Privacy Policy
Last updated: 23 July 2026
This Privacy Policy explains how we collect, use, and protect your personal data when you use askfpl (the “Service”), available at askfpl.app. We are committed to protecting your privacy and handling your data transparently and in line with the EU General Data Protection Regulation (GDPR) and Czech data-protection law.
1. Who we are
The Service is operated by Filip Cajthaml, a sole trader (OSVČ) based in Prague, Czech Republic, business ID (IČO) 17128111 (“we”, “us”, “our”). We are the data controller responsible for your personal data.
If you have any questions about this policy or how we handle your data, contact us at help@askfpl.app.
2. What data we collect
We collect only the data we need to provide the Service:
Data you give us
- Account data — your email address and authentication details when you sign up or sign in (including via Google sign-in, if used).
- FPL profile data — your Fantasy Premier League team ID, team name, entry name, and region, which you provide so we can load your squad.
- Mini-league data — the mini-league IDs and names you choose to connect.
- Chat content — the questions you ask and the messages in your chat conversations, which we store so you can browse and resume past chats.
- Demo chat content — if you try the free demo without signing up, the questions you ask and the answers you receive, which we store to improve the Service. These are not linked to an account, and we do not store your IP address alongside them.
Data we generate or receive
- Public FPL data — publicly available Fantasy Premier League data associated with your team ID and connected leagues (squad picks, standings, and rival team information), retrieved from the official FPL public API.
- Usage data — limited technical and usage information needed to run the Service, such as your AI query count (to enforce free-tier limits) and basic, non-marketing analytics about how the Service performs.
- Advert click identifier — if you reached us by clicking one of our adverts on Facebook or Instagram, the identifier Meta added to that link. We store it against your account so we can tell which adverts brought people who signed up. Visitors who arrive any other way have nothing recorded.
- Payment data — if you subscribe, our payment provider (Stripe) processes your payment. We receive limited billing metadata such as your subscription status and the last four digits / card brand. We never see or store your full card number.
3. How and why we use your data
We use your data for the purposes below, each with its legal basis under GDPR Article 6:
| Purpose | Legal basis |
|---|---|
| Create and manage your account and authenticate you | Performance of a contract (Art. 6(1)(b)) |
| Load your squad, mini-leagues, and provide AI answers grounded in your FPL data | Performance of a contract (Art. 6(1)(b)) |
| Store your chat history so you can resume past chats | Performance of a contract (Art. 6(1)(b)) |
| Process subscriptions, trials, and payments | Performance of a contract (Art. 6(1)(b)) |
| Enforce free-tier query limits and prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Keep the Service secure and working; fix problems | Legitimate interests (Art. 6(1)(f)) |
| Send you service-related emails (e.g. account, billing) | Performance of a contract (Art. 6(1)(b)) |
| Send you marketing or product-update emails, where applicable | Consent (Art. 6(1)(a)) — you can withdraw it any time |
| Measure whether our Facebook and Instagram advertising works, by telling Meta that a person it referred to us went on to create an account or subscribe | Consent (Art. 6(1)(a)), given when you create an account |
| Comply with our legal and tax obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data, and we do not use your chat content to train our own models.
4. AI processing of your questions
To answer your questions, we send the relevant context — your question, your squad, and mini-league data — to our AI provider (Anthropic) to generate a response. We send only what is needed to answer the question. Anthropic processes this data as our processor and, under our agreement, does not use it to train its models.
5. Who we share your data with
We share your data only with trusted service providers (“processors”) who help us run the Service, and only as needed. Each is bound by a data-processing agreement:
| Provider | What they do |
|---|---|
| Supabase | Database, authentication, and hosting of your account data |
| Vercel | Application hosting and delivery |
| Anthropic | AI model that generates chat answers |
| Stripe | Payment processing and subscription management |
| MailerLite | Email delivery (service and, where applicable, marketing emails) |
Advertising measurement (Meta). If you reached us by clicking one of our adverts on Facebook or Instagram, our servers send Meta a message when you create an account and when you subscribe, so we can tell which adverts are worth paying for. That message contains the click identifier Meta itself added to the link you followed, a one-way-scrambled (hashed) form of your email address, and — for a subscription — the amount paid. Unlike the other providers listed above, Meta is not acting purely on our behalf: it is a separate controller that also uses this information for its own purposes, which is described in Meta’s Privacy Policy.
This applies only if you arrived from one of our adverts. If you found us any other way, we send Meta nothing about you at all — not your visit, not your signup, not your subscription. We never send your unscrambled email address, your IP address, your questions, or your FPL data. You can ask us to stop at any time by emailing us (see section 13), and we will delete the click identifier held against your account.
We also retrieve publicly available data from the official FPL public API (operated by the Premier League). We may disclose data if required by law or to protect our rights.
6. International data transfers
Some of our providers are located outside the European Economic Area (EEA), including in the United States. Where your data is transferred outside the EEA, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses to ensure your data remains protected.
7. How long we keep your data
We keep your personal data only for as long as necessary:
- Account and profile data — for as long as your account is active. If you delete your account, we delete or anonymise this data without undue delay.
- Chat history — until you delete it or delete your account.
- Demo chat content — kept while we use it to improve the Service. It is not linked to an account, so it is not affected by account deletion.
- Billing records — for as long as required by accounting and tax law (typically several years), even after account deletion.
8. Your rights
Under GDPR, you have the right to:
- access the personal data we hold about you;
- rectify inaccurate or incomplete data;
- erase your data (“right to be forgotten”);
- restrict or object to certain processing;
- data portability — receive your data in a machine-readable format;
- withdraw consent at any time (this does not affect processing that already took place).
To exercise any of these rights, email help@askfpl.app. We will respond within one month.
If you believe we have mishandled your data, you have the right to lodge a complaint with the Czech data-protection authority, the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ), at www.uoou.cz.
9. Cookies
We use only strictly necessary cookies required to run the Service — for example, to keep you signed in and to process payments securely. These are essential to provide the Service you request, so no consent banner is required for them. If we introduce optional analytics or marketing cookies in the future, we will ask for your consent first and update this policy.
We run no advertising or third-party tracking cookies, and no third-party tracking scripts.This is deliberate. The advertising measurement described in section 5 happens entirely between our servers and Meta’s, after you have created an account — nothing is placed on your device, and no third party can follow you around this site or any other.
10. Children
The Service is not intended for anyone under 16 years old, and we do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Security
We take reasonable technical and organisational measures to protect your data, including encryption in transit, access controls, and trusted infrastructure providers. No online service can be completely secure, but we work to protect your data and will notify you and the relevant authority of a personal-data breach where the law requires it.
12. Changes to this policy
We may update this Privacy Policy from time to time. If we make material changes, we will update the “Last updated” date above and, where appropriate, notify you. Your continued use of the Service after changes take effect means you accept the updated policy.
13. Contact
Questions about this policy or your data? Email us at help@askfpl.app.