Privacy policy of FantaGamesHub
Draft awaiting review by a licensed lawyer. Version 0.1.
This policy explains what data FantaGamesHub collects, who runs it, why we collect it, how long we keep it, who we share it with, and what rights you have. Part A describes what happens today, simply by using the site you're visiting. Part B describes what will happen once account, group, chat, and friendly-bet features become available: those features don't exist yet, and that part describes a plan, not a service that is already running.
Part A — How it works today
A.1 Who is the data controller
The controller of your data is Federico Calò, an individual, who develops and operates FantaGamesHub without a company in between.
- Mailing address: [address to be added]
- VAT number, if applicable: [VAT number to be added, or a statement that none exists]
- Privacy contact email: [dedicated email to be added]
No Data Protection Officer (DPO) has been appointed: under the site's current configuration, appointing one is not legally required, because we don't process special categories of data at scale and we don't carry out large-scale systematic monitoring. We will revisit this if the user base grows significantly.
A.2 What we do today, in one sentence
Today FantaGamesHub is a presentation page. You cannot create an account, we do not ask you to register, and we do not collect any personal data that you voluntarily provide to us, because there is no form, no «Sign up» button, and no feature that would require it yet.
A.3 Data automatically collected from simple browsing
Like any website, when you visit FantaGamesHub your browser automatically sends some technical information to our hosting provider (Vercel), needed to deliver the page to you: IP address, browser and device type, requested page, date and time of the request. This data stays in the hosting provider's technical logs for operation and security purposes, not to build a profile of you, and is kept for the minimum period set by Vercel's policies, typically no more than a few months.
Legal basis: legitimate interest (Article 6(1)(f) of Regulation (EU) 2016/679, «GDPR») in keeping the site working, secure, and protected from abuse. Your consent isn't required because this is a processing activity technically necessary for any website, not a profiling or marketing tool.
A.4 Statistical measurement (Google Analytics 4): off by default today
The site includes the code needed to use Google Analytics 4, a tool that lets us know, in aggregate form, how many people visit the site and which pages they look at. This tool does not start automatically: it stays inactive until you give explicit consent through the cookie panel. Until you do, the site never contacts Google, never sets any measurement cookie on your device, and never transmits any information about you to Google.
The detail of what data is processed if you consent, for how long, and how to change your mind is fully described in our cookie notice, reachable from the footer of every screen: this privacy policy only notes that the tool exists and is off by default.
A.5 Who we share this small amount of data with, today
| Recipient | Role | Why |
|---|---|---|
| Vercel | Hosting provider, acting as processor | Necessary to publish and serve the site |
| Google (only if you consent to measurement) | Provider of the statistics tool | Only if you voluntarily turn on measurement from the cookie panel |
We never sell or transfer any data for advertising purposes. Today, there is no other recipient: there are no other users to share your data with, because there is no product with multiple users yet.
A.6 International data transfers, today
Vercel operates a globally distributed infrastructure, including servers in the United States, and relies on the EU-U.S. Data Privacy Framework as the safeguard mechanism for transfers to the United States. Google, if you enable measurement, does the same for data processed by Google Analytics. The Data Privacy Framework is an arrangement recognized by the European Commission as providing an adequate level of protection for transfers of personal data to certified U.S. companies.
A.7 Your rights, today
Even though we don't yet have an account to identify you by, you still have the right to:
- know for certain what data we process about you (at this stage, essentially only the technical browsing logs, and measurement data if you've consented);
- object to processing based on legitimate interest, by writing to us to ask for clarification on the balance between our security needs and your request;
- withdraw your consent to statistical measurement at any time, from the cookie panel or your browser settings;
- file a complaint with the Italian data protection authority (Garante per la protezione dei dati personali, www.garanteprivacy.it), if you believe the processing violates the regulation.
For any request, write to: [dedicated email to be added].
Part B — Once the product features are live
This part describes a plan, not a running service. None of the features described from here on exist today in the site you are visiting: it will be moved into Part A, section by section, as each feature actually goes into production.
