Privacy Policy

Football Lord
Effective date: 16 October 2026 · Last updated: 27 October 2026

This Privacy Policy explains what personal data we collect when you use the Football Lord mobile application, the website footballlord.com and related services (the "Service"), why we collect it, who we share it with, and the rights you have.

1. Who is responsible for your data

The data controller is Football Lord LLC, Wyoming, USA ("we", "us").
Contact for privacy matters: [email protected]

We process personal data in line with the Turkish Personal Data Protection Law No. 6698 ("KVKK"), the EU General Data Protection Regulation ("GDPR") where it applies, and other applicable laws.

2. The data we collect

2.1 Data you give us

Data	Examples	When
Account data	Unique user ID; name and email address shared by Google or Apple when you sign in (Apple may provide a private relay email)	When you sign in
Profile data	Manager name, profile picture, country (initially derived from your IP address when you sign in; you can change it), favourite team	When you create or edit your profile
Game data	Team rentals, answers to side questions and quizzes, points, rankings, budget, Lord Coins, badges, club membership and role, club tournament line-ups	When you play
User content	Club chat and match chat messages, club name and description, reports you submit and appeals	When you use these features
Support data	Your messages and the information you give us	When you contact us
Purchase data	The product you bought, subscription status (Lord Pass), transaction ID and time; card details never reach us	When you make an in-app purchase
Prize delivery data	If you win a real-world or sponsored prize, the contact details needed for delivery (e.g. email, name, address)	Only when you win and want to receive the prize
Communication preferences	Whether and when you gave or withdrew consent to marketing messages	When you give or change consent

2.2 Data collected automatically

Data	Purpose
Device and app data: device model, operating system, app version, language, time zone	Showing the app in your language and time zone, compatibility, sending match-day updates at the right time
Push notification token	Sending notifications you have enabled (goals, cards, match start, club chat, rewards)
Crash and diagnostic data (Firebase Crashlytics)	Finding and fixing errors
Technical logs: IP address, request time and path	Security, abuse prevention, troubleshooting; deleted or anonymised after a short period
Advertising data: advertising ID (Android Advertising ID, Apple IDFA if you allow tracking), ad interactions, coarse location derived from IP	Showing and measuring ads, rewarded-ad verification, fraud prevention (see Section 5)
Rewarded ad records: time, ad type, verification result	Granting rewards, enforcing ad limits, preventing fraud

We do not collect your precise location, contacts, photos (other than a picture you choose for your profile), or payment card details. Payments, if offered, are processed entirely by Apple or Google.

3. Why we use your data and our legal bases

Purpose	Legal basis (GDPR / KVKK)
Creating and running your account, providing the game, rankings, clubs and chats	Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
Push notifications	Your consent via the device permission; you can turn them off at any time
Validating in-app purchases and subscriptions, delivering prizes	Performance of a contract (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c))
Sending marketing messages	Your separate, optional consent (GDPR Art. 6(1)(a); Turkish Law No. 6563); you can withdraw it at any time
Security, preventing cheating, abuse and fraud, moderating chats, enforcing our Terms	Legitimate interests (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f))
Crash reporting and improving the Service	Legitimate interests
Personalised advertising and tracking	Consent (GDPR Art. 6(1)(a); KVKK Art. 5(1)); asked through the consent form and, on iOS, Apple's App Tracking Transparency prompt
Non-personalised ads and rewarded-ad verification	Legitimate interests / performance of a contract
Complying with legal obligations and responding to authorities	Legal obligation (GDPR Art. 6(1)(c); KVKK Art. 5(2)(a), (ç))
Establishing, exercising or defending legal claims	Legitimate interests (KVKK Art. 5(2)(e))

4. Who we share data with

We do not sell your personal data. We share it only with:

Recipient	Role	Data
Google LLC / Google Ireland Ltd (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Messaging, Crashlytics, Cloud Vision)	Processor: sign-in, storage, notifications, crash reporting; checking an uploaded profile photo for inappropriate content (nudity, violence)	Account ID, profile picture, tokens, diagnostics
Apple Inc.	Sign in with Apple, App Store payments	Sign-in data
RevenueCat, Inc. (USA)	Processor: validating in-app purchases and subscriptions	User ID, purchase and subscription records
Sponsor (sponsored prizes only)	Delivering a sponsored gift you won	Only the contact details needed for delivery, after telling you
Google (AdMob) and its mediation partners, including Unity Technologies (Unity Ads)	Independent advertising providers	Advertising ID, device and ad interaction data, IP address
Google Translate	Translating chat messages when you or another user taps "translate"	The message text only
netcup GmbH (Germany)	Server and database hosting	All data stored on our servers
Cloudflare, Inc.	Network security and content delivery	IP address, technical request data
Other users	Your manager name, profile picture, country, club, rankings, badges and chat messages are visible to other users; club members can also see whether you are online in the app	Public profile and content
Authorities, courts, advisers	When required by law or to protect rights and safety	As required
A successor	In a merger, acquisition or sale of assets, under this Policy	As needed

Sports data providers and our AI services used to create news content do not receive your personal data.

