Legal

What we process

• The public profile link you submit and its canonical form, including the handle or domain shown publicly.
• The club your listing belongs to, and your listing state: fan score, rank and effective support.
• Payment and provider identifiers, the amount, tax, payment status, and refund or dispute information needed to operate and reconcile the payment.
• The email address and message you send with a report or a club request.
• Technical data for security, rate limiting and aggregate traffic counting, including a short lived salted hash derived from your IP address.

Why we process it, and on what basis

• To provide the listing and ranking service you pay for, and to operate checkout and payment: performance of a contract.
• To meet accounting, tax and other legally required record keeping, and to handle disputes where the law requires it: legal obligation.
• To keep the service secure and economically consistent, including fraud and abuse prevention, rate limiting and reconciliation: legitimate interests.
• To handle a report or a club request you send us, and any related safety or legal issue: legitimate interests, and a legal obligation where one applies.

What is public and what is not

Your submitted profile handle or domain, the link, the club you support, your fan score and your rank may be shown publicly, together with related ranking context. Card data, the payer email address, and the email you use for a report or club request are not public. Refund and dispute events are not shown in the public activity feed, and no public activity ever identifies the payer. A listing is submitted by the person who pays for it, who must control the profile or be authorised to list it. If your public profile was listed by someone else, the data comes from that submission and from the public link itself, and you can ask us to review or remove the listing using the report option on the About page or the contact address in the Legal Notice.

What we do not do

• We do not receive or store full card numbers or card security data. Stripe handles card data.
• Our server never opens, fetches or scrapes the profile link you submit, and never loads its favicon or metadata.
• There are no public consumer accounts and no advertising pixels. Our analytics runs in cookieless mode with no tracking cookies and no long-lived browser identifier, and we do not send it your account or profile identity, payer identity, email, submitted profile link, or payment data.
• We do not sell personal data.

Providers we use

• Payment and tax processing, including payment receipts: Stripe.
• Hosting, database and infrastructure providers.
• Human verification and security providers, which may use technical storage strictly necessary for that check.
• Rate limiting and transient counter infrastructure.
• Cookieless website analytics for aggregate visitor measurement, which derives a short-lived, rotating pseudonymous visitor identifier from technical signals such as IP address, user agent and site domain: DataFast.
• Error monitoring may use Sentry when enabled, configured to avoid default personal data collection and scrubbed before sending.

Processing outside the EEA

Some providers may process data outside the European Economic Area. Where that happens, the processing must be covered by a transfer mechanism or safeguard permitted under the GDPR. You can ask us which providers are involved in a specific case using the contact address in the Legal Notice.

How long we keep it

We keep each category only as long as it is needed: listing and ranking data while the listing and its ranking integrity are maintained, payment records for as long as accounting, tax and legal obligations require, dispute and fraud material while a case can still arise, and report or request correspondence while the matter is being handled. Traffic counters expire automatically on short technical lifetimes, currently 120 seconds for the online count and 24 hours for the daily visitor set.

Your rights

Depending on the circumstances you may have the right to access your personal data, to have it rectified or erased, to restrict or object to processing, and to receive it in a portable form. To exercise a right, write to the contact address in the Legal Notice. You can also lodge a complaint with the Spanish Data Protection Agency (Agencia Espanola de Proteccion de Datos, AEPD).