Privacy Policy

1. Who we are

Football Financial Model is a product of Alchemy Sports Ventures LLC (“we”, “us”). This policy covers both the marketing site at footballfinancialmodel.com and the application at app.footballfinancialmodel.com. For any privacy question or request, contact privacy@footballfinancialmodel.com.

2. Information we collect

We collect only what we need to provide and improve the service:

• Account information — your name and email address, and a way of proving it is you. If you set a password, it is handled and stored in hashed form by our authentication provider; we never see your plaintext password. If you sign in with Google or LinkedIn instead, we hold an identifier issued by that provider and you have no password with us at all.
• Subscription and billing information — processed by our payment provider (Stripe). We do not store your full card details on our systems.
• Scenarios and content you create — the club scenarios and saved work you produce in the app.
• Usage, analytics and advertising data — information about how the site and app are used, collected only where permitted by your cookie choices.
• Support communications — messages you send us.

Signing in with Google or LinkedIn. You can create an account and sign in using Google or LinkedIn instead of choosing a password. If you do, we receive a limited set of information from that provider: your name, your email address, a profile picture, your language preference, and a permanent identifier that provider uses for your account. This is the standard profile information the provider returns, and we store it as it is sent to us. We use it to create your account, to sign you in, and to contact you about the service.

We ask each provider only for what is needed to identify you — the standard OpenID Connect sign-in permissions covering your identity, your email address and basic profile information. We do not request and cannot reach anything else held in your account with them: no contacts, no calendar, no files, and no ability to post or act on your behalf. We never receive your password for that account. What we receive is stored with the rest of your account data by Supabase, in the European Union, on the same terms as everything else described in this policy. We do not sell this profile information, and we do not share it with advertisers.

An email address is required to hold an account with us. If you sign in using an email address that differs from one already on an account with us, that creates a separate account — we do not merge accounts by assuming that two addresses belong to the same person. You can disconnect us at any time from your Google or LinkedIn account settings; that stops you signing in by that route, and does not by itself delete your account or the information we hold, which is covered in Section 7 and Section 8.

3. How we use your information

• To provide, secure and operate your account and the service.
• To process subscriptions, trials and payments.
• To send service messages — sign-in confirmation, password resets, trial and renewal notices, billing notices, and anything else needed to operate your account. These are part of the service rather than marketing; while your account is open you cannot turn them off.
• To send people who hold an account occasional product updates — a new country, tier or feature. Every one carries an unsubscribe link, and stopping them changes nothing about your account or the service messages above.
• To understand and improve how the product is used.
• To measure whether our advertising works.
• To meet legal and regulatory obligations.

4. Legal bases (UK/EU GDPR)

Where GDPR applies, we rely on: performance of a contract (to provide the service you sign up for, including the service messages described above); legitimate interests (to keep the service secure, to improve the product, and to tell people who already hold an account about changes to it — you may object to that at any time, and every product email carries an unsubscribe link); consent (for non-essential analytics and advertising cookies); and legal obligation (for example, tax and accounting records).

5. Trusted third parties we share data with

We share data only with partners that help us run the business, under appropriate agreements:

• Supabase — authentication and database hosting (EU region, Frankfurt).
• Vercel — website and application hosting, and cookieless aggregate traffic and page-performance measurement.
• Stripe — subscription payments and the billing records that go with them.
• PostHog — product and traffic analytics (EU region), used only where you have accepted analytics cookies.
• Sentry — error monitoring and diagnostic logs (EU region).
• Resend — service and product email delivery.
• Google Workspace — our business email.
• Google — sign-in, if you choose to use it. Google confirms your identity to us; it does not process your data on our behalf, and we do not send it information about how you use the service.
• LinkedIn — sign-in if you choose to use it, and advertising measurement if you accept analytics and advertising cookies. For sign-in, LinkedIn confirms your identity to us and nothing more. For advertising, LinkedIn’s tag tells LinkedIn which pages you visited here, so that we can measure whether our advertising works. The two are independent: the advertising cookies are set for any visitor who accepts them, whether or not they have a LinkedIn account or have ever signed in with one.

We do not sell your personal data.

6. Where your data is stored

We host identity, database, product-analytics and error-monitoring data in the European Union. Advertising measurement data is held by LinkedIn under their own arrangements, which are not limited to the European Union. Alchemy Sports Ventures LLC is itself based in New York, United States, so personal data may be accessed from the United States by us and by providers acting on our instructions. Where we transfer personal data outside your region, we rely on appropriate safeguards such as standard contractual clauses.

7. Retention

We keep personal data for as long as your account is open and as needed to provide the service. Ending a subscription does not close your account or delete the scenarios in it. When an account is closed or erased, four categories are handled differently, and it is worth knowing about them before you ask us to delete your data:

• Financial records. Invoices, charges and the related billing records held by our payment processor are retained after erasure. Tax and accounting law requires us to keep them, and that obligation overrides a deletion request.
• Error logs. Diagnostic error reports are retained for approximately 30 days by our error-monitoring provider and then expire automatically. There is no per-user purge inside that window.
• Product-analytics events. Analytics events are not removed automatically. We delete them on request as a manual step, so please say so explicitly if you want them removed as well.
• Advertising data. Where you have accepted advertising cookies, LinkedIn holds its own record of your visits under its own retention rules. We cannot delete it, because it is not ours to delete — you can ask LinkedIn directly, or clear the cookies involved from your browser. This applies whether or not you have ever held an account with us.

Everything else is deleted or anonymised once it is no longer needed for the purposes set out above.

8. Your rights

Subject to applicable law, you may request to access, correct, delete, or export your personal data, object to or restrict certain processing, withdraw consent where we rely on it (analytics and advertising cookies), and stop product emails at any time. To exercise any of these, email privacy@footballfinancialmodel.com. You also have the right to complain to your local data protection authority.

Deletion and erasure. There is no self-serve delete button. Erasure is run by us on request: email privacy@footballfinancialmodel.com from the address concerned and we will action it, subject to the retention exceptions in Section 7. If you would also like your product-analytics events removed, say so in the same message — that step is separate and manual.

9. Cookies

We use cookies. Essential cookies keep you signed in; analytics and advertising cookies are used only with your consent. See our Cookie Policy for details. The banner appears on your first visit; to change your choice afterwards, write to privacy@footballfinancialmodel.com, or use your account settings if you hold an account.

10. Children

The service is intended for professional and adult users and is not directed to anyone under 18. We do not knowingly collect data from children.

11. Security

We use managed, reputable infrastructure and apply role-based access controls, encryption in transit, and least-privilege practices. No system is perfectly secure, but we work to protect your data proportionately to its sensitivity.

12. Changes

We may update this policy from time to time. Material changes will be reflected by the “last updated” date above and, where appropriate, communicated to you.

13. Contact

Alchemy Sports Ventures LLC — privacy@footballfinancialmodel.com.