Privacy Policy

1. Who this covers

PrediSportsHQ hosts prediction-league websites for other organisations. That means two very different groups of people appear in our systems, and the law treats them differently:

• Our customers — the person who sets up and runs a league. For their information we are the data controller, and this policy explains what we do with it.
• Players on a customer's site — the members of that league. For their information the customer is the controller and we are a data processor acting on their instructions. If you play in a league hosted here, the organisation running it is responsible for your data, and its own privacy notice applies.

This distinction matters. It is why this policy is not the same document as the one on a league's own site.

2. What we collect from customers

• Your name, email address, and the organisation you represent.
• What you send us to build your site — branding assets, league details, preferences.
• We take no payments, so we hold no bank or card details.
• Our correspondence with you.
• Basic technical logs when you use the site, for security and troubleshooting.

3. Why we use it, and on what basis

• To run the site you set up — performance of our contract with you.
• To contact you about your site and about important changes to the service — legitimate interests in running the service.
• To keep the service secure — legitimate interests.

We do not sell your data, and we do not use it to advertise to you on behalf of anyone else.

4. Data we process for you

Your league's players give us their information through your site. We process it only to run that site for you — storing predictions, calculating standings, delivering messages and notifications. We do not use it for our own purposes, do not sell it, and do not use it to market to your members.

Some of it is private by design and not visible even to us in normal operation: a player's predictions are readable only by that player until kick-off, and direct messages are readable only by the two people in the conversation. There is no administrator override for either.

5. Where it is kept

Data is stored with Supabase in the European Union. The application is served by Vercel. Email is sent through Resend. Each of these processes data on our behalf under a contract, and each may operate support functions outside the UK and EU under appropriate safeguards.

6. How long we keep it

• Customer account and correspondence — while you are a customer, and for two years after your last site closes.
• A closed site's league data — 90 days, then deleted. You can request an export within the first 30.
• Your players' chat and private messages — 90 days from when each was sent, then deleted. A pinned message stays while it is pinned. Copies of reported or removed messages are kept for 12 months.
• Technical logs — a short rolling window, typically under 30 days.

7. Your rights

Under UK GDPR you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to or restrict how we use it, and ask for it in a portable format. Email us and we will respond within one month.

If you are a player rather than a customer, send those requests to the organisation running your league. We will help them answer you, but they decide.

8. Cookies

This site uses only what it needs to work — a session cookie once you sign in, and the equivalent local storage a browser needs to keep you signed in. There is no advertising or cross-site tracking.

We count visits so we can see how the site is used. No cookie is involved and nothing about you is kept: we add one to a running total for the page you opened, and for the website that sent you here (Google, Instagram and so on). If you are signed in, we also note which days you opened the site, so we can count how many players use it. Those notes are deleted after 400 days.

9. Complaints

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

10. Changes

We will update this policy when what we do changes. The date at the top always shows when it was last revised, and we will email customers about anything material.