Privacy Policy

Who we are

My FPL Mini-League is operated by:

Common Room Ventures Private Limited CIN U32409KA2026PTC222161 301/302, 3rd Floor, Saket Callipolis, Sarjapur Main Rd, Doddakannelli, Bengaluru, Karnataka 560035, India [email protected]

Common Room Ventures Private Limited is the Data Fiduciary under India's Digital Personal Data Protection Act, 2023, and the Data Controller under the UK and EU General Data Protection Regulation, for the personal data described here.

My FPL Mini-League is the product. Common Room Ventures Private Limited is the company that runs it.

A note on version 1.0. Until this version, these documents named three individuals as the operator. The company was incorporated on 11 June 2026 and is now the operator. The previous policy is retained as a historical record.

1. Read this first if you have never signed up

You can appear on this Platform without ever having used it. This is unusual, so it is stated at the top rather than buried.

When someone sets up a mini-league here, we retrieve that league's roster from the official Fantasy Premier League API. That roster includes every member of the league (their display name, their team name, and their performance record) whether or not they have an account with us.

If the host publishes the league page, that information becomes publicly accessible on the internet.

You can have your name taken off it, without an account, without going through the host, and without giving a reason. Email [email protected], tell us the team name or the league page, and we will action it. Full detail: Public League Pages and Your Data.

The rest of this policy applies to you as much as to anyone with an account.

2. What this policy covers

Everything we do with personal data across myfplminileague.com, our public league pages, our emails, and our WhatsApp messages.

It does not cover the Fantasy Premier League website or app, WhatsApp itself, or any other service you reach from ours. Those have their own policies and their own relationship with you.

3. What we collect

3.1 Information you give us

3.2 Information from Fantasy Premier League

We retrieve the following from the official FPL API, which publishes it:

• League name, league administrator, member count

• For every member of an ingested league: FPL entry ID, entrant name, team name

• Gameweek and overall points, rank and rank movement, bench points, captain points, transfer counts and points hits

• Squad composition, chips played, transfers made

This includes people who have no account with us. See §1 and §6.

3.3 Information collected automatically

Cookies and device storage are covered in the Cookie Policy.

3.4 Payment information

If you buy a plan, payment is handled by a payment provider, not by us. We never see or store your full card number. When you start the setup-mode payment-method flow, the payment provider selected for the service may receive the payment details needed to save a payment method, even if the later season charge does not complete. We receive a provider customer reference, a payment-method reference, a one-off payment reference, the plan, its amount and currency, its status, the anchored season charge date, and records of your future-charge consent and accepted terms version and timestamp. We do not receive a subscription reference or recurring billing period because a season purchase does not create a Subscription or renewal obligation.

We are the seller. The payment provider selected for the service will handle your card or bank details under its own privacy policy. Stripe, PayPal and Razorpay are under consideration, but none is currently confirmed or active for paid plans. The provider identity and its processing details will be added here before paid checkout is enabled.

Your card or bank statement will show Common Room Ventures, which is the company behind My FPL Mini-League.

3.5 Messaging records

If you opt into WhatsApp at product level: your phone number, the messages and artwork sent to you, delivery status, when you opted in or out, and your league and message-type delivery preferences. Creator Plus Broadcasts are a marketing category and may contain creator-written free text and artwork.

4. Why we use it, and our legal basis

Under DPDPA 2023 we process personal data with your consent, or for the legitimate uses that Act permits. Under UK/EU GDPR we rely on the bases named below.

Where we rely on consent, you can withdraw it at any time and it is as easy to withdraw as to give. Withdrawing does not affect what was done while it applied.

Where we rely on legitimate interests, we have weighed our interest against your rights, and you can object (see §10).

5. Where we do not use your data

Stated plainly because these are the things people assume:

• We do not sell personal data to anyone, and never have.

• We do not share it with advertisers or use it for advertising.

• We do not use it to make automated decisions with legal or similarly significant effects.

• We do not use your league data to train machine-learning models sold to third parties.

• We do not give hosts your phone number or email address.

6. Public league pages

This is the most significant processing we do, so it has its own section.

