Privacy Policy

Last updated: 10 June 2026

This Privacy Policy explains how CardStats ("we", "us", "our") collects, uses, and protects your personal data when you use cardstats.io (the "Service"). We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

Who we are

CardStats is a football disciplinary-statistics platform. For the purposes of data protection law, the data controller is CardStats, contactable at contact@cardstats.io.

If you have any questions about this policy or how we handle your data, you can reach us at contact@cardstats.io.

What data we collect

We collect the following categories of personal data:

Account information. When you sign in using Google, we receive your name and email address from Google to create and manage your account. We do not receive or store your Google password.

Your activity on the Service. If you create a watchlist, we store the players you have added to it, linked to your account.

Analytics and usage data. With your consent, we use analytics tools to understand how the Service is used (pages visited, features used, general device and browser information, and session activity). These tools may set cookies or similar identifiers. See "Cookies and analytics" below.

Communications. If you contact us, we keep a record of that correspondence.

We do not knowingly collect data from anyone under the age of 18. The Service is intended for adults.

How we use your data

We use your personal data to:

• Create and manage your account and provide the Service to you;
• Save and display your watchlist and preferences;
• Send you service-related emails (for example, sign-in and account emails);
• Understand and improve how the Service is used (with your consent, via analytics);
• Maintain the security and integrity of the Service;
• Comply with our legal obligations.

Legal bases for processing

Under UK GDPR, we rely on the following legal bases:

• Contract — to provide the Service you have signed up for (account, watchlist, core features);
• Consent — for non-essential cookies and analytics, which we only run after you accept them. You can withdraw consent at any time;
• Legitimate interests — to keep the Service secure and to operate and improve our platform, where this does not override your rights;
• Legal obligation — where we are required to process data to comply with the law.

Cookies and analytics

We use essential cookies that are necessary for the Service to function (for example, to keep you signed in and to remember your cookie preferences). These do not require consent.

We also use non-essential analytics tools, which only run after you give consent via our cookie banner:

• Microsoft Clarity — to understand how users interact with the Service (including aggregated session activity and heatmaps);
• PostHog — for product analytics (which pages and features are used, and how).

You can accept or decline these when you first visit, and your choice is remembered. Declining does not affect your ability to use the Service. You can change your choice by clearing your cookies or contacting us.

Who we share your data with

We do not sell your personal data. We share data only with the service providers that help us operate the Service, who act as our data processors:

• Google — for sign-in / authentication;
• Supabase — for database hosting and authentication infrastructure;
• Vercel — for application hosting;
• Microsoft Clarity and PostHog — for analytics (only with your consent);
• Resend — for sending service emails.

These providers process data on our behalf under appropriate data-processing terms. Some may process data outside the UK/EU; where they do, appropriate safeguards (such as Standard Contractual Clauses or an adequacy decision) are in place.

International transfers

Some of our service providers are based outside the UK and European Economic Area. Where your data is transferred outside the UK/EEA, we ensure an appropriate safeguard is in place, such as an adequacy decision or Standard Contractual Clauses.

How long we keep your data

We keep your account data for as long as your account is active. If you delete your account or ask us to delete your data, we will remove your personal data within a reasonable period, except where we are required to retain it for legal reasons. Analytics data is retained in line with the providers' standard retention periods.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Request correction of inaccurate data;
• Request deletion of your data ("right to be forgotten");
• Object to or restrict certain processing;
• Withdraw consent for analytics at any time;
• Request a copy of your data in a portable format;
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us at contact@cardstats.io.

Security

We take reasonable technical and organisational measures to protect your data, including encrypted connections and access controls. No method of transmission or storage is completely secure, but we work to protect your data and to keep our practices up to date.

Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you.

Contact

If you have any questions about this Privacy Policy or your data, please contact us at contact@cardstats.io.