This Privacy Policy explains how ManageFC ("we", "us", "our") collects, uses and protects your personal data when you visit https://managefc.com or play our football management game. It is written to comply with the EU General Data Protection Regulation 2016/679 ("GDPR") and Portuguese Law 58/2019.

The data controller for the processing described in this policy is ManageFC, operating the service from Portugal. You can reach us at support@managefc.com for any privacy-related question or request.

We have not appointed a Data Protection Officer because our processing does not meet the mandatory thresholds in Article 37 GDPR. The team behind ManageFC is nonetheless committed to data-protection by design and by default, and any privacy concern is handled at first level by the operator behind support@managefc.com.

We collect the following categories of data:

• Account data: e-mail address, username, password hash (bcrypt), preferred currency and expense-period, country code, locale, profile avatar, and any OAuth identifier when you sign in via Google, GitHub or Discord (scoped to e-mail and basic profile).
• 2FA secrets: encrypted TOTP secret and one-time recovery codes if you enable Two-Factor Authentication.
• Gameplay data: club state, tactics, line-ups, save metadata, sim-date, match results, inbox messages, MFC Coin balance, cosmetic inventory, achievements and other progression we need to run the game.
• Device & connection data: IP address, user-agent string, language, time zone, screen size, approximate location derived from IP (country level), and basic device fingerprinting for fraud-prevention.
• Communications: support e-mails you send us, abuse reports, and bug reports.
• Payment metadata (future): when paid features are enabled, Stripe will process card details directly; we receive only an event identifier, the amount, currency, the last four digits of the card, the country, and the transaction status.

We process the data above for the following purposes:

• Creating and operating your account and your saves;
• Persisting gameplay state and synchronising it across sessions;
• Sending transactional e-mails (account verification, password reset, security alerts, billing receipts when applicable, important policy changes);
• Providing customer support and responding to your requests;
• Preventing fraud, abuse, multi-accounting, cheating and chargeback misuse;
• Producing aggregated, non-identifying analytics to understand how the game is played and to improve it;
• Serving advertising where the relevant consent has been given (see section 12);
• Complying with our legal obligations (taxation, accounting, lawful requests from authorities).

Under Article 6 GDPR our legal bases are:

• Performance of a contract (Art. 6(1)(b)): to create your account, run the game, and deliver paid features you have ordered;
• Legitimate interests (Art. 6(1)(f)): to secure the service against abuse and fraud, to keep aggregated analytics, to send service-related notifications, and to defend legal claims. You have the right to object to processing based on legitimate interests (section 8);
• Consent (Art. 6(1)(a)): for non-essential cookies, personalised advertising and any marketing e-mails. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal;
• Legal obligation (Art. 6(1)(c)): to retain billing records for tax purposes and to comply with mandatory disclosures to authorities.

We do not sell your personal data. We share it only with the processors and partners strictly necessary to operate the service. Each is bound by a data-processing agreement and processes data only on our instructions and for the purposes stated below:

• Contabo GmbH (Germany) — infrastructure hosting (servers, databases, backups). Privacy policy.
• Stripe Payments Europe Limited (Ireland) — payment processing when paid features are enabled. Privacy policy.
• Google Ireland Limited — Google Analytics 4 (measurement ID G-4KLH3GWF9Q) and Google AdSense (publisher ID ca-pub-9667931659050794). Privacy policy.
• Discord Inc. — OAuth sign-in and the official ManageFC Discord server. Privacy policy.
• Google Ireland Limited / GitHub Inc. — OAuth sign-in providers (limited to e-mail and basic profile).

We may also disclose personal data when required by law, by a valid court order, or to protect the rights, property or safety of ManageFC, our users or third parties.

Our primary hosting is located in the European Union (Germany). Some of our processors (Stripe, Google, Discord) may transfer personal data to the United States or other third countries. Where this is the case, we rely on the European Commission's Standard Contractual Clauses (2021/914) and, for U.S. recipients certified to it, on the EU–U.S. Data Privacy Framework.

