Privacy notice
Last updated: 1 November 2026
Stats Squad is an unofficial tool for Fantasy Premier League managers. It is not affiliated with or endorsed by the Premier League or Fantasy Premier League. This notice explains what personal data we process, why, on what legal basis, who sees it, how long we keep it, and your rights under data protection law (the GDPR).
1. Who we are
Vineet Solabannavar is the controller of your personal data. Contact for anything in this notice, including exercising your rights: privacy@thestatssquad.com. We are a small service and have not appointed a data protection officer.
2. What we process, why, and on what basis
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, name (optional), the date you joined, and your agreement to be contacted | Running the waiting list, telling you when access opens, and showing that you agreed | Your consent (Art. 6(1)(a)). You can withdraw it at any time |
| Email address, a one-way scrambled form of your access code, when you last signed in, whether your access has ended | Giving you access, checking your code when you sign in, and ending access | Performing the service you asked for (Art. 6(1)(b)) |
| Your FPL team ID, your planner settings (horizon, chip choices and similar), and your squad, bank and free transfers as read from FPL's public service | Showing you forecasts, transfer plans and your team rating | Performing the service (Art. 6(1)(b)) |
| The plans and projections from your latest run, and when you last ran the planner and whether it worked | Showing your results, and limiting how often the planner can be run so the service stays available to everyone | Performing the service (Art. 6(1)(b)); legitimate interest in fair use (Art. 6(1)(f)) |
| Your IP address, linked to the email or sign-in it tried, for each sign-in attempt and waiting-list sign-up | Blocking password guessing and floods of sign-ups, and keeping the service secure | Legitimate interests (Art. 6(1)(f)) in security and preventing abuse. We weighed this against your rights and keep it for days, not months |
| A session cookie (see Cookies) | Keeping you signed in | Strictly necessary to provide the service you request |
Giving us your email address is required to join the waiting list or use the service; we cannot offer access without it. Your name is optional. We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not build profiles of you. We do not sell your data or use it for marketing. Your forecasts and plans are generated automatically by statistical and machine-learning models and an optimiser, using public Fantasy Premier League data. Nothing about you is used to train those models. Stats Squad is free while we launch to a small, invited group, and we will give you advance notice before that changes.
3. Where the data comes from
You give us your email, name, FPL team ID and settings. Your squad, bank and transfers come from the Fantasy Premier League service's public data for the team ID you give us. We never see your FPL password.
4. Who receives it
- Vineet Solabannavar, who runs the service and manages access.
- Our hosting provider, Contabo GmbH (Germany), which stores the data on servers we rent and sees IP addresses as any network provider does. It acts on our instructions as a processor under a data processing agreement.
- The Fantasy Premier League service (run by the Premier League) receives the requests our server makes to read public team data. Those requests contain the team ID and come from our server's address, not from you.
- If we send you a message or your access code by email, the email service we use to do that.
We do not share your data with anyone else, except where the law requires it.
5. Transfers outside your country
Your data is stored on servers operated by Contabo GmbH (Germany). We do not send your data to other countries ourselves. If either provider or an email service we use processes it outside the European Economic Area, we rely on the safeguards the law provides for such transfers (an adequacy decision or standard contractual clauses). Ask us for details.
6. How long we keep it
| Data | Kept for |
|---|---|
| Waiting-list entry | Until access opens for you, you ask to be removed, or 12 months pass, whichever is first. If you become a member, the entry (with your agreement record) is kept while you are a member |
| Member record, settings, squad, results | While you have access. After your access ends, or you ask, everything is erased within 30 days (the software does this automatically) |
| Plans and projections from your runs | Your latest run only; older ones are deleted each time you run the planner |
| Rating results, and the log of your last planner run | Held in the server's memory for up to an hour after they finish so you can read them, then dropped. They are not saved separately |
| Server logs | The web and application servers keep no access logs, and system logs that might contain an address are kept for 7 days at most |
| IP addresses on failed sign-in attempts and sign-ups | 7 days |
| A record that a place signed in successfully (so a later attack elsewhere cannot lock you out) | 30 days |
| Backups | We keep no separate backups. Our hosting provider may keep a snapshot of the server for recovery; deleted data leaves it when the snapshot is replaced |
7. Cookies
We set one cookie, a strictly necessary session cookie that keeps you signed in. It is not readable by scripts on the page, is sent only to this site, and lasts up to 14 days or until you sign out. Because it is strictly necessary we do not ask for consent for it. We use no advertising or analytics cookies or trackers.
8. Your rights
You have the right to:
- be told what we hold about you and get a copy (access);
- have wrong data corrected (rectification);
- have your data erased ("the right to be forgotten");
- limit how we use it, or object to our use based on legitimate interests;
- receive the data you gave us in a common, machine-readable format (portability);
- withdraw your consent at any time, without affecting what we did before you withdrew it.
Write to privacy@thestatssquad.com. We will answer within one month, free of charge, and may need to check it is you. Erasing a member also erases their waiting-list entry, sign-in records, planner settings, squad and results.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the supervisory authority: the Data Protection Commission (dataprotection.ie).
9. Security
Access codes are stored only in scrambled form, so we cannot read them back. The service is served over an encrypted connection, each member's data is kept in a folder only their account uses, and the database can be read only by the account that runs the service. Repeated wrong sign-ins are blocked. No system is perfectly secure: if a breach put your rights at risk we would tell you and the Data Protection Commission (dataprotection.ie) as the law requires.
10. Children
This service is not aimed at anyone under 16, and we do not knowingly collect their data. If you think a child has joined, write to us and we will remove them.
11. Changes
If we change this notice in a way that matters to you we will update the date above and, for members, tell you.