6.1 What is published

When a host publishes a league, we generate a page at a public address. It contains the league's branding and name, the full standings, the prize board, and the latest recap. Each standings row carries a display name, team name, rank and points.

6.2 Who can see it

Anyone with the link, without signing in. The page can be shared, screenshotted, indexed by search engines, cached by messaging platforms, and unfurled into link previews. Standings are searchable within the page, which means the full roster is retrievable by anyone viewing it.

Treat a published league page as fully public, because it is.

6.3 People who never signed up

The great majority of rows on a typical league page belong to people who have never used the Platform. Their information comes from Fantasy Premier League's public API, not from them.

Our lawful basis is legitimate interests, and the interest is this: the league is one the person is already a member of, the underlying data is already published by Fantasy Premier League, running a league is not possible without its full roster, and what we publish is limited to team names, display names and game performance. We have weighed that against the rights of the people concerned, and we accept that it does not override them.

Because we obtained the data from Fantasy Premier League rather than from the people themselves, and because we hold no contact details for them and so cannot notify them individually, we make this information publicly available instead, in a document written for exactly that audience: Public League Pages and Your Data. It is linked from every public league page. Hosts are also required, under Host Terms §3, to tell their league that the page exists.

Anyone can object and have their name taken off, without an account, without going through the host, and without giving a reason. We do not ask why.

6.4 What we do when you object

We anonymise your row. Your display name and team name are replaced with a neutral label, so nothing on the page identifies you.

The row itself stays. That is deliberate: a league's standings and every prize race are calculated across the full roster, so deleting a row would change everyone else's position and their prize results. Anonymising leaves the competition intact for the rest of the league while taking your name off it.

It applies to every version of the page published from then on, automatically, and it is not undone the next time we refresh the league's data from Fantasy Premier League.

6.5 The limits, stated honestly

Anonymising takes your name off the page going forward. It does not undo what has already been published or shared:

• Our pages are published in versions, and older versions remain retrievable by anyone holding their direct address rather than being deleted when a new version replaces them. All versions are deleted at the end of the season following the one they were published in, so nothing persists indefinitely, but within that window an older version may still carry your name.

• We cannot retrieve screenshots, forwarded images, or previews cached by a messaging platform.

• We cannot remove anyone from Fantasy Premier League, which is where the data originates.

We would rather state this plainly than promise something more complete than it is.

6.6 How to ask

Email [email protected]. No account needed, no reason needed, no need to involve the host. See Public League Pages and Your Data.

7. Hosts and members

If you run a league, you are responsible for telling your league that its page exists and is public, and for passing on any objection you receive. That obligation is in the Host Terms §3.

Hosts can see their league's roster, who has claimed a row, and prize positions. They cannot see any member's email address, phone number, password, or FPL credentials.

8. Who we share data with

We share personal data only with service providers who process it on our instructions, and only as far as they need to.

We also use Google Fonts and jsDelivr to deliver typefaces and emoji graphics; these see your IP address as a technical necessity of serving the file.

The Fantasy Premier League API, operated in the United Kingdom, is a source of data rather than a recipient. We read from it; we do not send it anything about you.

We may also disclose data where the law requires it, to enforce our terms, or to protect the rights and safety of users. And if the business is ever sold or restructured, to the acquiring party, who would be bound by this policy or one no less protective. We would tell you first.

Each of these processes personal data on our instructions and not for its own purposes. We are working through formal data-processing agreements with each of them, and will say here where one is not yet in place once that review is complete.

A note on the payment row. Paid plans are not live yet, and no payment provider has been confirmed, so no provider currently receives payment data. Once a provider is confirmed and setup-mode checkout is enabled, that provider may receive payment details when you start the payment-method flow; no charge is taken merely because setup begins. Before that happens, update this policy with the provider identity, processing location, data-processing agreement and international-transfer details. Stripe, PayPal and Razorpay remain under consideration; none is being removed from the product decision.

9. International transfers

We are based in India, and our providers are spread across several countries, so your data is transferred internationally.

For transfers out of the UK or EU, we rely on the appropriate safeguards permitted under UK/EU GDPR (most commonly Standard Contractual Clauses) or on an adequacy decision where one applies. You can ask us for details of the safeguards for any specific transfer at [email protected].