5. Advertising and consent

5.1. The app shows ads through Google AdMob, which can use mediation partners such as Unity Ads.

5.2. In the EEA, the UK and Switzerland, a consent form (Google User Messaging Platform) is shown before personalised ads are used. You can change your choice at any time in the app's settings, where available, or by reinstalling the app.

5.3. On iOS, we ask for permission through Apple's App Tracking Transparency prompt. If you decline, your IDFA is not shared and ads are not personalised using it.

5.4. On Android, you can reset or delete your advertising ID under Settings → Privacy → Ads (or Google → Ads).

5.5. Rewarded ads are optional. When you watch one, the ad network sends our server a signed confirmation containing your user ID and a one-time code, so we can grant the reward and prevent fraud.

Learn more: How Google uses data · Unity Privacy Policy

6. Marketing messages

6.1. We send emails or similar commercial electronic messages about campaigns, events and news only if you separately and optionally agree. This consent is not a condition of using the Service, and the box is never pre-ticked.

6.2. You can withdraw your consent at any time, free of charge, in the app under Settings or through the unsubscribe link in every message. For recipients in Turkey, commercial electronic messages are managed through the Message Management System (İYS) under Law No. 6563.

6.3. Game and service notifications (e.g. rewards, clubs, matches, account and security information) are not marketing; you can manage them in your device's notification settings.

7. International transfers

Our servers are in Germany (EU). Some providers (for example Google, Apple, Cloudflare and Unity) may process data in the United States or other countries. For transfers outside the EEA we rely on adequacy decisions (including the EU–US Data Privacy Framework where the provider is certified) or Standard Contractual Clauses. For transfers outside Türkiye we act in line with Article 9 of KVKK, including standard contracts notified to the Personal Data Protection Authority where required.

8. How long we keep data

Data	Retention
Account, profile and game data	While your account exists; deleted within 30 days of account deletion
Uploaded profile photos	Up to your last 4 approved photos in your gallery until you delete them or your account; rejected photos 30 days for review and appeal. Location and device data (EXIF) are removed on upload
Chat messages	While your account exists, or until deleted by you, a club manager or moderation; deleted or anonymised when you delete your account
Moderation, ban and report records	Up to 2 years after the decision, to prevent repeated abuse
Rewarded-ad and purchase records	Up to 2 years, or longer where tax or commercial law requires
Account-linking records (copy of the closed account when two sign-in methods are merged into one account)	365 days, for disputes and abuse prevention
Prize delivery data	Up to 1 year after delivery, or as required by law
Marketing consent records	3 years after consent is withdrawn (proof of consent)
Technical server logs	Up to 90 days
Crash reports	Up to 90 days (Firebase Crashlytics default)
Backups	Overwritten on a rolling basis within 30 days

9. Your rights

Depending on where you live, you have the right to:

access the personal data we hold about you and get a copy;
correct inaccurate data (most profile data can be edited in the app);
delete your data ("right to be forgotten");
restrict or object to processing based on legitimate interests;
data portability;
withdraw consent at any time (this does not affect processing that already took place);
not be subject to decisions based solely on automated processing that significantly affect you;
under KVKK Article 11: learn whether your data is processed, learn the purpose and whether it is used for that purpose, know the third parties it is transferred to, request correction or deletion and notification of this to third parties, object to results arising from automated analysis, and claim compensation for damages caused by unlawful processing.

How to exercise your rights: email [email protected] from the email linked to your account, or include your manager name and the email address you sign in with. We will reply within 30 days. Requests under KVKK can also be made as described in the Communiqué on the Procedures and Principles of Application to the Data Controller.

Complaints: you can lodge a complaint with the Turkish Personal Data Protection Authority (KVKK — kvkk.gov.tr) or, in the EEA, with your local data protection authority.

Additional rights depending on where you live

This Policy applies worldwide; where local law gives you additional rights, those rights apply too:

Turkey: your rights under Article 11 of the KVKK (above).
European Economic Area, United Kingdom and Switzerland: your rights under the GDPR and UK GDPR (above), and the right to complain to your local data protection authority.
Brazil: your rights under the LGPD (access, correction, anonymisation, portability, deletion, withdrawal of consent) and the right to complain to the ANPD.
United States: we do not sell your personal data. You can turn off ad personalisation in your device's ad settings. If your state's privacy law gives you rights to access, correct or delete your data, write to [email protected].
Other countries: write to [email protected] to exercise the rights your local law gives you.

10. Deleting your account

You can delete your account in the app under Settings → Account → Delete account. This permanently deletes your account, profile, game progress, club memberships and Virtual Items. Some records may be kept for the periods in Section 8 where we are legally required or entitled to do so. You can also request deletion without the app: see footballlord.com/delete-account.

11. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from children under 13. Users below the age of digital consent in their country (up to 16 in some EU countries) need the consent of a parent or guardian. If you believe a child has given us personal data without the required consent, contact [email protected] and we will delete it.

12. Security

We use encryption in transit (HTTPS/TLS), access controls, authentication of every request, and restricted administrative access. No system is completely secure; if a data breach affects your rights, we will notify you and the competent authorities as required by law.

13. Changes to this Policy

We may update this Policy. The "Last updated" date shows the latest version. For material changes, we will notify you in the app before they take effect.

14. Contact

Football Lord LLC
Wyoming, USA
Privacy: [email protected]