Privacy Policy

1. Who We Are

UCL Fantasy Tools operates the website uclfantasy.com. We are based in the United Kingdom and committed to protecting your privacy in accordance with UK GDPR and the Data Protection Act 2018.

Data controller contact: uclfantasysite@gmail.com

2. What Data We Collect

3. How We Use Your Data

• Service delivery: Providing your subscription, delivering content, processing payments
• Communication: Sending subscription confirmations, service updates, and (with consent) marketing emails
• Improvement: Understanding how our tools are used to make them better
• Legal compliance: Meeting our obligations under UK law

4. Legal Basis for Processing

• Contract: Processing necessary to deliver your subscription (Article 6(1)(b) UK GDPR)
• Consent: Marketing communications — you can withdraw at any time
• Legitimate interest: Analytics and service improvement (Article 6(1)(f) UK GDPR)

5. Third-Party Services

We use the following trusted services to operate:

• Supabase (EU servers) — Authentication and database
• Stripe — Payment processing. Stripe is PCI DSS Level 1 certified. See Stripe's privacy policy
• Netlify — Website hosting and server-side analytics (cookie-free)
• Anthropic (Claude AI) — Powers "Ask The Savant" responses. Questions are processed but not stored by Anthropic for training

We do not sell your data to anyone. Ever.

6. Data Retention

• Active accounts: Data retained while your account is active
• Cancelled accounts: Data deleted within 90 days of cancellation, except where required by law (e.g., financial records retained for 6 years)
• AI questions: Stored for 12 months, then automatically deleted

7. Your Rights

Under UK GDPR, you have the right to:

• Access — Request a copy of all data we hold about you
• Rectification — Correct any inaccurate data
• Erasure — Request deletion of your data ("right to be forgotten")
• Portability — Receive your data in a machine-readable format
• Object — Object to processing based on legitimate interest
• Withdraw consent — For marketing communications, at any time

To exercise any of these rights, email uclfantasysite@gmail.com. We will respond within 30 days.

8. Cookies

We use minimal cookies:

• Authentication cookies — Essential for keeping you logged in (strictly necessary, no consent required)
• Theme preference — Remembers your light/dark mode choice (localStorage, not a cookie)

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. Netlify Analytics is fully server-side and cookie-free.

9. Security

• All data transmitted over HTTPS (TLS 1.3)
• Passwords hashed using bcrypt (via Supabase Auth)
• Row-Level Security enforced at the database level — users can only access their own data
• Payment data handled exclusively by Stripe (PCI DSS Level 1)
• Regular security reviews of our infrastructure

10. International Transfers

Your data may be processed by our third-party providers outside the UK. All providers listed above maintain adequate safeguards (Standard Contractual Clauses or equivalent) in compliance with UK GDPR.

11. Children

Our services are not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with data, please contact us immediately.

12. Changes

We may update this policy from time to time. Material changes will be communicated to subscribers via email. The "last updated" date at the top of this page will always reflect the latest version.

13. Contact & Complaints

For privacy queries: uclfantasysite@gmail.com

If you're not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.