SuperScout Privacy Policy

Version 1.3 — Effective 30 July 2026 Last updated: 28 July 2026

1. Who we are

Data controller: Paul Insley, trading as SuperScout, a sole trader registered in England, United Kingdom.

Postal address: SuperScout, 61 Bridge Street, Kington, HR5 3DJ, United Kingdom.

ICO registration number: ZC118315.

Paul Insley is the controller and Privacy Lead. SuperScout is not currently required to appoint a statutory Data Protection Officer. Specialist external advice is used where appropriate.

2. Who can use SuperScout

You must be at least 13 years old. If you are aged 13–17, you must have permission from a parent or guardian before creating an account. During signup, we may ask you to confirm that you have this permission. We may also request further confirmation where appropriate.

Children under 13 must not create an account. A separate plain-language privacy notice is available for young users.

3. Personal data we collect

Account data: email address, display name, hashed password, age band and account status.

FPL data: FPL Manager ID, team selections, league history and public FPL information connected to the account.

Preferences: notification settings, playing style and feature choices.

Decision context: active chip, free transfers, mini-league gap to the leader where available, and gameweeks remaining.

Decision records: options shown, highlighted pick, confirmed decision, timing, later outcome and decision-quality score.

Adult-only behavioural profile: risk appetite, recency bias, timing pattern, template-versus-contrarian tendency and comfort-zone override rate.

Feedback: ratings, survey responses and free-text comments you choose to submit.

Consent and rights records: privacy choices, parental-permission attestation, policy version, deletion requests and export requests.

Usage and device data: app version, device and operating-system information, feature interactions and analytics where you consent.

Subscription data: product, plan and entitlement status. We do not receive your full payment-card details.

Security and operational data: limited logs needed to protect and operate the service.

We do not intentionally collect health data, ethnicity, political opinions, criminal-offence data or other special-category data. We do not collect your FPL password or login credentials.

4. How we use personal data and our lawful bases

Contract: creating and managing your account; connecting FPL data; providing the service; administering subscriptions and delivering features you request.

Legitimate interests: personalised recommendations; explainable decision-scoring and educational feedback; adult-only behavioural profiling; security and misuse prevention; necessary service messages; and responding to account and data-rights requests.

Consent: optional analytics, marketing push notifications and newsletters. You can withdraw consent at any time.

Legal obligation: tax, accounting and other records we must retain by law.

We have completed a Legitimate Interests Assessment. It concludes that our interests do not override your rights where the safeguards in this policy are applied.

5. Artificial intelligence, automated processing and profiling

SuperScout uses artificial intelligence, including services provided by Anthropic, to generate personalised fantasy-football recommendations, analysis and commentary.

All outputs are advisory. SuperScout does not make decisions about you that produce legal or similarly significant effects. You remain in control of every fantasy-football decision.

SuperScout does not build or use a persistent behavioural profile for users under 18. Young users may receive single-decision educational feedback, but this is advisory, limited to that decision and not used to create a behavioural profile over time.

Adults may receive adaptive coaching based on a behavioural profile built from their decisions during the season. Adults can object to or turn off this profiling. If you do, we will stop updating and using the profile for coaching adaptation or engagement. You may also ask us to delete or reset profile data linked to your account.

We do not use behavioural information to shame, pressure or manipulate users. The comfort-zone override rate may be used for adults only to improve the timing or relevance of legitimate prompts. It must never be used to exploit a tendency or create dark patterns.

6. Who we share data with

Supabase: authentication and database hosting. Application data is hosted in London, United Kingdom.

Render: hosting the SuperScout API and related operational services. The production region and applicable transfer safeguard are recorded in our internal processing records.

Anthropic: AI analysis and recommendations using minimised and pseudonymised FPL and preference data.

RevenueCat: subscription and entitlement management.

Apple and Google: app distribution and in-app purchase processing.

Resend: account verification, password reset, deletion confirmation and other necessary transactional email.

Beehiiv: newsletters where you subscribe.

Expo and Firebase: push-notification delivery and related app services.

Professional advisers and authorities: only where necessary to obtain advice, protect rights or comply with law.

We do not sell personal data or share it with third parties for their own advertising.

7. International transfers

Some processors or subprocessors may process data outside the United Kingdom. Where this happens, we use an adequacy decision, the UK Extension to the EU-US Data Privacy Framework, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard as applicable.

We record the actual processor location and safeguard in our Record of Processing Activities and processor evidence pack. We do not rely on a transfer mechanism merely because a supplier is based in the United States.

8. How long we keep data

Account and service data: while the account remains open, then during the 30-day account-deletion recovery period, followed by deletion unless a legal exception applies.

AI recommendation, decision and score history: current season plus two completed seasons, unless deleted earlier with the account.

Adult behavioural-profile data: current season plus two completed seasons, unless disabled, reset or deleted earlier.

Consent and request records: while the account is open and for up to 24 months afterwards where needed to demonstrate compliance.

Subscription and financial records: up to six years where required for tax or accounting.

Security logs: only for the period reasonably necessary for security, incident investigation and service operation.

Newsletter data: until you unsubscribe, subject to limited suppression records needed to honour the unsubscribe request.

9. Your rights

Depending on the circumstances, you can ask us to provide access to your data, correct inaccurate data, delete data, restrict processing, provide portable data, or consider an objection to processing based on legitimate interests.

Adults can object specifically to behavioural profiling. You can withdraw consent for analytics, marketing notifications or newsletters at any time without affecting earlier lawful processing.

You can use the in-app export and account-deletion functions or contact privacy@superscout.pro. We may need to verify your identity before completing a request.

10. Account deletion

You can request deletion in the app. We apply a 30-day recovery period. During that period, you can cancel the deletion request or request an export. At the end of the period, account data is deleted or de-identified in accordance with the retention schedule.

Deleting a SuperScout account does not automatically cancel an Apple or Google subscription. Subscriptions must be cancelled through the relevant app-store account.

11. Security

We use access controls, encryption in transit, database row-level security, controlled privileged operations, data minimisation, testing, logging restrictions and supplier safeguards. No system can be guaranteed completely secure. Please contact privacy@superscout.pro if you believe your account or data has been compromised.

12. Young users

We aim to explain our use of data in language young people can understand. Our separate Privacy Notice for Young Users summarises the most important information. A young user can contact us directly about their data rights.

13. Complaints

Please contact privacy@superscout.pro first so we can investigate. You can also complain to the UK Information Commissioner's Office at ico.org.uk.

14. Changes to this policy

We may update this policy when the service, law or suppliers change. We will provide appropriate notice of material changes. The version and date at the top show when this policy was last revised.