Privacy Policy

The data controller for FPL Terminal is Max Rigby, a sole trader trading as FPL Terminal, Suite 12, AM Self Storage, The Causeway, Great Horkesley, Colchester CO6 4EJ. For any privacy question or to exercise your rights, contact support@fplterminal.live. This policy is written to the UK GDPR and the Data Protection Act 2018.

• Account details: your email address and a securely hashed password (we never store your password in readable form).
• Your FPL team ID: the public entry number that tells the Service which squad to read.
• Your written opinions. The free-form text you type about players, and the structured claims, prediction snapshots, and calibration history derived from it.
• Usage counts: how many reads you have logged in a gameweek, so we can enforce tier limits.
• Billing metadata from Stripe (your plan and its status). We never receive or store your card details.
• Ordinary server logs kept by our host (the request, the time, and the originating IP address), retained briefly to keep the Service running and secure.
• Anonymous page counts. Which pages were viewed and which site a visitor came from. No cookie is set, no identifier is stored on your device, and nothing here is linked to your account or to any other visit.
• Which link brought you here. If you arrived from one of our own posts or links, a short tag naming that post (for example “tt” for TikTok) travels in the web address and is stored against your account, so we can tell which of our posts reached anyone. It is a fact about the post, not about you: no cookie is set, nothing is stored on your device, and it is never shared, sold, or used to target you. We also keep a daily count per link of how many people followed it, which is a running total and identifies nobody.

The opinions you write are free-form content and personal data, and we treat them as such. They are stored so the Service can structure them, adjust your expected-points figures, and score your predictions against real results over time. No other user of the Service can see them, and they are retained until you delete the opinion or your account, after which they are removed.

There is one exception, and it is set out in full in clause 10: we may quote a read anonymously on our own social accounts. You can switch that off for your account at any time.

To interpret and structure your written opinions, the text you enter is sent to our AI provider, Anthropic, for processing. Anthropic acts as our processor for this purpose. You can read Anthropic’s terms at anthropic.com/legal/commercial-terms. Two things are sent: the text of your read, and your current squad (each player’s name, position and club) so that the players you name can be matched to the right ones. We do not send your name, your email address, or your account identifier.

• To provide the Service (accounts, squad reads, structuring your opinions and scoring them): performance of our contract with you.
• To enforce tier limits, secure the Service, and prevent abuse: our legitimate interests.
• To quote reads anonymously when we promote the Service (clause 10): our legitimate interests in showing what the Service is for, using content stripped of everything that identifies its author. You can object at any time, in one click, and we will stop.
• To email you about your own gameweek (a reminder the day before a deadline if you have not logged a read, and your record once a gameweek has been marked): our legitimate interests in the Service doing the thing you signed up for. At most two a week, only during a season, never about anything else, and never shared with anyone. One click in Account settings stops both, and every message links to that switch. Account and billing email, such as a password reset or a receipt, is part of providing the Service and sends regardless.
• To count page views and see which sites send us visitors: our legitimate interests in knowing whether anyone is reading. The counts are anonymous, so nothing about them is traceable to you.
• For any analytics that would identify you or set a cookie: your consent, which we would ask for first and you could withdraw at any time. We use none today.

Under UK GDPR you have the right to access, correct, delete, and export your personal data, to object to or restrict certain processing, and to withdraw consent.

• Deletion. You can delete your account and all associated data yourself from the Account page. This is a working in-app path, not just a request address.
• For access, correction, or export, contact support@fplterminal.live and we will respond within one month.
• You also have the right to complain, to us or to the Information Commissioner's Office. See the next clause.

If you think we have handled your data badly, tell us. Email support@fplterminal.live with “data protection complaint” in the subject line, or write to the address in clause 1. You do not have to use a form and you do not have to word it in any particular way.

We will acknowledge your complaint within 30 days of receiving it, look into it properly, and tell you the outcome. That is a legal duty under section 103 of the Data (Use and Access) Act 2025, in force since 19 June 2026, and not a courtesy.

You can complain to the Information Commissioner’s Office instead, or as well, at any point. You do not need to come to us first, though it is usually quicker if you do. The ICO is at ico.org.uk/make-a-complaint.

We use these sub-processors:

• Supabase: authentication and the database holding your account data.
• Vercel: hosting of the Service itself, and its server logs.
• Anthropic: AI structuring of your reads.
• Stripe: payment processing and billing.
• Vercel Web Analytics: counts of page views and where visitors arrived from. No cookies, no identifiers, and nothing that can be traced back to a person or a visit.

That is the whole list. We use no error-monitoring provider and no advertising or profiling tools of any kind; if we ever add one, this clause and the version above change before it goes live.

The database holding your account, squad and reads is hosted in the United Kingdom (London). Our other sub-processors are US-headquartered and process personal data outside the UK: reads sent for structuring are processed by Anthropic in the United States, and hosting and payments are handled by Vercel and Stripe respectively.

Those transfers are made under the safeguards in each provider’s data processing agreement: the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum. You can ask us for a copy of the relevant terms at support@fplterminal.live.

We run social accounts for FPL Terminal, and some of what we post is drawn from the Service. Two different things happen there, and this clause covers both.

Aggregate trends. We may publish community-level figures, such as the most-discussed players in a gameweek, on the condition that no individual is identifiable from them. That is derived data about everyone at once.

Individual reads, anonymously. We may also quote a single read: your words, as you wrote them. When we do, it goes out with no name, no username, no email address, no FPL team number, and no account identifier of any kind. We never say who wrote it, and we never tell anyone privately either.

Reads containing a link, an email address, or an @ handle are never quoted, because those can identify someone even when the words around them do not.

Our lawful basis is legitimate interests, not consent: showing prospective users what the Service is actually for, using content from which the author has been removed. We have weighed that against your interests, which is why quoting is anonymous, why the exclusions above exist, and why the switch below is one click rather than an email.

To object, clear “My reads may be quoted anonymously” on the Account page. It applies to everything of yours from that moment, including reads you have already written, and nothing you write after it is ever considered. You can also email support@fplterminal.live and we will do it for you.

A quote that has already been posted stays posted unless you ask us to remove it, which we will do on request. We cannot recall a screenshot somebody else has taken, and no one honestly can.

We keep your data for as long as your account is active, and delete it when you close your account, save where we must retain limited billing records to meet legal obligations. Access is protected by authentication and database row-level security so that your data is reachable only by you.

We use only the cookies necessary to keep you signed in. Our page counts are deliberately cookieless: they set nothing on your device and store no identifier, which is why this site has no cookie banner and why you have never been asked to dismiss one. If we ever add an analytics tool that needs a cookie, we will ask for your consent first, and this clause will change before it does.

If we change how we handle your data, we will update this policy and its version and effective date above.