Privacy & Cookies
Last updated: 9 September 2026
lib/legal.ts.Who we are
My League Rules is operated by [TO CONFIRM: your full legal name], trading as My League Rules, who is the data controller for the personal data described here. You can reach us at support@myleaguerules.com or by post at [TO CONFIRM: contact address].
Data we collect
Your account: your name and email address, handled by our authentication provider. We never see or store your password.
League data you enter: player names and any chosen display names, positions, skill ratings, match results, goals, assists, Player of the Match votes and season history.
Billing, if you subscribe: your billing address and the identifiers and status of your subscription. Card details go directly to Stripe and never reach our servers.
We do not use analytics or advertising, we do not track you across other sites, and we do not sell your data to anyone.
Data about other people
A league admin enters data about their players, who may not have accounts of their own. If you are an admin, you are responsible for making sure you may record that information about them, and for telling them it is here - particularly where a league is public and its table is visible to anyone with the link. If you are a player and want your details changed or removed, ask your league admin first, or contact us and we will help.
The Service is not designed for under-16s to create accounts. If a league includes children, the admin is responsible for having the appropriate consent from a parent or guardian before entering their details.
Why we can use it (legal basis)
Under UK GDPR we rely on:
Contract - to give you the Service you signed up for: running your leagues, calculating ratings and standings, and taking payment for a paid plan.
Legitimate interests - to keep the Service secure and working, to prevent abuse, and to fix problems.
Legal obligation - to keep billing and tax records for as long as the law requires.
Who processes it for us
These providers process data on our behalf, under contract, and only to run the Service. Some are US-based, and where data reaches them it is covered by the standard contractual clauses and UK addendum in their terms.
| Provider | What for | Where |
|---|---|---|
| Vercel | Application hosting | EU / US |
| Supabase | PostgreSQL database and backups | EU (eu-west-1) |
| Clerk | Accounts, sign-in and session cookies | EU / US |
| Stripe | Subscription payments and invoicing | EU / US |
Your rights
You can ask us for a copy of your personal data, to correct it, to delete it, to export it, to restrict how we use it, or to object to our using it. Email support@myleaguerules.com and we will respond within one month. There is no charge.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.
How long we keep it
League data is kept for as long as the league is in use. When you delete a league or your account, the data is permanently removed within 30 days - the delay is a grace period so an accidental deletion can be recovered, after which it also rotates out of our backups.
Billing and tax records are kept for six years, because UK tax law requires it. That is invoice and payment information, not your league data.
Keeping it safe
Data is encrypted in transit, held in a managed database with access restricted to the operator, and backed up regularly. No service can promise perfect security, but if a breach ever affected your personal data we would tell you and the ICO as required.
Changes to this policy
If we change this policy we will post the new version here with an updated date. If a change materially affects how we use your data, we will tell account holders by email.
Contact
Privacy questions, or want to exercise any of the rights above? Email support@myleaguerules.com.