Transfers from India are made in line with DPDPA 2023 and any restrictions notified by the Central Government.

10. Your rights

You have these rights whether or not you have an account with us.

If you are in California, you additionally have the right to know what is collected and disclosed, to delete it, to correct it, and not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA/CPRA.

10.1 How to exercise them

Email [email protected]. Tell us what you want and enough to identify you. For a public page, the team name or the page link is enough.

We respond within 30 days. If a request is complex we will tell you and explain why, before that deadline passes. There is no charge unless a request is manifestly excessive, in which case we will say so before doing anything.

We may need to verify who you are, proportionately to what is being asked. We will not demand more identification than the request warrants.

10.2 Complaining to a regulator

You can complain to us first (we would prefer that) but you do not have to.

• India: the Data Protection Board of India, once constituted under DPDPA 2023

• United Kingdom: the Information Commissioner's Office, ico.org.uk

• European Union: your national supervisory authority

UK and EU representative. We have not yet appointed a representative under Article 27. One is being arranged, and their details will be published here as soon as they are. Until then, write to us directly at [email protected]; we answer requests from the UK and EU on the same terms as any other.

11. Grievance Officer

Under India's Information Technology Rules, 2011 and the Consumer Protection (E-Commerce) Rules, 2020:

Shashwat Nandan, Co-Founder & Director [email protected] Common Room Ventures Private Limited, 301/302, 3rd Floor, Saket Callipolis, Sarjapur Main Rd, Doddakannelli, Bengaluru, Karnataka 560035, India

We acknowledge grievances within 24 hours and resolve them within 15 days. Consumer complaints under the E-Commerce Rules are acknowledged within 48 hours and redressed within one month.

A published telephone line is being set up and its number will appear here. Until it does, [email protected] reaches the Grievance Officer directly and is answered on the timescales above.

12. How long we keep data

We keep personal data for as long as needed for the purpose it was collected for, and then delete it or make it non-identifying.

Two things worth stating plainly:

• We keep an internal archive of past seasons. If you ask us to delete your data, that request covers the archive too.

• Where the law requires us to keep something, such as a financial record or a record of a grievance, we keep it for that period even if you have asked for deletion. We will tell you if that applies to your request.

The full schedule, including internal operational data, is in the Data Retention and Deletion policy.

13. Security

We use encryption in transit, encryption at rest with our database provider, access controls limiting who on our team can reach personal data, and audit logging.

We sign you in with a magic link or Google rather than a password you have to remember and we have to store.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to you, we will notify you and the relevant regulator as the law requires. If you believe your account has been compromised, tell us at [email protected] immediately.

14. Children

Accounts are for people aged 18 and over. Under India's Digital Personal Data Protection Act, 2023 anyone under 18 is a child, and processing a child's data requires verifiable parental consent. We have chosen not to operate a parental consent process, so we do not offer accounts to under-18s and we do not knowingly collect their data through an account.

If we find out an account holder is under 18, we close the account and delete the personal data attached to it.

14.1 Children on public league pages

This needs saying separately, because it is the one place a child's data can reach us without an account.

League rosters from Fantasy Premier League do not indicate age. We cannot tell how old anyone in a roster is, and Fantasy Premier League itself permits accounts from 13, and younger with parental permission. So a published league page may show the team name and performance of someone under 18, without us knowing.

We do not target children, do not profile them, and do not send them anything, because messaging requires an account and accounts are 18+.

If your child appears on a league page, tell us and we will anonymise their row. Their display name and team name are replaced with a neutral label, so nothing on the page identifies them. Email [email protected]. You do not need an account, you do not need to go through the league's host, and you do not need to give a reason. We treat a request about a child as a priority. See Public League Pages and Your Data.

15. Changes to this policy

We may update this policy. Where a change materially affects your rights we will notify you by email or in the Platform before it takes effect, and where a change requires fresh consent we will ask for it rather than assume it.

Every version is retained with its effective date, so you can always establish what applied at a given time. The current version and effective date are shown at the foot of this page.

16. Contact

Postal: Common Room Ventures Private Limited, 301/302, 3rd Floor, Saket Callipolis, Sarjapur Main Rd, Doddakannelli, Bengaluru, Karnataka 560035, India.