Privacy Policy

1. Who is responsible for your data

The data controller is Mathias Fremstad Gjestad, General Laakes vei 52, 2010 Strømmen, Norway. You can reach us at mathias@dominatefpl.com.

2. What we collect and why

• Your email address. Used to sign you in. We use passwordless sign-in, so we send a one-time link to your address instead of storing a password. Legal basis: performance of our contract with you.
• Your FPL ID, if you choose to link one. Optional. Used to show your overall rank, free transfers and mini-league standings. Legal basis: consent, which you can withdraw at any time by clearing the field in Settings.
• A profile picture, if you upload one. Optional. Shown to you, and to others in your mini-leagues only if we have manually verified that you own the linked FPL ID. Legal basis: consent.
• Your squad and your plans. The players you pick, your formation, captain, planned transfers for future gameweeks, and which chips you plan to use. This is the substance of the product. Legal basis: performance of our contract with you.
• Payment reference. DominateFPL is currently free, so we collect no payment data at all and never ask for card details. Should we introduce a paid tier later, payments would be handled by Stripe and we would store only a customer reference — never your card details — and we would update this policy before that happens.

3. Where the data comes from

Most of what you see on DominateFPL is not your data at all. Player prices, ownership, fixtures and results come from the official Fantasy Premier League API, which is publicly available. Expected points are produced by our own statistical model, trained on that same public match data.

If you link your FPL ID, our servers request your publicly visible team information from that API — overall rank, points, transfers, chips used, and mini-league standings. These requests are made by our server, not your browser, so your IP address is not shared with them.

4. What we deliberately do not do

• We use no analytics, tracking pixels, advertising networks or third-party cookies.
• We do not sell, rent or share your personal data with anyone for marketing purposes.
• We do not profile you for advertising, and we make no automated decisions with legal effect.

5. Cookies

We set only the cookies required to keep you signed in, placed by our authentication provider. They are strictly necessary for the service to work, so no consent banner is required and there is nothing to opt out of other than not signing in. Clearing them signs you out.

6. Who processes data on our behalf

We use a small number of providers, each bound by a data processing agreement and permitted to use your data only to deliver their service to us:

• Supabase — database, sign-in and file storage. Hosted inStockholm
• Vercel — application hosting and content delivery.
• Stripe — payment processing. Stripe is an independent controller for card data and handles it under its own privacy policy.

Where a provider processes data outside the EEA, that transfer relies on the European Commission’s Standard Contractual Clauses.

7. How long we keep it

We keep your account data for as long as your account exists. Ask us to delete your account and we will remove your profile, squad and plans without undue delay, and in any case within 30 days. Records required for accounting purposes are kept for five years, as Norwegian bookkeeping law requires.

8. Your rights

Under the GDPR you may request access to your data, correction of anything inaccurate, deletion, restriction of processing, and a machine-readable copy to take elsewhere. You may also object to processing based on legitimate interests, and withdraw any consent you have given.

Email us and we will respond within one month. If you believe we have handled your data improperly, you can complain to the Norwegian Data Protection Authority (Datatilsynet), Postboks 458 Sentrum, 0105 Oslo.

9. Children

DominateFPL is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

10. Security

Data is encrypted in transit and at rest. Access to your squad, plans and profile is enforced at the database level, so one account cannot read another’s data. No system is perfectly secure, but we will notify you and Datatilsynet without undue delay if a breach is likely to affect your rights.

11. Changes

If we change this policy in a way that materially affects you, we will tell you by email before the change takes effect. The date at the top always reflects the current version.