1. Who we are

This policy explains how FPLai handles personal data when you use our website (fplai.app) and our iOS app. We do not sell your data and we do not use it for advertising.

FPLai is operated by Martinez Parrondo Digital, a Norwegian sole proprietorship (enkeltpersonforetak), at Fornebu, 1360 Norway. It is the controller of your personal data. Org. no. 938 647 402. You can reach us at [email protected] or through our support form.

We are based in Norway, so the EU/EEA data protection rules (GDPR, as applied in Norway) apply. The supervisory authority is the Norwegian Data Protection Authority, Datatilsynet.

2. What we collect

What we hold depends on how you use FPLai. You can browse parts of the site and try the demo without an account.

• Account data: your email address, name, and how you sign in. If you use email and password we store the password only as a hash. If you use Sign in with Google we receive your email address and basic profile information (name and profile picture); we do not access anything else in your Google account. If you use Sign in with Apple we receive the name and email address Apple shares with us, which can be Apple's private relay address if you choose that. We also keep your plan and subscription status, the date you last used the service, your favourite team, your notification settings (including your push token and which push types are on) and whether you have opted out of emails.
• FPL team data: the FPL team ID you link, and your squad, transfer history, results and leagues. We read this from the public official Fantasy Premier League (FPL) API using your team ID. We do not ask for your FPL login and we never submit anything to the FPL game on your behalf.
• Content you give us: squad screenshots you upload, questions you ask in Ask FPLai (together with the squad context needed to answer), messages you send through the support form (your email, topic, message and your IP address for rate limiting and abuse prevention), feedback you submit on the service or on a suggestion, and team searches you save so we can tell you when that team is found. If you create a shareable verdict or plan link, it contains what the shared page shows, such as your team name, manager name, score, captain pick or planned transfers.
• Payment data: we never see your card details. On iOS, purchases go through Apple In-App Purchase and are managed with RevenueCat. On the web, payments go through Polar. We keep your plan, subscription status, amounts, currency, and the customer, subscription and order identifiers the payment providers give us.
• Device and usage data: on the website and in the app, our own analytics record product actions (for example starting an analysis or opening a plan page), linked to your user ID if you are signed in. On the website they also record the pages you view (path and referrer), campaign tags in the link you arrived from, a random session ID for usage statistics (held in memory for that page view only and never stored on your device, see section 8) and your user agent (browser and device type). In the iOS app, we use PostHog (EU region) to record product events together with your user ID, your plan, whether you have linked an FPL team and whether push notifications are on. For anonymous previews and demos we use a keyed hash of your IP address to apply usage limits, and these records hold only the hash. Our servers and Cloudflare also process your IP address and request details to deliver the service and keep it secure.
• Referral and campaign data: if you open a referral link we keep the referral code in your browser so the referral you followed can be applied when you sign up. If you arrive from a campaign link, the campaign tags (UTM parameters and any ad-click identifier in the link) are held only in memory during your visit and are not stored on your device. If you sign up or buy during that visit, we save the campaign information with the sign-up or purchase and pass it to Polar in the checkout details. If you used the site earlier in the same visit before signing up, we link that activity to your account when you register.

3. Public FPL manager data (people who are not our users)

To let you find a team without knowing its number, we keep a search index of public FPL entries, covering roughly 12 million managers, most of whom have never used FPLai. For each entry the index holds the FPL team ID, team name and manager name exactly as FPL publishes them.

Source: the public official FPL API, which we crawl periodically. We did not collect this data from you directly. Purpose: letting FPLai users search for and open a team. Legal basis: our legitimate interests in providing that search. The data is already public on the FPL site and we use it only for this purpose. When you view leagues or rivals we also show publicly available FPL information about the other managers, such as team and manager names, which we fetch from the official FPL API.

If you appear in this index you have the same rights as everyone else (see section 12). In particular you can object, or ask us to remove your entry, by emailing [email protected] with your FPL team ID.