We perform a transfer impact assessment for each processor and require them to apply supplementary technical and organisational measures (such as encryption at rest and in transit, pseudonymisation, and strict access controls) when needed.

We retain personal data only for as long as necessary to fulfil the purposes described in this policy:

• Account & gameplay data: for the lifetime of the account, plus up to 12 months after deletion to handle account-recovery requests and fraud reconciliation; permanently anonymised aggregates may be kept indefinitely;
• Transactional & billing logs: at least 5 years, in line with Portuguese tax law (Decreto-Lei 28/2019);
• Server access logs: typically 90 days, longer where a security incident is under investigation;
• Support correspondence: up to 3 years from the last contact;
• Cookies: per the retention shown in our Cookie Policy.

After the applicable retention period we either delete or irreversibly anonymise the data.

Under the GDPR you have the right to:

• Access the personal data we hold about you (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data, subject to legal-retention obligations (Art. 17);
• Restrict processing in certain situations (Art. 18);
• Data portability for data you have provided to us under contract or consent (Art. 20);
• Object to processing based on legitimate interests, including profiling for advertising (Art. 21);
• Withdraw consent at any time for processing based on consent (Art. 7(3));
• Not be subject to a decision based solely on automated processing producing legal or similarly significant effects (Art. 22); ManageFC does not currently take such decisions.

To exercise any of these rights write to support@managefc.com. We will reply within 30 days, extendable by two further months for complex requests (we will tell you within the first month if such extension is necessary). We may ask you to verify your identity before acting on a request.

ManageFC is not directed to children under 13. In the EU/EEA, the minimum age is 16unless local law (and, where relevant, parental consent) permits a lower age down to 13. Portugal's digital-consent age is 13 under Law 58/2019, but we apply 16 as a conservative default for EEA users.

We do not knowingly collect personal data from children under the applicable minimum age. If you are a parent or guardian and become aware that your child has provided us with personal data without proper consent, please contact support@managefc.com and we will delete the account and the associated data promptly.

We take security seriously and apply technical and organisational measures appropriate to the risk, including: TLS 1.2+ for all traffic to managefc.com; bcrypt password hashing; encrypted TOTP secrets; encrypted off-site database backups; firewalled servers; least-privilege access for staff; activity logging and anomaly detection; regular security reviews; and the option for users to enable Two-Factor Authentication on their account.

No system is completely secure. If we become aware of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and inform affected users without undue delay where the risk is high, in accordance with Articles 33 and 34 GDPR.

We use cookies and similar technologies to operate the service, remember your preferences, measure usage and (with your consent) serve advertising. A full list of the cookies we use, the legal basis for each category and how to manage them, is available in our Cookie Policy.

We use Google AdSense (publisher ID ca-pub-9667931659050794) to display advertising. Where required, these partners may use cookies and similar identifiers to serve personalised ads based on your prior visits to this and other websites. Personalised advertising is shown only after you have given consent through our cookie banner.

You can opt out of personalised advertising at any time:

• Google: Ad Settings;
• U.S. self-regulatory opt-outs: DAA and NAI;
• EU self-regulatory opt-out: EDAA Your Online Choices.

Opting out does not stop ads being shown; it stops them being personalised based on cross-site interest profiles.

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page indicates the latest revision. Material changes will be notified via the in-game inbox and by e-mail to the address associated with your account at least 14 days before they take effect, unless an earlier effective date is required by law.

If you believe that our processing of your personal data infringes the GDPR you have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of the alleged infringement. The lead authority for ManageFC is the Portuguese Comissão Nacional de Protecção de Dados (CNPD):

CNPD— Av. D. Carlos I, 134 — 1.º, 1200-651 Lisboa, Portugal — https://www.cnpd.pt/.

For any question, request or complaint relating to this Privacy Policy please write to support@managefc.com. We will respond promptly and at the latest within the 30-day GDPR deadline.