1. Introduction

FPL Weekly ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our service. We are committed to complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Information We Collect

We collect information you provide directly to us when you:

• Create an account (email address for authentication)
• Add Fantasy Premier League leagues to track
• Contact us for support
• Subscribe to a paid plan (payment information is processed by our payment provider, not stored by us)

We also automatically collect certain technical information when you use our service, such as your IP address, browser type, and usage patterns, to help us improve the service.

3. How We Use Your Information

We use the information we collect solely to provide and improve our service. Specifically, we use it to:

• Create and manage your account
• Generate personalized articles for the Fantasy Premier League leagues you choose to track
• Send you service-related communications (such as gameweek updates, if you've opted in)
• Respond to your support requests
• Improve our service based on usage patterns

We do not use your data for any other purposes. We do not sell, rent, or share your personal information with third parties for their marketing purposes.

4. Fantasy Premier League Data

We access Fantasy Premier League data through their official public API. This data includes league standings, manager information, player statistics, fixtures, and results. This data is publicly available through the Fantasy Premier League API and is used solely to generate personalized articles for the leagues you choose to track.

5. Legal Basis for Processing

Under UK GDPR, we process your personal data based on:

• Contract: To provide the service you have requested
• Legitimate interests: To improve our service and ensure security
• Consent: For optional communications (you can withdraw consent at any time)

6. Data Storage and Security

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Your data is stored securely using industry-standard encryption and security practices. Access to your personal data is restricted to authorized personnel only.

7. Third-Party Services

We use the following third-party services to operate our service:

• Supabase: For authentication and secure database storage
• Fantasy Premier League API: For accessing publicly available FPL data
• OpenAI: For generating article content (we do not share your personal information with OpenAI)

These services are necessary for us to provide our service. They have their own privacy policies, and we ensure they meet appropriate data protection standards.

8. Cookies and Tracking

We use essential cookies to maintain your session and provide our services. We do not use tracking cookies or third-party analytics that collect personal information without your explicit consent. You can control cookies through your browser settings.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of access: Request a copy of the personal data we hold about you
• Right to rectification: Correct inaccurate or incomplete information
• Right to erasure: Request deletion of your account and associated data
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Export your data in a portable format
• Right to object: Object to processing of your personal data
• Right to withdraw consent: Withdraw consent for optional communications at any time

To exercise any of these rights, please contact us at privacy@fplweekly.com. We will respond to your request within one month.

10. Data Retention

We retain your personal information for as long as necessary to provide our services and fulfill the purposes outlined in this privacy policy. When you delete your account, we will delete your personal information within 30 days, except where we are required to retain it for legal or regulatory purposes (such as financial records for paid subscriptions).

11. Data Transfers

Your personal data is primarily stored and processed within the UK and European Economic Area (EEA). If we need to transfer your data outside the UK/EEA, we will ensure appropriate safeguards are in place to protect your data in accordance with UK GDPR requirements.

12. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. We will notify you of any material changes by posting the new privacy policy on this page and updating the "Last updated" date. We encourage you to review this privacy policy periodically.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your rights, or have concerns about how we handle your personal data, please contact us:

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe we have not handled your personal data in accordance with UK GDPR. Visit ico.org.uk for more information.