4. Why we use your data and our legal basis

We only use personal data where the law allows it. Here is what we use it for and on what basis.

Where we rely on legitimate interests we have weighed them against your rights and interests. Ask us if you would like to know more about that assessment.

5. AI processing

Some features use Google's Gemini models, accessed through Google's API (our requests pass through a Cloudflare-hosted proxy). We send Gemini:

• the squad screenshots you upload, so it can read the players in them. We do not store the screenshots after the squad has been read;
• the questions you ask in Ask FPLai together with the squad context needed to answer them. We do not keep these conversations by default; the answer is held in a short-lived cache for up to 24 hours so a repeated request is not charged or answered twice (see section 11 for the optional sharing feature);
• for some insight text, your team name and a summary of your team's performance.

We use Google's paid Gemini API. Under Google's terms for paid API use, Google does not use our requests or the responses to improve its products, although it may keep them for a limited time to detect abuse.

Transfer, captain and chip recommendations come from FPLai's own optimisation engine rather than from a language model. Nothing is submitted to the FPL game for you, and you always make the final decision.

We do not make decisions about you that have legal effects or similarly significant effects based solely on automated processing. AI-written text can be wrong, so please check anything important.

Ask FPLai is an AI assistant, not a person, and is labelled as such in the app. Some news articles and social posts we publish may be written with AI assistance.

6. Who we share it with

We do not sell your personal data and we do not share it with advertisers or ad networks. We use the following service providers (processors) to run FPLai. They may only use your data to provide their service to us, except where a provider acts as an independent controller under its own terms, as Apple does for App Store purchases and Sign in with Apple and Polar does for web payments.

• OVHcloud (OVH GmbH, Germany): hosts our database and backend servers, located in Germany.
• Cloudflare: hosts the website, runs our edge services and storage and provides network security, so it processes the requests your device makes, including your IP address. We also use Cloudflare Web Analytics for aggregate page-view statistics, without cookies.
• Google: the Gemini API for screenshot reading, Ask FPLai answers and insight text (section 5), and Sign in with Google.
• Apple: the App Store, In-App Purchase, Sign in with Apple and Apple Push Notification service, including Live Activities.
• RevenueCat: manages iOS subscriptions. It receives your app user ID, email address and display name.
• Polar: web payments and billing. Polar sells web purchases as merchant of record, so for the payment itself it acts as an independent controller under its own privacy policy. It receives your customer ID, the campaign details described in section 2, your IP address and the details you enter at checkout.
• Expo: delivers app updates (EAS Update) and routes push notifications.
• PostHog (EU region): product analytics in the iOS app. It keeps no analytics identifier on your device; events are linked to your user ID when you are signed in.
• Resend: sends our emails, including replies to support messages.
• OpenAI: only if you connect FPLai to ChatGPT (section 10).

We may also disclose data if the law or a public authority requires it, or to protect our rights, our users or the security of the service.

7. International transfers

Some of these providers, such as Google, Cloudflare, Apple, RevenueCat, Polar, Expo, Resend and OpenAI, may process data outside the EU/EEA, including in the United States. Where that happens the transfer relies on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the provider is certified, or otherwise on the Commission's standard contractual clauses. Our own database is hosted in Germany. You can ask us for more information about the safeguards for a particular provider.

8. Cookies and local storage

On the website we store on your device only what is needed to run the site. We do not use advertising cookies, analytics identifiers or third-party analytics cookies, so there is no cookie banner. Our own usage statistics and campaign information are held only in memory during your visit and disappear when you close or reload the page.

