Privacy Notice

Who is responsible

Arijit Ghosh, operator of Gaffr (gaffr.team), is the data controller for personal data processed through the service. Contact us via our contact page.

Data we collect and why

• Account data (email, name, date of birth, login details) — to create and run your account (contract).
• Game data (team name, squads, transfers, linked FPL team ID, scores) — to provide the league (contract).
• AI Advisor data (your squad and chosen settings sent to our AI provider, token balance and run history) — to generate advice you request (contract).
• Messages sent via contact or partnership forms — to reply to you (legitimate interests).
• Technical data (IP address, device and browser information, usage logs) — for security, fraud prevention and fixing problems (legitimate interests).
• Emails such as sign-in codes and invitations — to operate your account (contract).

Who we share data with

• Service providers: hosting and database, email delivery, and AI model providers, acting on our instructions.
• Paddle, our Merchant of Record, for the sale of tokens and subscriptions, subscription management, payments, tax compliance and invoicing.
• Professional advisers (legal, accounting) where needed.
• Authorities where required by law.

International transfers

Some providers may process data outside the UK/EEA. Where they do, we rely on adequacy decisions or Standard Contractual Clauses.

How long we keep data

We keep account and game data while your account is active, and delete or anonymise it when no longer needed, normally within 90 days of account closure. Purchase records are kept as long as tax law requires.

Your rights

Under GDPR you can access, correct, delete, restrict or port your data, object to processing, and withdraw consent at any time. You may complain to your local data protection authority. We respond to requests within one month.

Security

We use appropriate technical and organisational measures, including encryption in transit, access controls and row-level permissions on stored data.

Cookies

We only use essential cookies and browser storage to keep you signed in and to process checkout. We do not use advertising cookies. You can clear them in your browser settings, but sign-in will stop working.