Privacy Notice

1. Who is responsible for your information

Xylos Digital Inc., a Delaware corporation with its registered office at c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US, operates the FPL Kitty platform and is the controller of the personal information described in this notice. Contact us about privacy at [email protected].

This notice explains what we collect, why, who we share it with, and the choices and rights you have. It applies to the FPL Kitty websites, applications and related services.

2. Information we collect

You give us:

• Account information — name, email address, password (stored in hashed form by our authentication provider), profile photo, and organiser/manager type.
• FPL information — your FPL team or manager ID, and the publicly available team, squad, points and league data associated with it, which we retrieve from the official FPL game to run scoring and standings.
• Competition information — competition names, branding, descriptions, rules, entry-fee amounts, declared prize structures, membership lists and standings you create or join.
• Payment-record information — proof-of-payment images or references an Organiser or Participant uploads so an Organiser can record that an entry fee was paid, and bank or payout account details a user enters so an Organiser can record a prize payout. We store these as records only; we do not make, receive, verify financially, or settle those payments.
• Communications — support requests, waitlist submissions, survey answers and other messages.

We collect automatically:

• Usage and device data — pages viewed, actions taken, referring pages, browser and device type, IP address, approximate location derived from IP, timestamps, and error/diagnostic logs.
• Cookies and similar technologies — see section 6.

We receive from third parties:

• Payment confirmations and references from our payment processors when you pay Xylos for its own services (see section 4). We do not receive or store your full card number.
• Public FPL data from the official FPL game, keyed to the team ID you provide.
• Referral attribution data when you arrive through another organiser's referral link.

We do not intentionally collect special-category data (such as health, biometric, religious or political data), and you should not submit it.

3. Why we use your information, and our legal bases

4. Payments — what we do and do not see

When you pay Xylos for its own services (subscriptions, platform fees, organiser royalties), the payment is processed by a third-party payment processor — currently Korapay for users in Africa, and, as we expand to other regions, Stripe. They collect your payment details directly and act as controllers of that data under their own privacy policies. We receive transaction metadata such as a reference, amount, currency, status and, where provided, the card's last digits and type.

We do not process entry fees or prizes between Organisers and Participants, so we do not receive payment-card or bank-authentication data for those transactions. Where our software holds a proof-of-payment image or a payout account number, it is because a user uploaded or entered it so an Organiser could keep a record.

5. Who we share information with

• Service providers (processors) who help us run the Service, under contract and confidentiality obligations: cloud hosting and application hosting, database, authentication and file storage, transactional email delivery, analytics, and payment processing.
• Other users, where the Service is designed to show it — for example, your display name, profile photo, FPL team name and standings are visible to other members of a competition you join; an Organiser can see the membership, entry-status and payment-record information for their own competition. Organisers act as independent controllers of the Participant information they collect and are responsible for how they use it.
• Professional advisers, auditors and insurers, where necessary.
• Authorities, regulators or third parties where we are required by law, or where necessary to investigate fraud or abuse, or to establish, exercise or defend legal claims.
• A buyer or successor, in connection with a merger, reorganisation, financing, or sale of all or substantially all of our assets or of the FPL Kitty business, including transfer to a group company established to operate the Service in a particular market. Information transferred stays subject to a privacy notice consistent with this one, and we will give notice where required.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

6. Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your tenant and preferences, keep the Service secure, and understand how it is used. We use Google Analytics 4 for usage measurement. You can control cookies through your browser and, where required by law, through the cookie choices we present; blocking some cookies will break parts of the Service.

7. International transfers

Xylos is based in the United States and our service providers operate in the United States and other countries. Your information will therefore be transferred to and processed outside your country, including in the United States. Our primary hosting region is the United States (AWS us-east-1 / Supabase). Where personal information is transferred from the European Economic Area, the United Kingdom, Nigeria or another country with transfer restrictions, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), together with additional measures where needed. Where personal information is collected from users in Nigeria, Xylos complies with the Nigeria Data Protection Act (NDPA) and applicable NDPC guidelines alongside these international transfer safeguards. You can ask us for details at [email protected].

8. How long we keep information

We keep personal information for as long as your account is active and for as long as needed for the purposes described here. After that we keep:

• Financial and transaction records for as long as required by tax, accounting and audit law;
• Competition results, standings and audit logs for as long as needed to evidence past competitions, resolve disputes and maintain the integrity of our records; and
• Security and fraud-prevention logs for a limited period.

When information is no longer needed we delete it or irreversibly anonymise it. Specific retention periods are set out in our internal retention schedule.

9. Your rights and choices

Depending on where you live, you may have the right to: access a copy of your information; correct inaccurate information; delete information; object to or restrict certain processing; withdraw consent; receive your information in a portable format; opt out of marketing; and not be subject to a decision based solely on automated processing with legal or similarly significant effects (we do not make such decisions).

If you are in the EEA or UK, you may also complain to your local data protection authority. If you are in Nigeria, you may contact the Nigeria Data Protection Commission. If you are a California resident, you may exercise access, deletion, correction and “do not sell or share” rights and will not be discriminated against for doing so.

To exercise a right, contact [email protected]. We will verify your identity and respond within the time allowed by applicable law. You can also update most account information directly in the Service. Note that some information cannot be deleted while it is needed for a live competition, to keep financial records, or to defend legal claims.

If your information was given to us by an Organiser as part of their competition, that Organiser is responsible for their own use of it; contact them directly, or contact us and we will help route your request.

10. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, hashed credentials, access controls, role separation between public and privileged data access, signed webhooks for payment events, and audit logging of privileged actions. No system is completely secure, and we cannot guarantee absolute security. If a breach affects your information and the law requires it, we will notify you and the relevant regulator.

11. Children

The Service is not intended for anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has provided information to us, contact [email protected] and we will delete it.

12. Changes to this notice

We may update this notice. If the change is material we will take reasonable steps to notify you, for example by in-product notice, email, or by posting the updated notice with a new effective date.

13. Contact

Privacy questions and requests: [email protected]. Postal: Xylos Digital Inc., c/o Legalinc Corporate Services Inc., 131 Continental Dr, Suite 305, Newark, DE 19713, US.