Privacy Policy

Craig Fahey, trading as GafferSuite is the controller responsible for personal information processed through GafferSuite.

Privacy and data-rights requests may be emailed, without signing in, to support@gaffersuite.co.uk.

This policy covers GafferSuite accounts, FPL team linking and personalised analysis, purchases and entitlements, support, administration, optional marketing, and use of our website and applications.

• Account data: email address, display name, password hash (not your plaintext password), verification state, authentication/session information and temporary verification, reset or email-change records.
• FPL data: public Entry ID, public team and manager details, team-name verification challenge, picks, history, leagues, players and related data used for squad analysis.
• Payment and access data: Stripe checkout/customer/session/payment references, amount, currency and status, purchase events, and Season Pass entitlement records. Stripe handles full card details.
• Affiliate payout data: if you register for affiliate payouts, the account-holder name, UK sort code and account number needed to send earnings, together with masked destination details, payout history and related administrative records.
• Support data: tickets, messages, account identity and transactional delivery status.
• Administration and security data: proportionate audit, operational, fraud/abuse-prevention and deleted Entry-ID lock records.

GafferSuite does not ask for or store your FPL password or reusable FPL authentication credentials.

Account, support and marketing information is generally provided directly by you. FPL information comes from publicly accessible official Fantasy Premier League sources using the Entry ID you link. We may receive payment status and transaction or reference information from Stripe, and relevant email delivery and preference information from Resend.

We process information to create and secure accounts, verify and link teams, provide and personalise the service, process purchases and access, administer the affiliate programme and send affiliate earnings, respond to support, maintain reliability, prevent fraud and abuse, and meet applicable legal obligations.

Depending on the activity, processing is necessary to provide the service or perform a contract; supports legitimate interests in proportionate security, administration and reliability; is required by law; or relies on consent for optional marketing.

Marketing email is optional, separate from account acceptance, age confirmation and browser-storage choices, and unticked by default at signup. You can withdraw consent in Account & Settings or through the signed unsubscribe link. We may retain a minimum suppression record to honour an opt-out. Resend supports email delivery and marketing contact synchronisation.

GafferSuite uses strictly necessary authentication/security cookies and limited functional browser storage. Affiliate promo codes are entered directly at checkout and are not remembered through referral cookies. We do not currently use optional analytics, advertising, profiling or behavioural-tracking technology. See the Cookie and Browser Storage Policy.

Relevant recipients include hosting and PostgreSQL database infrastructure, Stripe for customer checkout and payments, Resend for email, authentication infrastructure, official/public FPL sources, configured football/news data providers, and support or email-routing services where required. Encrypted affiliate payout details are stored through our hosting and database infrastructure. An authorised administrator may temporarily reveal the destination for one prepared payout, and the necessary recipient details are then disclosed to the relevant banking service when the UK bank transfer is made. Providers process information needed to provide their functions under their current terms.

Some providers may process information in locations described in their current privacy and data-processing terms. Appropriate safeguards are used where legally required. We do not state provider regions or transfer mechanisms here where they have not been verified from current production arrangements.

We retain information only as long as reasonably necessary for the service and the relevant operational, accounting, security, abuse-prevention or legal purpose. Exact periods depend on record type and applicable requirements.

Affiliate payout details are stored using authenticated encryption and access is restricted to payout administration. Decryptable details should be removed when they are no longer needed, while non-sensitive commission, payout and audit history may be retained for accounting, security or legal purposes. Outstanding affiliate payment obligations may require payout details to be retained after programme closure or account deletion until they are resolved.

Account deletion removes the active profile, credentials, linked-team details, entitlements, saved squads, support tickets and account-specific snapshots. Detached SeasonPurchase and payment/webhook/idempotency records, marketing suppression and webhook-deduplication records, deleted-account Entry-ID locks, admin audit/security records, affiliate financial records needed for outstanding or historical obligations, and provider-controlled payment or email records may remain where required for their stated purposes. Retained records may contain transactional identifiers or pseudonymous information.

You can delete your account in Account & Settings. This removes active account and authentication data as described above. A verified Entry ID may remain locked for the relevant season to prevent reuse. Provider records remain subject to provider and legal retention requirements. Deleting an account does not request or automatically produce a refund.

We use reasonable technical and organisational safeguards appropriate to the service. Affiliate payout details are encrypted at rest using a server-held key separate from the database and are not displayed in ordinary affiliate or administrative views. No online service can promise absolute security.

Depending on the circumstances and lawful basis, you may have rights of access, rectification, erasure, restriction, objection and portability, and may withdraw consent at any time. These rights are not always absolute. Email support@gaffersuite.co.uk to make a request; an account login is not required.

You have the right to complain to the UK Information Commissioner's Office. We welcome the opportunity to resolve a concern first, but contacting GafferSuite before the ICO is not mandatory.

GafferSuite uses player, fixture and squad information to produce personalised fantasy-football decision support. The user makes the final choice. This is not automated decision-making that produces legal or similarly significant effects.

GafferSuite accounts and purchases are intended for people aged 18 or over. We do not collect dates of birth for this purpose.

We may update this policy when the service, providers or legal requirements change and will communicate material changes reasonably. Contact support@gaffersuite.co.uk or write to: