Privacy Policy

1. Who this covers

PrediSportsHQ hosts prediction-league websites for other organisations. That means two very different groups of people appear in our systems, and the law treats them differently:

• Our customers — the person who orders and runs a site. For their information we are the data controller, and this policy explains what we do with it.
• Players on a customer's site — the members of that league. For their information the customer is the controller and we are a data processor acting on their instructions. If you play in a league hosted here, the organisation running it is responsible for your data, and its own privacy notice applies.

This distinction matters. It is why this policy is not the same document as the one on a league's own site.

2. What we collect from customers

• Your name, email address, and the organisation you represent.
• What you send us to build your site — branding assets, league details, preferences.
• Billing details sufficient to invoice you. We do not store card numbers.
• Our correspondence with you.
• Basic technical logs when you use the site, for security and troubleshooting.

3. Why we use it, and on what basis

• To provide the service you ordered — performance of our contract with you.
• To invoice you and keep accounting records — legal obligation.
• To contact you about your site, renewals and material changes — legitimate interests in running the service.
• To keep the service secure — legitimate interests.

We do not sell your data, and we do not use it to advertise to you on behalf of anyone else.

4. Data we process for you

Your league's players give us their information through your site. We process it only to run that site for you — storing predictions, calculating standings, delivering messages and notifications. We do not use it for our own purposes, do not sell it, and do not use it to market to your members.

Some of it is private by design and not visible even to us in normal operation: a player's predictions are readable only by that player until kick-off, and direct messages are readable only by the two people in the conversation. There is no administrator override for either.

5. Where it is kept

Data is stored with Supabase in the European Union. The application is served by Vercel. Email is sent through Resend. Each of these processes data on our behalf under a contract, and each may operate support functions outside the UK and EU under appropriate safeguards.

6. How long we keep it

• Customer account and correspondence — while you are a customer, and for two years after your last site closes.
• Invoices and accounting records — six years, as UK tax law requires.
• A closed site's league data — 90 days, then deleted. You can request an export within the first 30.
• Technical logs — a short rolling window, typically under 30 days.

7. Your rights

Under UK GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to or restrict how we use it, and ask for it in a portable format. Email us and we will respond within one month.

If you are a player rather than a customer, send those requests to the organisation running your league. We will help them answer you, but they decide.

8. Cookies

This site uses only what it needs to work — a session cookie once you sign in, and the equivalent local storage a browser needs to keep you signed in. There is no advertising or cross-site tracking.

9. Complaints

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes

We will update this policy when what we do changes. The date at the top always shows when it was last revised, and we will email customers about anything material.