B.1 Creating an account
Once registration is available, you'll be able to create an account with an email address and password. Passwords will never be stored in plain text: they will be handled by our authentication provider (Supabase) using industry-standard encryption. You'll be asked to verify your email address and will be able to reset your password on your own if you forget it.
B.2 What data we'll collect and why
| Data | Why we ask for it | Legal basis |
|---|---|---|
| Email and password | Creating and protecting your account | Performance of a contract with you |
| Nickname, display name, avatar, preferred language | Letting other members of your groups recognize you, showing you the interface in your language | Performance of a contract |
| Date of birth | Verifying that you meet the minimum age to use Credits and take part in friendly bets | Performance of a contract, and the need to responsibly manage a regulatory risk connected to betting |
| Groups you belong to (“Crews”), roles, matches (“Games”) and leaderboards (“Leagues”) you take part in | Making the game work: knowing who can award points, who takes part in what | Performance of a contract |
| Messages in your groups and direct messages between users | Letting you communicate with other members of your group | Performance of a contract |
| Notification content and channel preferences | Letting you know what's happening in your games | Performance of a contract for essential notifications; consent for any non-essential digest |
| Credit wallet movements (purchases, uses, bets) | Letting you always know how many Credits you have and how you used them; tax obligations tied to purchases | Performance of a contract; legal obligation for the tax component |
| Payment data | Processing your Credit purchases (card details never pass through our systems: they are handled directly by Stripe) | Performance of a contract |
| Technical and security logs | Detecting and preventing abuse, fraud, unauthorized access | Legitimate interest |
Why we'll ask for your date of birth. Friendly bets settled in Credits carry a real economic risk, because Credits are purchased with real money: the platform will let only people who have turned 18 use Credits and place bets; account existence itself, without Credit use, will remain available from age 14 onward. Below age 14, consent from a parent or legal guardian will be required.
Once entered, your date of birth cannot be changed by you directly: this is a deliberate choice, to prevent the age check from being bypassed by simply editing your own birthday. If you made a mistake, you'll be able to request an assisted correction from an operator.
B.3 How long we'll keep the data
Generally, for as long as your account exists. Some exceptions:
- Credit ledger entries will remain stored even after your account is closed, in a form no longer linked to your identity, both because they're needed to keep other players' leaderboards and accounts consistent, and because of a legal obligation to keep tax-relevant records for 10 years;
- security logs will be kept for 6-12 months, unless a deeper investigation into an incident requires more;
- if you close your account, your email, password, nickname and other profile data will be deleted or made unrecoverable, subject to the exceptions in B.7.
B.4 Who we'll share your data with
| Recipient | Role | Data involved |
|---|---|---|
| Supabase | Runs the database and authentication | Practically all account data |
| Stripe | Processes payments for Credit purchases | Payment data, purchase amount |
| Vercel | Hosts the application | Technical browsing data |
| Google (only if you consent) | Statistical measurement | Anonymous/aggregate browsing data |
| Transactional email provider | Sends verification, password reset, invite, and receipt emails | Provider not yet chosen — email address, strictly necessary message content |
| Other members of your group (“Crew”) | See your nickname, avatar, scores, and any messages you choose to share | Only what the game's functioning requires to display |
We will never sell your data to third parties for advertising purposes.
B.5 International data transfers
Some of our providers also operate outside the European Union, in particular in the United States. When that happens, we will rely on safeguard mechanisms recognized under European law: standard contractual clauses approved by the European Commission, or the provider's participation in the EU-U.S. Data Privacy Framework. The database holding your data (Supabase) will be configured, as far as possible, on infrastructure located in the European Union; if that changes, we will update this policy.
