Privacy Policy

1. Who is responsible for your data

The data controller is Mathias Fremstad Gjestad, General Laakes vei 52, 2010 Strømmen, Norway. You can reach us at mathias@dominatefpl.com.

2. What we collect and why

• Your email address. Used to sign you in. We use passwordless sign-in, so we send a one-time link to your address instead of storing a password. Legal basis: performance of our contract with you.
• Your FPL ID, if you choose to link one. Optional. Used to show your overall rank, free transfers and mini-league standings. Legal basis: consent, which you can withdraw at any time by clearing the field in Settings.
• A profile picture, if you upload one. Optional. Shown to you, and to others in your mini-leagues only if we have manually verified that you own the linked FPL ID. Legal basis: consent.
• Your squad and your plans. The players you pick, your formation, captain, planned transfers for future gameweeks, and which chips you plan to use. This is the substance of the product. Legal basis: performance of our contract with you.
• Payment reference. DominateFPL is currently free, so we collect no payment data at all and never ask for card details. Should we introduce a paid tier later, payments would be handled by Stripe and we would store only a customer reference — never your card details — and we would update this policy before that happens.

3. Where the data comes from

Most of what you see on DominateFPL is not your data at all. Player prices, ownership, fixtures and results come from the official Fantasy Premier League API, which is publicly available. Expected points are produced by our own statistical model, trained on that same public match data.

If you link your FPL ID, our servers request your publicly visible team information from that API — overall rank, points, transfers, chips used, and mini-league standings. These requests are made by our server, not your browser, so your IP address is not shared with them.

4. Visitor statistics

We count page views so we know which parts of the site are actually used. This runs on Vercel Web Analytics, and it is deliberately the least invasive option available: it sets no cookies, stores no identifier on your device, and never follows you to other websites.

Each page view is recorded with the page address, the site that referred you, your approximate location (country, region and city), your operating system, browser and whether you are on a phone, tablet or desktop. All of it is derived from the request your browser makes anyway. Your IP address is not stored.

So that repeat visits on the same day are not counted as separate people, our provider derives a temporary identifier from your request. It is not stored on your device, it cannot be used to recognise you on any other website, and it is discarded after 24 hours — after which a return visit counts as a new one. We cannot use it to work out who you are, and we never connect it to your account.

Because nothing is stored on or read from your device, this does not require your consent under the Norwegian Electronic Communications Act, which is why you are not asked to accept cookies. Our legal basis under the GDPR is our legitimate interest in understanding which parts of the site are used, balanced against a form of measurement that cannot identify you.

5. What we deliberately do not do

• We use no tracking pixels, advertising networks or third-party marketing cookies.
• We do not sell, rent or share your personal data with anyone for marketing purposes.
• We do not profile you for advertising, and we make no automated decisions with legal effect.
• We do not link visitor statistics to your account, your FPL ID or your team.

6. Cookies

We set only the cookies required to keep you signed in, placed by our authentication provider. They are strictly necessary to deliver a service you asked for, so they are exempt from the consent requirement. Our visitor statistics (section 4) store nothing on your device at all. Between them, that is why this site has no cookie banner — not because we skipped it. There is nothing to opt out of other than not signing in. Clearing them signs you out.

7. Who processes data on our behalf

We use a small number of providers, each bound by a data processing agreement and permitted to use your data only to deliver their service to us:

• Supabase — database, sign-in and file storage. Hosted inStockholm
• Vercel — application hosting, content delivery and the visitor statistics described in section 4.
• Stripe — payment processing. Stripe is an independent controller for card data and handles it under its own privacy policy.

Where a provider processes data outside the EEA, that transfer relies on the European Commission’s Standard Contractual Clauses.

8. How long we keep it

We keep your account data for as long as your account exists. Ask us to delete your account and we will remove your profile, squad and plans without undue delay, and in any case within 30 days. Records required for accounting purposes are kept for five years, as Norwegian bookkeeping law requires.

9. Your rights

Under the GDPR you may request access to your data, correction of anything inaccurate, deletion, restriction of processing, and a machine-readable copy to take elsewhere. You may also object to processing based on legitimate interests, and withdraw any consent you have given.

Email us and we will respond within one month. If you believe we have handled your data improperly, you can complain to the Norwegian Data Protection Authority (Datatilsynet), Postboks 458 Sentrum, 0105 Oslo.

10. Children

DominateFPL is not directed at children under 16. If you believe a child has given us personal data, contact us and we will delete it.

11. Security

Data is encrypted in transit and at rest. Access to your squad, plans and profile is enforced at the database level, so one account cannot read another’s data. No system is perfectly secure, but we will notify you and Datatilsynet without undue delay if a breach is likely to affect your rights.

12. Changes

If we change this policy in a way that materially affects you, we will tell you by email before the change takes effect. The date at the top always reflects the current version.