What the site keeps in your browser's local storage (and session storage):

• Sign-in session: keeps you signed in and speeds up loading your account.
• Preferences: things like your currency, analysis mode and selected league.
• Referral code: remembers the referral link you clicked until it is applied.
• Things you asked us to remember: squads or results you were working on.
• Review squad ID: if you build a squad for review without signing in, a random ID is kept in local storage so your saved draft can be restored when you come back. It is used only for that function, not for analytics, and it is removed when you clear your site data.
• Page data cache: copies of information the site has already loaded for you, so pages load faster. This is public data such as gameweek stats and, when you are signed in, your own account data such as referral statistics. It stays on your device until it expires or you clear your site data.

Held only in memory during your visit (not stored on your device): the random session ID for usage statistics and the campaign tags from a link you arrived from. A purchase in that same visit can still be credited to the campaign.

The confirmation page for the welcome-email research question stores nothing on your device: it reads the one-time code from the link, removes it from the address bar, and keeps it only in memory until you confirm or leave the page.

We use Cloudflare Web Analytics for aggregate page-view statistics; it is cookieless and does not store anything on your device.

You can clear everything at any time in your browser's site-data settings; you will be signed out and some preferences will reset. The sign-in and payment pages hosted by Google, Apple and Polar are run by those companies and set their own cookies under their own policies.

In the iOS app: the app keeps your sign-in session in the device's secure storage, and stores your preferences and caches of data it has already loaded on the device. A random review ID is kept so a squad you review without signing in can be restored. Data needed by home-screen widgets and Live Activities (such as your team and the next deadline) is kept in an app group shared between the app and those widgets. When you open the app from a push notification, its campaign tag is kept on the device only briefly so the tap can be counted. Deleting the app removes this data from your device.

9. Emails and notifications

Service emails (such as account and security messages, the welcome email when you create an account, and replies to your support requests) are part of the service. Product and offer emails include feedback requests, nudges, trial reminders, win-back messages and deadline reminders. Every product or offer email has a one-click unsubscribe link, and addresses that bounce or report an email as spam are opted out automatically. In the iOS app you can also turn email updates off in Profile.

Push notifications on iOS only start after you accept the system permission prompt. You can switch each type on or off in the app, or turn them all off in iOS Settings.

10. Optional assistant (ChatGPT) connection

If you connect FPLai to an assistant service, FPLai receives the specific tool requests you send through that connection and returns the requested results. If you choose ChatGPT, OpenAI processes your conversation and the connector results under its own privacy practices. FPLai does not receive your full ChatGPT conversation through the connector.

The information used depends on the permission you approve and the tool you choose:

• Account and team status: FPLai uses your account identity to look up your plan tier and whether an FPL team is linked. For analysis, it uses your linked FPL team ID and relevant team data, including squad picks and season and transfer history, from the official FPL API and FPLai's cache.
• Saved analyses: read requests return the saved-analysis identifier, date, gameweek and recommendation fields for a saved analysis in your account. These can include player names or IDs, captain and vice-captain choices, lineup, transfer recommendations, projection horizon, confidence and rationale.
• Player comparisons: comparison requests can include two to five player IDs or exact player names and a gameweek horizon. FPLai returns current projection and player statistics for those selections.
• Fresh analysis: after you approve a new analysis request, FPLai analyzes your linked team, uses your account's analysis quota and saves a result when the save completes. FPLai reports whether the save was confirmed. It does not submit or execute transfers in the official FPL game.

The connector returns a limited recommendation projection. It does not return original screenshots, user notes, raw extraction data, account identity or internal debug metadata.

FPLai's website, including its OAuth consent page, is hosted on Cloudflare Pages. The authenticated assistant gateway is hosted on OVH and forwards approved requests to FPLai's account, projections and analysis APIs. The gateway stores the assistant client identity, approved permissions, account reference and OAuth session records separately from your FPLai analysis history. Token lookup values are hashed, while session payloads, including server-side FPLai session tokens, are encrypted. Gateway access and refresh tokens expire according to their configured expiry. Expired records are removed during gateway housekeeping. Consumed or revoked records are also eligible for removal once they are at least 24 hours old.

