data. Some records, such as the purchase record, we must keep for a set time.
• Ask us to limit how we use your data.
• Receive your data in a format that a computer can read, and move it to another service.
• Object to a use that rests on legitimate interests.
• Withdraw your consent at any time, for example for the Smart Alerts digest.

To use a right, send an email to hello [at] fpldatamoves [dot] com. Use the email address of your account. We can ask you to prove who you are. We answer within one month.

Delete your account

To delete your account, send an email to hello [at] fpldatamoves [dot] com from the email address of the account. If you have a monthly plan, cancel it first in the Stripe Customer Portal, so that it does not renew. We then delete your account data. We keep the purchase record for the time that this page states.

Complaints

If you think that we handle your data in a wrong way, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Cookies

We use cookies to keep you signed in. Our page view and page speed statistics set no cookie.

Changes

We can change this policy. When we change it, we change the date at the top of this page. For an important change, such as a new use of your data or a new provider that receives it, we send you an email or show a notice on the site before the change starts.