WCWins — Privacy Policy
Last updated: 13 October 2026.
1. Who is responsible for your data
The data controller is ACHIM GABRIEL-DAN PFA, Bucharest, Sector 3, Romania, CUI 47379440, Trade Register F40/6633/2022, operator of wcwins.com ("WCWins", "we"). For any privacy question or request, write to gabriel.achim@wcwins.com.
2. What data we collect
- Account data: email address, username, login method (email/password or third-party sign-in) and account identifiers. Passwords are stored only in hashed form by our authentication provider.
- Profile data: avatar, badges and the settings you choose.
- Game activity: your picks, Fantastic 7 lineups, leagues, leaderboard positions and Virtual Points history (WINS and Credits).
- Content you submit: league names, Fan Zone posts and messages you send to us.
- Winsy conversations: the messages you send to the AI assistant and its replies. Conversations and replies are stored in Supabase with a 30-day expiry timestamp. They are deleted automatically by the daily cleanup after their expiry.
- Technical data: IP address, browser and device information, and server logs needed to run and secure the Service.
- Cookies: essential cookies that keep you signed in and keep the Service secure. No analytics or advertising cookies are configured in the audited live Service.
We do not knowingly collect data from anyone under 18.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account; operating the game, scoring, leaderboards and leagues | Performance of our contract with you (Art. 6(1)(b)) |
| Answering your questions through Winsy and support | Performance of contract (Art. 6(1)(b)) |
| Keeping the Service secure, preventing fraud, multiple accounts and abuse | Legitimate interests (Art. 6(1)(f)) |
| Fixing bugs and improving the Service using aggregated or technical data | Legitimate interests (Art. 6(1)(f)) |
| Showing aggregated, anonymous statistics (for example total predictions made) | Legitimate interests (Art. 6(1)(f)) |
| Sending service messages (security, account, important changes) | Performance of contract (Art. 6(1)(b)) |
| Marketing emails, if we ever send them | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Keeping records required by law | Legal obligation (Art. 6(1)(c)) |
We do not sell your personal data and we do not use it for advertising.
4. Who processes data on our behalf
We use the following service providers to run WCWins. The AI provider's separate logging and improvement uses are described below:
- Supabase — database and authentication. The project is hosted in the European Union, in Ireland (eu-west-1).
- Vercel — website hosting and server logs.
- Cloudflare — DNS and network security.
- Google — email (Google Workspace). Sign-in currently uses email and password only; Google and other third-party sign-in methods are disabled.
- OpenRouter (Winsy) — the messages you send to Winsy and its replies are processed through OpenRouter using the NVIDIA Nemotron model (nvidia/nemotron-3-ultra-550b-a55b:free). No fallback AI model is currently configured. NVIDIA's free-endpoint terms permit logging for security, fraud and abuse monitoring, and use of inputs and outputs to improve its products and services, including AI models. We cannot promise that messages will not be retained or used for model improvement/training. Do not share personal, sensitive or confidential information with Winsy. See the free-endpoint disclosure and NVIDIA API Trial Terms. Our WCWins conversation-retention period does not set OpenRouter's or NVIDIA's retention periods.
Our football data provider (API-Football) receives no personal data from us.
Some providers are based in or access data from outside the European Economic Area, mainly the United States. In those cases transfers are protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework, as applicable.
5. How long we keep it
- Account and game data: while your account is active. To delete your account, email gabriel.achim@wcwins.com from the address linked to your account. We verify the request and, within 30 days, delete or anonymize your personal data. Game history may be kept in anonymized form so leaderboards stay consistent.
- Virtual Points and game history: may be kept in anonymized form so leaderboards and game records stay consistent.
- Winsy conversations: Winsy conversations are kept for 30 days and then deleted automatically. Deletion takes place in the daily cleanup after their expiry, normally within a further 24 hours. This applies to the conversations and replies stored by WCWins, not to separate retention by OpenRouter or NVIDIA.
- Technical logs: for a limited period, normally no longer than our hosting providers' standard log retention.
- Data we must keep by law: for the period the law requires.
6. Your rights
Under the GDPR you have the right to: access your data; correct it; delete it; restrict or object to its processing; receive it in a portable format; and withdraw consent at any time where processing is based on consent.
To exercise these rights, email gabriel.achim@wcwins.com from the address linked to your account. We reply within one month.
You also have the right to complain to the Romanian data protection authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, Bucharest, www.dataprotection.ro.
7. Automated decisions
Scoring, settlement and leaderboards are calculated automatically from game rules. They have no legal or similarly significant effect on you, because Virtual Points have no monetary value. Winsy's replies are automated suggestions only and never decide anything about your account.
8. Security
We use access controls, encryption in transit, role-restricted database functions and server-side permission checks to protect your data. No system is completely secure. If a breach affects your data, we will act as the law requires.
9. Changes to this policy
We may update this policy. We will publish the new version with its date and, for material changes, notify you in the Service or by email.
10. Contact
ACHIM GABRIEL-DAN PFA · CUI 47379440 · F40/6633/2022 · Bucharest, Sector 3, Romania · gabriel.achim@wcwins.com