FANTAPREDIO

Privacy Policy & Information Notice

Last updated: 11 September 2026

This is the information notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 (Privacy Code), and also serves as the privacy policy of the game fantapredio (app and site).

Last updated: 11 September 2026.

1. Data controller

The controller is Matteo Vanzini, Via Carso 63, 41013 Castelfranco Emilia (MO), Italy.

Privacy contact: support@fantapredio.com.

Data Protection Officer (DPO): none has been appointed, as the conditions for mandatory appointment (Art. 37 GDPR) are not met.

2. What data we process

Account data. Email address; password (stored encrypted only, never in clear text); username and team name, if you set them. Each account has an internal identifier (PUID).

Sign in with Apple or Google. If you sign in with Apple or Google, we receive an identifier from the provider and, depending on your settings with the provider, your email address, solely to create and recognise your account. We neither receive nor store the provider password.

Gameplay data. Level, experience, credits, card collection, line-ups, scores, predictions, missions, achievements, emblems, avatar and profile colour.

Push notifications. If you enable them, we process a device token (via Firebase Cloud Messaging) to send you in-game alerts.

Technical and security data. Registration date, access timestamps, temporary email-verification and password-reset codes, and the technical data needed to run and protect the service.

Policy consent. We record the date and version of the Terms and this notice accepted at sign-up, as proof of consent.

On the showcase site. This site uses demo cards with fictional names and exposes no real persons’ data. The names and faces of real players live inside the app and are processed as described in section 3.

3. Names and images of real people

The app shows names and faces of identifiable real people (the team’s players). Their processing and the use of their image rely on written, freely revocable consents (Art. 10 Italian Civil Code; Arts. 96-97 Law 633/1941; GDPR). On withdrawal, the image is removed without undue delay.

Purpose Legal basis (Art. 6 GDPR)
Create and manage your account and let you play Performance of a contract (6.1.b)
Verify your email and recover access Performance of a contract (6.1.b)
Send you push notifications Consent (6.1.a), withdrawable anytime
Security, abuse and fraud prevention, technical continuity Legitimate interest (6.1.f)
Use of real players’ names/images The data subject’s consent, revocable
Comply with legal obligations Legal obligation (6.1.c)

5. Whether providing data is required

Providing account data (chiefly the email) is necessary to create the account and use the service: without it we cannot provide the game. Providing the notification token is optional and does not affect use of the service.

6. Automated decision-making and profiling

We carry out no automated decision-making producing legal or similarly significant effects on data subjects (Art. 22 GDPR), and no advertising profiling.

7. Who we share data with

We do not sell your data. We use providers that process data on our behalf, appointed as processors under Art. 28 GDPR, including:

  • Railway — application and database hosting;
  • Tigris — file storage (object storage);
  • Mailtrap — sending service emails;
  • Google / Firebase — push notifications and Google sign-in;
  • Apple — sign in with Apple.

8. Transfers outside the European Economic Area

Account and gameplay data are hosted in the European Union: the application hosting, the database and file storage (Railway and Tigris) are located in EU West (Amsterdam, Netherlands). Some ancillary services may instead involve processing in the United States — push notifications and Google sign-in (Google/Firebase), Sign in with Apple, and email delivery — covered by the appropriate safeguards of Arts. 44-49 GDPR, in particular the European Commission’s Standard Contractual Clauses, of which you may request a copy at support@fantapredio.com.

9. How long we keep data

We keep account and gameplay data for as long as the account is active. Unclaimed rewards expire within a few days. Temporary codes are short-lived. On account deletion, data is erased or anonymised, except where the law requires retention.

10. Your rights

You may exercise at any time the rights under Arts. 15-22 GDPR: access, rectification, erasure, restriction, portability, objection and withdrawal of consent (without affecting processing already carried out). Write to support@fantapredio.com; we will reply within the legal deadlines (usually one month).

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante, www.garanteprivacy.it) or the supervisory authority of your country of residence.

11. Minors

The service is intended for users aged 14 or over, the age set in Italy for consent to information-society services (Art. 2-quinquies of Decree 196/2003, implementing Art. 8 GDPR). For under-14s, processing is lawful only with the consent of the holder of parental responsibility. We do not knowingly collect data of under-14s without such consent; if we become aware of it, we delete it.

12. Changes to this notice

We may update this notice. For material changes we will give notice and update the date at the top; the version accepted at sign-up remains recorded.