Privacy Policy

FPLab is operated by LudeHQ, based in Larnaca, Cyprus. LudeHQ is the controller of the personal data described in this policy. You can contact us at contact@ludehq.com.

• Account data, including your email address and password hash.
• The FPL team ID you provide. This is a public identifier from fantasy.premierleague.com. We also process your app settings and cached public FPL data associated with that identifier.
• Technical data, including your IP address, request logs, and security events. These logs are kept for a short period.
• Money league data, including league names, member team IDs, standings, and other tracking information used for league activity. FPLab does not collect, hold, or pay out entry fees or prizes.
• Information sent to AI providers when you use prediction or news features that rely on those providers. This may include prompts, public FPL information, and relevant app context.

We process personal data under the following legal bases:

• Performance of a contract under Article 6(1)(b) of the GDPR. This covers creating and managing your account, saving your settings, connecting your FPL team, and providing money league tracking.
• Our legitimate interests under Article 6(1)(f) of the GDPR. This covers keeping the Service secure and reliable, preventing abuse, maintaining technical logs, and caching data so the Service works efficiently.
• Compliance with legal obligations under Article 6(1)(c) of the GDPR where we must keep or disclose information to comply with applicable law.

We use the following service providers:

• Vercel for hosting and delivery of the Service.
• Upstash for data caching.
• LudeMail, our self-hosted service, for transactional email.
• AI providers, including OpenAI, Google, and providers accessed through OpenRouter, for prediction and news features where those features are used.

These providers process data only to supply services to us. We do not sell personal data and do not use it for advertising.

Some providers may process personal data outside the European Economic Area, including in the United States. Where required, these transfers are covered by appropriate safeguards, such as the European Commission's Standard Contractual Clauses.

We keep account data until you delete your account. We keep app settings, FPL team information, and money league tracking data while they are needed to provide the Service. Cached FPL data is refreshed or removed as part of normal operations. Technical logs are kept for a short period, unless they are needed for a security investigation or a legal obligation. We may retain limited records for longer where the law requires it.

Depending on the circumstances, you may have the right to access, correct, erase, or receive a copy of your personal data. You may also have the right to restrict or object to processing and to withdraw consent where processing is based on consent.

To exercise a right, email contact@ludehq.com. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

FPLab uses only an essential session cookie to keep you signed in. We do not use tracking or advertising cookies, so no cookie banner is shown. We use browser local storage to remember selected teams and app preferences on your device.

We use HTTPS, password hashing, restricted access to systems, and reasonable technical and organisational measures to protect personal data. No system can guarantee complete security.

FPLab is not directed at children under 16. If you believe a child under 16 has provided personal data, contact us so we can review and remove it where appropriate.

We may update this policy when the Service or applicable law changes. We will publish the updated policy on this page and provide appropriate notice if a change materially affects your rights.

Questions about this policy or your personal data can be sent to contact@ludehq.com.

LudeHQ, Larnaca, Cyprus.