Skip to content
GRIDIRONEDGENFL MODEL
TEMPLATE — NOT LEGAL ADVICE. Reviewed-by-counsel required. Complete every `[BRACKETED]` placeholder and confirm it matches what your site and vendors actually do. Privacy law is enforced based on your actual practices, so an inaccurate policy is worse than none. See `LEGAL_README_AND_LAWYER_CHECKLIST.md`.

Privacy Policy

Effective date: [EFFECTIVE DATE] Last updated: [DATE]

This Privacy Policy explains how [COMPANY LEGAL NAME] ("we," "us") collects, uses, discloses, and protects personal information when you use [PRODUCT NAME] at [WEBSITE URL] (the "Service"). By using the Service you agree to this Policy.

1. Information We Collect

Information you provide:

  • Account data: name or username, email address, password (stored hashed).
  • Payment data: processed by our payment processor Stripe. We do not store full card numbers; we receive limited billing details and a token/transaction ID.
  • Communications: messages you send us (support, email) and any content or prompts you submit to interactive/AI features.
  • Preferences: subscription tier, favorite teams/players, and settings.

Information collected automatically:

  • Usage & device data: IP address, browser and device type, operating system, pages viewed, referring URLs, and interactions.
  • Cookies and similar technologies: a strictly-necessary session cookie for authentication only. We do not use advertising or cross-site tracking cookies. See Section 4.

Information from third parties: aggregate, cookieless analytics (see Section 4) and, if you sign in via a third party, limited profile data from that provider.

We do not knowingly collect sensitive personal information as defined by applicable law; do not submit it through the Service.

CCPA/CPRA statutory categories collected (last 12 months)

Identifiers (name, email, IP); commercial information (subscription/transaction records); internet or network activity (usage/analytics); geolocation (approximate, from IP); and inferences drawn from the above. We collect these for the business purposes in Section 2. [CONFIRM/EDIT this list to match your actual collection.]

2. How We Use Information

We use personal information to: (a) provide, operate, and maintain the Service; (b) create and manage your account; (c) process subscriptions, billing, and renewals; (d) provide customer support; (e) personalize content and features; (f) analyze and improve the Service; (g) send transactional messages and, with your consent where required, marketing communications (you may opt out anytime); (h) detect, prevent, and address fraud, abuse, and security issues; and (i) comply with legal obligations and enforce our Terms. Each purpose is limited to what is reasonably necessary and proportionate.

3. How We Share Information

We do not sell your personal information for money. We share personal information only as follows:

  • Service providers / processors who act on our behalf, such as: hosting/deployment (Vercel), payment processing (Stripe), analytics (Vercel Web Analytics — first-party, cookieless), and email delivery (Resend), each bound by contract to protect the data. [AI/LLM provider: not applicable yet — no AI assistant feature is live. Update this line if/when one ships.]
  • Legal and safety: to comply with law, respond to lawful requests, or protect our rights, users, or the public.
  • Business transfers: in connection with a merger, acquisition, financing, or sale of assets.

Confirmed: our analytics (Vercel Web Analytics) is cookieless, collects no persistent identifiers, and is not shared with or sold to third parties — it does not qualify as a "sale" or "sharing" under CCPA/CPRA. We run no advertising or cross-site tracking cookies of any kind. See Section 6.

4. Cookies, Analytics, and Global Privacy Control

We use one strictly-necessary cookie: a session cookie (via our authentication provider, Supabase) that keeps you signed in. We do not use advertising, cross-site tracking, or third-party analytics cookies.

Our analytics is Vercel Web Analytics, a first-party, cookieless service — it does not set cookies, use persistent identifiers, or track you across sites; it reports aggregate usage (e.g., page views) only. Because the only cookie we set is strictly necessary and analytics sets none, we do not operate a per-category cookie-consent banner (not required for strictly-necessary-only cookie use) — a brief, dismissible notice on first visit links to this Policy instead.

We recognize and honor the Global Privacy Control (GPC) browser signal: when GPC is detected, analytics does not load for that visit at all. This is a real, functional response, not only a policy statement — see the "Do Not Sell or Share" note in Section 6 for why GPC's usual purpose (opting out of a sale/share) doesn't otherwise apply here. Other than GPC, we do not currently respond to browser "Do Not Track" (DNT) signals.

5. Your Privacy Rights

Depending on where you live, you may have some or all of these rights:

  • Access/Know the personal information we hold and how we use and disclose it.
  • Delete your personal information.
  • Correct inaccurate information.
  • Opt out of the sale or sharing of your information and of targeted advertising.
  • Limit the use of sensitive personal information.
  • Portability — receive a copy of your data.
  • Non-discrimination for exercising your rights.
  • Appeal a denied request.

How to exercise: email danielpar0703@gmail.com or use [REQUEST FORM/LINK]. We will verify your identity and respond within the timeframes required by law (generally 45 days under CCPA, 30 days under GDPR, extendable as permitted). You may use an authorized agent where allowed.

EU/UK residents (if you serve them): our legal bases for processing are performance of a contract, our legitimate interests, consent, and legal obligation. You may object, withdraw consent, and lodge a complaint with your supervisory authority. [CONFIRM whether you intend to serve EU/UK users; if not, say the Service is US-only and you do not target the EEA/UK.]

6. Do Not Sell or Share My Personal Information

We do not sell or share personal information as defined by CCPA/CPRA or similar laws, and have not done so in the past 12 months. We run no advertising or cross-site tracking cookies, and our analytics provider (Section 4) is cookieless and does not receive data usable to identify you across sites or services. Because we don't sell or share, there is no opt-out link to provide here. We still honor the Global Privacy Control (GPC) signal as described in Section 4. If our practices change, we will update this Policy and provide the required opt-out mechanism before any such sale or sharing begins.

Nevada residents: Under Nevada law (NRS 603A), Nevada consumers may submit a verified request directing us not to sell certain covered personal information collected about them. To do so, email danielpar0703@gmail.com.

7. Data Retention

We keep personal information only as long as necessary for the purposes described here, to comply with legal, tax, and accounting obligations, resolve disputes, and enforce agreements. Account data is retained while your account is active and for [RETENTION PERIOD, e.g., 24 months] after closure; billing records are retained as required by law. We then delete or de-identify it.

8. Security

We use reasonable administrative, technical, and physical safeguards (including encryption in transit, hashed passwords, and access controls) designed to protect personal information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If a breach affects you, we will notify you as required by law.

9. Children's Privacy

The Service is not directed to and may not be used by anyone under 21. We do not knowingly collect personal information from children under 13 (COPPA). If you believe a child provided us information, contact danielpar0703@gmail.com and we will delete it.

10. Third-Party Links

The Service may link to third-party sites (e.g., sportsbooks, data providers). We are not responsible for their privacy practices; review their policies.

11. Changes to This Policy

We may update this Policy; the "Last updated" date shows the latest version, and we will provide additional notice where required. Continued use after changes indicates acceptance.

12. Contact Us

[COMPANY LEGAL NAME] — Attn: Privacy [MAILING ADDRESS] Email: danielpar0703@gmail.com