B.6 Your rights
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Know what data we process about you | Your profile will show the main data; for a full list, write to [dedicated email] |
| Rectification | Correct a wrong piece of data | Email, public nickname, avatar and language will be changeable from your profile; date of birth requires an assisted correction |
| Erasure | Ask that your data be deleted | You'll be able to close your account at any time; some data will remain in non-identifiable form for the reasons explained in B.7 |
| Portability | Receive a copy of your data in a machine-readable format | On request to [dedicated email] |
| Objection | Object to processing based on our legitimate interest | By writing to us, or by turning off non-essential notification channels from your profile |
| Restriction | Ask that a disputed piece of data not be used until the dispute is resolved | On reasoned request to [dedicated email] |
| Complaint | Contact an independent authority | The Italian data protection authority (Garante, www.garanteprivacy.it) |
We will respond within one month of your request, as required by law.
B.7 Why some data can't be fully deleted
Some of the product's records — points awarded in games and Credit movements — are designed to never be edited or deleted once written, because that's the only way to guarantee that a leaderboard can always be reconstructed and that the accounts of a bet between two people always balance, for both of them. If you request deletion of your account, these records will not be removed, but they will be stripped of any direct reference to you: your name will disappear, leaving only numbers and dates that keep the leaderboard and other participants' accounts consistent.
In very small groups, other members may still be able to guess who you were by cross-referencing amounts and timing: we're telling you this honestly, because it's a real limit of this mechanism, not something to hide.
B.8 Minors
- You'll be able to create an account starting at age 14; below that age, consent from a parent or legal guardian will be required.
- You'll be able to purchase Credits and take part in friendly bets only starting at age 18.
- Age will be verified based on what the user declares at registration: this is a check that a determined minor could bypass by lying, and we're saying this openly so its limits are clear. If the volume of Credits in circulation or the regulatory environment requires it in the future, we may introduce a stronger verification method.
- FantaGamesHub is not designed to specifically target young children and will not run targeted advertising toward them.
B.9 If you're in the United States: which laws might apply
FantaGamesHub is aimed, among others, at the U.S. market. The United States has no single federal privacy law comparable to the European GDPR: instead, individual states have their own, differing laws that recognize similar rights — knowing what data we hold about you, having it deleted, correcting it, opting out of its sale or use for targeted advertising. Among the best known: the California Consumer Privacy Act and the California Privacy Rights Act, the Virginia Consumer Data Protection Act, the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act, and a growing list of similar laws adopted by other states.
An honest point, not a technicality: nearly all of these laws apply only to businesses that cross certain thresholds. We don't yet know, and can't know while writing this text, whether and when FantaGamesHub will cross those thresholds: it depends on how many users and how much revenue we'll have, figures that don't exist yet because the product hasn't launched. Before opening the product to the U.S. public, we will check with a lawyer licensed in each relevant state which of these laws actually apply, and we will update this policy accordingly.
In the meantime, and regardless of the thresholds, we commit anyway, as good practice toward all U.S. users: not to sell your personal data, to let you ask what data we hold about you and have it deleted using the same process described in B.6, and to respond within the timeframe required once we've confirmed which law applies.
On minors in the United States: the federal COPPA (Children's Online Privacy Protection Act) law imposes enhanced obligations on sites that collect data from children under 13. FantaGamesHub is designed to not allow account creation below age 14 specifically to stay above that threshold; it remains true, as noted in B.8, that the check will rely on the user's own declaration rather than independent verification.
B.10 Complaints
If you're in Italy or the European Union, you'll be able to contact the Garante per la protezione dei dati personali. If you're in the United States, you'll be able to contact your state's consumer protection authority or the Federal Trade Commission; unlike the European Union, there is no single federal authority responsible for every aspect of privacy.
B.11 How this policy changes
Any substantial change (one that significantly affects your rights or obligations toward you) will be flagged to you and, where legally required, will require a new explicit acceptance the next time you log in. Minor editorial changes are still tracked with a new date at the bottom of the document, without requiring new acceptance.
Contact
For any question about this policy, or to exercise any of your rights, write to: [dedicated email to be added].