Privacy policy
Draft, last updated [DATE]. Not yet reviewed by a lawyer.
This policy explains what personal data FUT AutoLister collects, why, and what your rights are.
Who we are
The data controller is [PFA LEGAL NAME], a sole trader (PFA) registered in Romania under no. [REGISTRATION NUMBER], tax ID [CUI], address [REGISTERED ADDRESS]. Contact: support@futautolister.com.
What we collect
Your account
- Your email address, and the sign-in codes we send to it, which are stored only as a hash and expire after 10 minutes.
- If you use Sign in with Google: your email address and Google account ID. We don’t get your Google password or contacts.
- Your signed-in browsers: when each signed in and was last used. We don’t collect your browsing history.
Your subscription
- Your plan, number of slots, renewal date and payment status, which Stripe sends us.
- We never see or store your card details. Stripe handles them.
Your EA accounts
The extension reads these from the Web App’s own responses while it runs. It never makes extra requests to EA to collect them.
- Your EA persona ID and name, club name and abbreviation, platform and similar club details, used to link each EA account to your slot.
- We never collect your EA password, EA email, login tokens or cookies, coin balance, squads or a full list of your club.
How the extension runs
- Run events: when a run starts and ends, which player was being sold (name and rating), how many cards were listed, re-listed, sold or cleared, and error and recovery categories.
- Market data used for pricing: the searches the extension makes and the prices and counts it sees, sent to our server to calculate your listing prices.
- Extension version and basic technical details for fixing problems.
When you contact us
- Your emails to support and our replies.
The website
- futautolister.com uses Cloudflare Web Analytics, which counts visits without cookies and without tracking you across sites. We don’t use advertising or tracking cookies. The account page uses one cookie to keep you signed in. If you press the €/$ switch next to our prices, one cookie remembers that choice. We show prices in euros or dollars based on the country your IP address is in, without storing it.
Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running your account, slots, trial and subscription | Contract (Art. 6(1)(b)) |
| Calculating listing prices on our server | Contract |
| Sending sign-in codes and service emails | Contract |
| Preventing abuse: trial reuse, account sharing beyond the limits, attacks on our server | Legitimate interests (Art. 6(1)(f)) |
| Fixing bugs and improving reliability from run events | Legitimate interests |
| Keeping invoices and payment records | Legal obligation (Art. 6(1)(c)) |
We don’t sell your data, use it for advertising or make automated decisions about you that have legal effects.
Who we share it with
We use these providers to run the Service. Each processes data only on our instructions or as an independent controller where stated:
- Cloudflare, Inc. hosts our server, database and website. Cloudflare also processes your IP address as part of hosting.
- Stripe handles payments. Stripe is the merchant of record for your purchase and acts as an independent controller for payment data. See Stripe’s privacy policy.
- [EMAIL SENDER, e.g. Resend] sends sign-in codes.
- [SUPPORT MAILBOX PROVIDER, e.g. Zoho] hosts our support inbox.
- Google handles the optional Sign in with Google.
Some of these providers are based in the United States. Transfers are covered by the EU-US Data Privacy Framework or the EU’s Standard Contractual Clauses.
We may also share data if the law requires it.
How long we keep it
- Account, slot and subscription records: while your account exists, then [30 days] after you delete it.
- Run events: detailed events for [30 days], then only daily totals without personal details. [Alex to confirm: the plan says 14 to 30 days.]
- Market data used for pricing: [30 days].
- Sign-in and setup codes: until used or expired, at most 30 minutes.
- Payment and invoice records: as long as Romanian tax law requires, currently up to 10 years. Stripe keeps these.
- Support emails: [2 years] after the conversation ends.
- IP addresses for abuse limits: briefly in memory; only a hash is stored, for at most 2 days.
Your rights
You can ask to access, correct, delete or export your data, to restrict how we use it, or object to processing based on legitimate interests. Email support@futautolister.com from your account email; we reply within one month.
To delete your account, cancel your subscription and email us. We delete your data within 30 days, except what the law requires us to keep.
If you’re unhappy with how we handle your data, you can complain to the Romanian data protection authority, ANSPDCP (www.dataprotection.ro), or the authority in your own country.
Security
Data is sent over HTTPS. Sign-in and setup codes are stored only as hashes. Session cookies can’t be read by page scripts. Access to the database is limited to us.
Children
FUT AutoLister is not meant for anyone under 18, and we don’t knowingly collect their data.
Changes
If we change this policy in a way that matters, we’ll tell you by email or in the extension before the change applies.