Privacy Policy

1. Who we are (controller)

The personal data controller is:

In this policy, we explain what data we collect about you, why, how we use it, to whom we provide it, and what rights you have under GDPR.

2. What personal data we process

Depending on how you use the Fantasy Boosters service, we process mainly these categories of data:

2.1 Data during registration and purchase

• first and last name (if provided),
• email address,
• billing information (company name, ID, VAT ID, address),
• information about the purchased plan (subscription type, number of mini-leagues, Founders Pass, etc.).

2.2 Data about the mini-league used and FPL

• FPL league ID, or league name,
• FPL user/team ID, if provided or if part of the report,
• internal identifiers created in our system (e.g., order ID, subscription ID).

2.3 Technical and analytical data

• IP address,
• device and browser type,
• server logs (e.g., date and time of request, URL, status code),
• cookies and similar technologies,
• analytical events (e.g., report opening, app clicks, page visits, conversions).

2.4 Payment data

Credit card numbers are processed exclusively by the payment gateway; we do not have access to them. We process mainly:

• information about the success or failure of the payment,
• transaction ID, amount, currency, payment time,
• anonymized or pseudonymized data from the payment gateway (e.g., Stripe).

2.5 Newsletter and marketing communication

• email address,
• information about whether you opened the newsletter / clicked on a link (if tracking is used).

3. On what legal basis we process data (GDPR)

The processing of personal data is based on these legal bases according to Art. 6 of the GDPR:

3.1 Performance of a contract (Art. 6(1)(b) GDPR)

On this basis, we process data necessary for:

• creating and managing your account,
• processing orders and providing the digital service (Fantasy Boosters reports),
• communication regarding your subscription (e.g., delivering reports, technical notifications).

3.2 Compliance with legal obligations (Art. 6(1)(c) GDPR)

We process some data because legal regulations require us to do so, especially accounting and tax regulations (retention of invoices and related documents for a legally established period).

3.3 Legitimate interest (Art. 6(1)(f) GDPR)

Our legitimate interest can be the basis for:

• basic analytics and statistics of service use (to know how to improve it),
• prevention of service abuse and resolution of incidents (e.g., security logs),
• mild direct communication to existing customers (e.g., info about changes in conditions, service expansion).

3.4 Consent (Art. 6(1)(a) GDPR)

Based on your consent, we process mainly:

• newsletter subscription / marketing emails,
• advanced analytics and marketing cookies (e.g., Google Analytics, Meta Pixel, etc., if we use them),
• any other purposes not covered by contract, law, or legitimate interest.

4. How we use cookies and analytical tools

4.1 What are cookies

Cookies are small text files stored on your device when visiting our site / app, allowing us to:

• ensure correct website functioning (login, preferences),
• measure traffic and performance (analytics),
• possibly target advertising (marketing cookies).

4.2 Types of cookies we may use

• Necessary (essential) – required for site functioning and security (session cookies, login cookies).
• Analytical – anonymized or pseudonymized measurement of traffic and user behavior (e.g., Google Analytics / other tool).
• Marketing – if we use advertising platforms (e.g., Meta, Google Ads).

5. To whom we provide personal data (recipients)

We may also process your personal data through trusted partners – processors. Typically, these are:

• Payment gateway – e.g., Stripe.
• Hosting and infrastructure – e.g., cloud/hosting provider (Vercel, AWS).
• Email/SMS provider – email distribution tool.
• Analytical tools – e.g., Google Analytics.

5.1 Transfer to third countries

Some providers may have servers outside the EU/EEA. In such cases, we ensure the transfer is protected according to GDPR (EU standard contractual clauses).

6. Retention period of personal data

• data related to contract performance – for the duration of the contract and then for a maximum of 3 years,
• billing and accounting documents – 10 years from the end of the accounting period,
• data for newsletter – until unsubscribing,
• logs and security records – typically 6–24 months.

7. Your rights (data subject rights)

As a data subject, you have mainly these rights under GDPR:

• 7.1 Right of access – the right to know what data we process.
• 7.2 Right to rectification – the right to correct incorrect data.
• 7.3 Right to erasure – the right to "be forgotten".
• 7.4 Right to restriction of processing.
• 7.5 Right to portability.
• 7.6 Right to object to processing based on legitimate interest.
• 7.7 Right to withdraw consent at any time.
• 7.8 Right to file a complaint with the Office for Personal Data Protection of the Slovak Republic.

8. How you can exercise your rights

You can exercise your rights by contacting us at the email address: privacy@fantasyboosters.app

We try to respond to your requests without undue delay, at the latest within 1 month of their delivery.

9. Personal data security

We take appropriate technical and organizational measures to protect personal data, especially encrypted transfers (HTTPS), restricted access to data, and regular updates.

10. Automated decision-making and profiling

Within the Fantasy Boosters service, we do not perform automated individual decision-making within the meaning of Art. 22 of the GDPR. Algorithms serve only for entertainment and community purposes.

11. Changes to this policy

We may update this Privacy Policy from time to time. The current version is always available on our website.

Last updated: December 4, 2025