LEGAL
Privacy Policy
Last updated: 6 September 2026
1. WHO WE ARE
Matchroom is operated by Matchroom, England.
Data controller contact: support@getmatchroom.app
2. WHAT DATA WE COLLECT AND WHY
| DATA | WHY | LEGAL BASIS |
|---|---|---|
| Email address and password | To authenticate your account | Contract performance |
| Display name | To show you in pool leaderboards and member lists | Contract performance |
| Prediction picks and results | To run the pool and generate results | Contract performance |
| Payment information | Processed by Stripe; we receive payment confirmation and transaction identifiers, not your full card details | Contract performance and record keeping |
| Device type and browser | Included in an error report only when you choose to send one | Legitimate interests |
| Vercel Web Analytics | Cookieless page-view and traffic measurements, including page, referrer, approximate location, browser and device type | Legitimate interests |
| Google Analytics 4 | Consented session, page, source and device measurements | Consent |
| Optional Matchroom product analytics | Consented interaction events such as CTA clicks, paywall views, picks and payment starts; events may be linked to your account when signed in | Consent |
| Optional acquisition attribution | After consent, standard UTM source, medium, campaign, content and term values, landing path and referring hostname used to connect eligible acquisition touches with signups, pools, checkouts and purchases | Consent |
| Operational and business records | Account, pool, participation, checkout, purchase, refund and entitlement records required to operate and audit the service | Contract performance and legitimate interests |
| Analytics consent preference | To remember and respect whether you accepted or rejected optional analytics; the preference contains no visitor identifier | Legitimate interests |
| Email preferences | To respect your communication choices | Legal obligation / consent |
Analytics and hosting providers may process request information, including IP-derived information, to deliver, secure and aggregate their services. Matchroom does not sell personal data or use these analytics systems to show advertising.
3. WHO WE SHARE DATA WITH
We use the following processors to operate and measure the service:
- Supabase (Supabase Inc., USA) — database and authentication. Data stored in EU-West region. Supabase DPA: supabase.com/privacy
- Stripe (Stripe Inc., USA) — payment processing. Stripe processes payment data under its own privacy policy: stripe.com/privacy
- Resend (Resend Inc., USA) — transactional email delivery. resend.com/privacy
- Vercel (Vercel Inc., USA) — hosting, content delivery and cookieless Web Analytics. vercel.com/legal/privacy-policy
- Google — Google Analytics 4, used only after you accept optional analytics. policies.google.com/privacy
- API-Football (RapidAPI) — sports data. We send no personal data to this service; it provides match fixtures and results.
All processors are required to handle data under their applicable agreements and privacy terms.
4. HOW LONG WE KEEP YOUR DATA
| DATA TYPE | RETENTION PERIOD |
|---|---|
| Account data (email, display name) | Until you request deletion |
| Pool and pick history | Until you request deletion |
| Payment records | 7 years (legal requirement) |
| Error reports | 90 days |
| Analytics consent preference | 180 days, then we ask again |
| Optional acquisition attribution cookie | 90 days from the latest eligible acquisition, or removed when analytics consent is withdrawn |
| Vercel Web Analytics | According to the active Vercel plan and project retention settings |
| Google Analytics 4 | According to the production GA4 property retention setting |
| Matchroom product and business events | For product analysis, service operation and financial audit needs; the precise schedule is under review |
5. YOUR RIGHTS UNDER UK GDPR
You have the right to:
- Access — request a copy of personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete data where the right applies
- Portability — receive applicable data in a machine-readable format
- Object — object to processing based on legitimate interests
- Withdraw consent — reject optional analytics using Cookie settings and unsubscribe from marketing emails at any time
To exercise these rights, email support@getmatchroom.app with the subject line "Data Request." We will respond within 30 days. You may also lodge a complaint with the Information Commissioner's Office (ico.org.uk).
6. COOKIES AND ANALYTICS CONTROLS
Vercel Web Analytics runs without cookies. GA4, optional Matchroom browser interaction events and first-party acquisition attribution run only after you select Accept analytics. GA4 may then set analytics cookies. The consent cookie stores only the current policy version and your accepted or rejected choice; the separate attribution cookie contains the limited campaign values described above and no anonymous visitor UUID.
You can reopen Cookie settings from the footer at any time. Withdrawing consent stops future GA4, optional Matchroom browser-event and acquisition-attribution collection and triggers removal of Matchroom-domain GA and attribution cookies where the browser permits it. Required operational and business records are not controlled by this analytics choice.
7. SECURITY
We use security measures including encryption in transit, encryption at rest and database access controls. If a personal-data breach requires notification, we will notify affected people and the ICO within the applicable legal time limits.
8. CHANGES TO THIS POLICY
We will publish material changes here and provide any additional notice required by law.