1. Who We Are
11.football ("we", "us", "our") is a football lineup builder and football tools directory operated by Popsall Ltd, a company registered in England and Wales (Company No. 16953262), registered office 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE.
For any privacy-related questions, contact us at: privacy@11.football
2. Data We Collect
We collect the following personal data:
- Account Information: Email address, username (when you sign up)
- Authentication Data: Google ID (if using Google Sign-In)
- User Content: Lineups you save
- Payment Information: Payment status (processed by Stripe — we don't store card details)
- Technical Data: Push notification subscriptions, browser user agent
- Security Data: IP addresses (used temporarily for rate limiting)
- Referrer Data: We record which websites refer visitors to shared pages (domain name only, aggregated by day). No individual user data is collected.
- Tools directory suggestions and corrections: The link you send, the change you suggest, and your email address if you give one (so we can tell you the outcome). We keep a daily-changing scrambled form of your IP address to stop abuse; it can't be used to identify you.
- Listing claims: If you manage a product listed in the directory and claim its listing, we keep your work email address, use it to confirm the claim, and email you when the listing changes. Logos and screenshots you upload are published on the listing.
- Clicks to listed tools: We count clicks on “Visit” buttons per tool, page and day. No cookies are used and nothing about you is stored.
3. How We Use Your Data
We use your data to:
- Provide and maintain our service
- Send push notifications about match results (if enabled)
- Process payments for Pro subscriptions
- Communicate with you about your account
- Check and apply corrections to the tools directory, and tell you the outcome
- Confirm and manage listing claims, and tell vendors when their listing changes
Legal Basis (GDPR): We process your data under the following legal bases: contract performance for account services, payments, and transactional emails; consent for push notifications; and legitimate interest for security measures, aggregate traffic analysis, and keeping directory listings accurate (handling corrections and listing claims). Correction emails are kept with the correction so we can contact you if its source changes; ask us and we'll delete them.
4. Third-Party Services
We share data with the following service providers:
- Cloudflare: Hosting, database, and CDN services
- Cloudflare Turnstile: Bot protection on forms
- Google: Authentication via Google Sign-In
- Stripe: Payment processing for Pro subscriptions
- Forward Email: Sending magic link and transactional emails
- Google Web Risk: Safety checks on links sent to the tools directory (the link only)
- Anthropic: Reads the public web pages linked in directory suggestions and corrections to check the facts (no personal data is sent)
Each provider operates under their own privacy policy and data protection agreements.
5. Data Retention
We retain your data for as long as your account is active. You can request deletion of your account and associated data at any time through your account settings or by contacting us.
- Magic link tokens: Deleted after 24 hours
- Security data (rate limits): Deleted within 1 hour
- Push subscriptions: Deleted when you unsubscribe or revoke browser permission
- Payment processing records: Deleted after 30 days
- Aggregate analytics data: Retained for up to 13 months
- Account data: Deleted upon account deletion request
- Shared lineups: Remain accessible in anonymised form after account deletion, as they may have been shared with others via URL
6. Your Rights
Under GDPR, UK GDPR, and CCPA, you have the right to:
- Access: Request a copy of your personal data
- Rectification: Correct inaccurate data (e.g., change your username)
- Erasure: Delete your account and all associated data
- Data Portability: Export your data in a machine-readable format
- Object: Object to processing of your data
- Withdraw Consent: Unsubscribe from push notifications at any time
To exercise these rights, visit your account settings or email privacy@11.football.
7. Cookies and Local Storage
We use essential cookies for authentication and local storage to remember your preferences (such as recent teams and draft data). Google Sign-In sets functional cookies during the authentication process. We do not use tracking or advertising cookies.
8. International Transfers
Transfers to third-party providers outside the UK are protected by Standard Contractual Clauses or the EU-US Data Privacy Framework.
9. Data Security
We implement appropriate security measures including:
- HTTPS encryption for all data in transit
- Secure session tokens with HttpOnly cookies
- No storage of payment card details (handled by Stripe)
- Rate limiting to prevent abuse
10. Children's Privacy
Our service is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.
11. California Privacy Rights
We do not sell or share your personal information. California residents may exercise their data rights through account settings or by emailing privacy@11.football.
12. Changes to This Policy
We may update this privacy policy from time to time. We will notify you of significant changes by posting a notice on our website or sending you an email.
13. Contact & Complaints
For privacy questions or to exercise your rights, contact: privacy@11.football
If you're not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK, CNIL in France).