Privacy Policy (GDPR & UK GDPR Compliant)

Banterball (banterball.net) is the data controller. We provide casual, non-gambling Premier League prediction and social banter services for football fans. We do not operate a sportsbook and we do not process payments for real-money betting.

If you create an account, join a league, make weekly predictions, or otherwise use the Service, we process your personal data as described in this Policy.

Depending on how you use Banterball, we may process:

• Account data via third-party OAuth (Google, X / Twitter, Facebook, and other supported sign-in providers): display name, email address, profile picture, and provider user ID. We receive this data only after you choose to connect that account.
• Gameplay data: club preferences, weekly predictions, league standings, group membership, and user-set banter nicknames.
• Technical data: IP addresses (anonymized where applicable), browser type, and essential session cookies needed to keep you signed in and to operate the Service securely.

We process personal data only where a lawful basis under Article 6 of the GDPR / UK GDPR applies:

• Performance of a contract (Art. 6(1)(b)): to create your account, deliver core gameplay, record match predictions, calculate points, and display league tables.
• Legitimate interests (Art. 6(1)(f)): to prevent abuse, combat fraud, keep the platform secure, diagnose faults, and improve matchday reliability, where those interests are not overridden by your rights.
• Consent (Art. 6(1)(a)): for optional cookies and social-media feature opt-ins (such as Twitter bot shoutouts). You may withdraw consent at any time without affecting processing that already took place.

We utilize automated Large Language Models (LLMs such as Google Gemini) to generate satirical match commentary and group tabloids. This content is entertainment satire, not factual reporting.

Match data, league positions, banter nicknames, and display names are passed to AI prompts when Feature me in Matchday Roasts is on (the default). Members who turn it off are sent only as anonymous titles. We never sell your personal data to AI model providers. We do not send your email address, OAuth identifiers, or payment details to those models.

We use carefully selected processors to operate Banterball. They may process personal data only on our instructions and under appropriate data-processing terms:

• Infrastructure & database: Supabase Inc. (authentication, profiles, predictions, and related application data, including Row Level Security controls).
• Application hosting: Vercel Inc.
• Authentication: Google, X Corp, and Meta, when you choose those sign-in methods.
• Payments: Stripe, if you purchase a Season Pass or other paid feature.

Some processors are established outside the UK/EEA. Where that happens, we rely on an appropriate transfer mechanism, such as the UK Extension to the EU-US Data Privacy Framework, an adequacy decision, or standard contractual clauses.

Subject to the limits in the GDPR, UK GDPR, and Data Protection Act 2018, you may exercise:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — ask us to correct inaccurate or incomplete data. Some profile details can be updated through your OAuth provider or in-app settings.
• Right to restriction or objection — ask us to limit certain processing, or object where we rely on legitimate interests.
• Right to data portability — receive certain data you provided to us in a commonly used machine-readable format, where technically feasible.
• Right to Erasure ("Right to be Forgotten"): Users can permanently delete their account and associated data directly in-app via Profile settings or visit /data-deletion.
• Right to withdraw consent — for optional cookies or social features, without affecting the lawfulness of earlier processing.

You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom that is the Information Commissioner's Office (ICO). EU users may contact their local data-protection authority.

We retain personal data for as long as your account remains active, and for a limited period afterwards where we must keep records for security, dispute resolution, or legal compliance. When you delete your account, we erase or irreversibly anonymize data that identifies you, except where a short retention period is required by law (for example, to complete a Meta data-deletion status check or to prevent abuse).

We apply industry-standard encryption in transit (TLS) and at rest through our infrastructure providers, together with access controls and Supabase Row Level Security. No method of transmission or storage is completely secure, but we take appropriate technical and organisational measures to protect your data against unauthorised access, alteration, disclosure, or destruction.

For privacy questions, access requests, or other data-protection inquiries, contact our support channel. We will respond within the time limits required by applicable law.