Operational rollback backups may contain OAuth session records. Their session payloads are encrypted, and the backups are stored with restricted access. No automatic schedule currently removes these backups. Disconnecting the assistant or deleting your FPLai account does not immediately erase those records from existing backups.

Saved analyses are stored in your FPLai account and have no automatic expiry in the assistant connector. You can delete saved analyses through supported FPLai app controls or delete your FPLai account from Profile. When account deletion completes, it removes account-linked profile, saved analysis and squad-cache records.

To stop future access, disconnect FPLai from your assistant's connected-app settings. Disconnecting in ChatGPT does not delete information already present in ChatGPT conversations. See OpenAI's connected-app guidance for managing that connection and its conversation data.

11. How long we keep data

• Account data: until you delete your account. Deleting it from Profile removes your sign-in and the account-linked records such as your profile, saved analyses and squad cache. Some analytics and usage rows can remain in aggregate or anonymised form with your user ID removed.
• Squad screenshots: not stored by us.
• Ask FPLai conversations: not kept by default (answers sit in a cache for up to 24 hours). If you choose "share for product review", we keep up to 20 redacted turns for 30 days.
• Shared verdict and plan links: a link stops working 90 days after it was last opened and, at the latest, one year after it was created. Expired links are then eligible for deletion.
• Campaign tags: held only in memory for the length of your visit; nothing about them is kept in your browser afterwards.
• Welcome-email research question: the one-time invitation record (a hash of the code in the email link, tied to your account) is deleted when you answer, or within 7 days after it expires (7 days after it was sent) if you do not. A used link shows as expired. An answer (category and week only) is anonymous and cannot be traced back to you, so we cannot delete an individual answer on request; it is kept in anonymous form.
• Referral matching: a pending web-to-app referral match expires after 7 days.
• Payment and accounting records: about 5 years, because Norwegian bookkeeping law requires it. These are not removed when you delete your account.
• Support messages and feedback: kept only as long as needed to handle your request and improve the service. You can ask us to delete them at any time.
• Team search index: refreshed periodically from the FPL API; entries are removed on request (section 3).
• Database backups: we take daily database backups on a rolling basis. Deleted data drops out of these backups as they roll over, within about 45 days. Backups of the assistant connection are handled as described in section 10.
• Data held by providers: purchase records at Apple, RevenueCat and Polar, events in PostHog and email logs at Resend are not deleted automatically when you delete your account and follow those providers' own retention. You can ask us to pass on a deletion request where the provider allows it.

12. Your rights

You have the right to access your data, have it corrected, deleted or restricted, receive it in a portable format, and object to our use of it, including to direct marketing at any time. Where we rely on your consent (for example push notifications) you can withdraw it at any time without affecting what we did before.

To use a right, delete your account from Profile or email [email protected]. We may need to confirm who you are first. We answer within one month, or tell you within that month if a complex request needs up to two more months, as the law allows. If you are not happy with how we handle your data you can complain to Datatilsynet, the Norwegian Data Protection Authority, or to the authority in your own country. We would appreciate the chance to fix the problem first.

UK and US users: if you are in the UK you have the same rights under the UK GDPR and can complain to the Information Commissioner's Office (ico.org.uk). We do not sell personal information or share it for cross-context behavioural advertising, and we do not use it for targeted advertising. US residents can use the same email to ask for access or deletion.

13. Children

FPLai is not directed at children under 13 and we do not knowingly collect personal data from children under 13. If you believe a child under 13 has given us personal data, contact us at [email protected] and we will delete the account and its data. People under 18 need a parent or guardian's permission to buy.

14. Security

We take reasonable technical and organisational steps to protect personal data, such as limiting who can access it, storing passwords only as hashes and sending data over HTTPS between your device and our service. We never see your card details. No online service is completely secure, so we cannot guarantee absolute security. If a breach affects your rights we will tell you and the authorities as the law requires.

15. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version. If a change is significant we will tell you in the app or by email.