Privacy Policy
Last updated: April 10, 2026
1. Introduction
CupNation ("we", "us", "our") operates the CupNation website (cupnation.org) and the CupNation mobile application. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our service.
We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable Dutch and European privacy laws.
2. Data Controller
Business Name: CupNation
Contact: Contact form or [email protected]
Governing Law: The Netherlands
3. Information We Collect
3.1 Information You Provide
- Account information: Full name, email address, and password (stored securely hashed)
- Profile data: Favourite teams, optional profile picture (JPG/PNG/GIF, max 2 MB)
- Predictions: Match score predictions and bonus picks you submit
- Company/group data: Company or group name when creating or joining a pool
3.2 Information Collected Automatically
- IP address: Used to detect your country and preferred language/currency
- Device information: Push notification tokens (if you enable notifications)
- Cookies: Session cookie, remember-me token (30-day expiry), country code, and language preference
3.3 Information We Do NOT Collect
- We do not use Google Analytics or any third-party tracking/advertising scripts
- We do not store payment card numbers — all payment processing is handled by Stripe
4. How We Use Your Information
- Provide and operate the prediction competition service
- Display leaderboards and rankings within your company or group
- Process payments for Company/Group Admin access via Stripe
- Send push notifications about match reminders and leaderboard updates (if opted in)
- Send transactional emails (password reset, invitations, admin notifications)
- Detect your country for language and currency preferences
- Maintain account security (two-factor authentication, session management)
5. Legal Basis for Processing (GDPR)
- Contract: Processing your account and prediction data is necessary to provide the service you signed up for
- Consent: Push notifications and optional profile picture uploads are based on your explicit consent
- Legitimate interest: Security measures, fraud prevention, and service improvement
6. Third-Party Services
We share data with the following third-party processors only as necessary to operate the service:
| Service | Purpose | Data Shared |
|---|
| Stripe | Payment processing | Email, payment details (handled on Stripe's servers) |
| Firebase Cloud Messaging | Push notifications | Device push token |
| ip-api.com | Country/currency detection | IP address |
| Cloudflare | CDN and security | IP address, request metadata |
| Gmail SMTP | Transactional email | Email address, message content |
We do not sell, rent, or trade your personal data to any third party.
7. Data Retention
- Account data is retained as long as your account is active
- If you delete your account, your personal data is removed within 30 days
- Payment records may be retained for up to 7 years as required by Dutch tax law
- Session and cookie data expires automatically (session cookies at browser close, remember-me tokens after 30 days)
8. Your Rights
Under the GDPR, you have the following rights:
- Access: Request a copy of the personal data we hold about you
- Rectification: Correct inaccurate or incomplete data
- Erasure: Request deletion of your account and personal data
- Portability: Receive your data in a structured, machine-readable format
- Restriction: Request limited processing of your data
- Objection: Object to processing based on legitimate interest
- Withdraw consent: Withdraw consent for push notifications or optional data at any time
To exercise any of these rights, please contact us.
9. Data Security
- All connections are encrypted via HTTPS/TLS
- Passwords are securely hashed and never stored in plaintext
- Optional two-factor authentication (TOTP) is available
- Session cookies are set with Secure, HttpOnly, and SameSite=Strict flags
- Payment data is processed exclusively by Stripe and never touches our servers
10. Children's Privacy
CupNation is not intended for users under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. International Transfers
Your data may be processed by third-party services (Stripe, Firebase, Cloudflare) that operate servers outside the European Economic Area (EEA). These providers maintain adequate data protection standards and are compliant with GDPR requirements.
12. Changes to This Policy
We may update this Privacy Policy from time to time. If we make significant changes, we will notify you via email or an in-app notification. The "Last updated" date at the top reflects the most recent revision.
13. Contact
If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us: