Privacy Policy
Last updated: 16 October 2026
Who we are
Vireo Analytics is a Fantasy Premier League companion service available at vireoanalytics.com.
The service is operated by Vireo Analytics (OPC) Private Limited, a company currently in the process of incorporation in India. Until incorporation is complete, the service is operated on its behalf by its founder.
If you have any question about this policy or about your data, contact us at admin@vireoanalytics.com. We aim to reply within five working days.
What this policy covers
This policy explains what personal information we collect when you use Vireo Analytics, why we collect it, who else can see it, and what you can ask us to do about it.
The information we collect
Information you give us
- Your email address, when you create an account — either directly or through Sign in with Google.
- How you signed up — whether by email or via Google — and the date you signed up.
- Your Fantasy Premier League team ID, if you choose to link your team. This is the public numeric ID that appears in the address bar of your own FPL team page. We use it only to fetch your squad and your rank from publicly available Fantasy Premier League data, and for nothing else.
- Squads, drafts and plans you create in the app, including saved transfer plans and comparisons.
We never ask for, receive, or store your Fantasy Premier League password. Linking your team uses only your public team ID and publicly available Fantasy Premier League data. We cannot make changes to your FPL team and we never see your FPL account credentials.
Information collected automatically
- Usage information — which pages and features you use, and when. We use this to understand which parts of the product are useful and where people get stuck.
- Technical information — your browser type, device type, approximate location derived from your IP address (country or region level), and the pages you arrived from.
- Error reports — when something goes wrong, we record what failed and where, so we can fix it.
- Ad click details — if you arrive by clicking one of our ads, the web address carries a click reference added by the ad platform (for example
fbclidfrom Meta orgclidfrom Google) and tags that name the ad. We keep them with your visit and, if you sign up, with your account, so we know which ad brought you.
Information we do not collect
- We do not collect payment card details. We do not currently process payments. If we introduce paid subscriptions, payment will be handled by a specialist payment provider and we will not receive or store your card number. We will update this policy before that happens.
- We do not collect special category data — such as information about health, ethnicity, religion, political opinions or sexual orientation. Please do not send it to us.
Why we use your information, and our lawful basis
| What we use it for | Lawful basis |
|---|---|
| Creating and securing your account, and signing you in | Performance of a contract — we cannot provide the service without it |
| Showing you projections, plans and your linked team | Performance of a contract |
| Sending you account emails — sign-in codes, password resets, service notices | Performance of a contract |
| Understanding how the product is used, so we can improve it | Legitimate interests — running and improving a product people choose to use |
| Diagnosing and fixing faults | Legitimate interests — keeping the service working |
| Telling you about changes to the service or to your plan | Legitimate interests |
| Knowing which of our ads bring people to Vireo Analytics, and telling Meta or Google when a click on one of their ads led to a sign-up | Legitimate interests — measuring our advertising, so we spend less on ads that do not work. See "Ads and measuring them" below |
We do not sell your personal information. The only thing we pass to advertising platforms is the sign-up report described in "Ads and measuring them", and only when you arrived from one of their ads.
Ads and measuring them
We advertise Vireo Analytics on Instagram, Facebook and Google. When you click one of these ads, the platform adds a click reference to our web address. If you then create an account, we tell that platform that the click led to a sign-up. This helps the platform show our ads to people likely to find Vireo Analytics useful, and shows us which ads work.
- What Meta (Facebook and Instagram) receives: the click reference, the time you signed up, the address of our page and your browser's standard identification text (its "user agent").
- What Google receives: the click reference and the time you signed up.
- What neither receives: your email address in any form, your name, your FPL team, or anything you do in the app.
- If you did not arrive from one of our ads, nothing is sent.
- We send the report from our analytics provider's server. There are no advertising pixels or tags on our site.
Meta and Google use these reports under their own terms and privacy policies: Meta Privacy Policy and Google Privacy Policy. You can also manage how they use information from other websites in your Meta and Google ad settings.
You can object at any time: email admin@vireoanalytics.com and we will stop sending reports about you. A report that has already been sent stays with the platform under its own policy.
Who else can see your information
We use a small number of service providers to run Vireo Analytics. They process your information on our instructions, and only for the purposes described here.
| Provider | What it does | What it can see |
|---|---|---|
| Lovable | Hosts the website and app, and records visit statistics, page speed and errors for the hosting | The pages you visit, the site you came from, your browser and device type, approximate country, ad click details, and technical details of errors |
| Supabase | Stores your account and all your data, and handles sign-in | Your email address, account details, linked team ID, squads, drafts and plans |
| PostHog (hosted in the European Union) | Product analytics and error tracking, and sending the ad sign-up reports to Meta and Google | Your email address, how and when you signed up, which features you use, ad click details, and technical details of any errors |
| Railway | Runs the calculation service that produces your transfer plans | The contents of a squad at the moment you ask for a plan |
| Resend | Sends account emails on our behalf | Your email address and the contents of those emails |
| Cloudflare | Provides domain and email routing for our contact address | Email you send to our contact address |
| Only if you choose Sign in with Google | Google confirms your identity to us and tells us your email address. We receive nothing else from your Google account |
Advertising platforms. Meta and Google also receive the sign-up report described in "Ads and measuring them". They are not our service providers: they use it under their own terms.
We may also disclose information if we are legally required to, or to establish or defend legal claims.
Where your information is held
Our providers store and process information in the European Union, the United Kingdom and the United States, and our own operations are based in India. Meta and Google process the sign-up reports in the United States and other countries. Where information leaves the UK or the European Economic Area, we rely on our providers' standard contractual protections for international transfers.
Cookies and similar technologies
We use three kinds of storage on your device:
- Essential storage, which keeps you signed in and lets our hosting tell people apart from automated traffic. The service cannot work without it.
- Analytics storage, used by our analytics provider and our hosting to recognise a returning visitor, so that usage is counted as one person rather than many.
- Ad click storage — if you arrive from one of our ads, the click reference and the ad's tags are kept on your device until you sign up, so the sign-up can be matched to the ad.
We do not currently show a cookie consent banner. We are telling you plainly instead: analytics and ad click storage are set when you visit, and they are used only as described above. We are reviewing this and intend to introduce a consent control. If you would prefer not to be included in analytics or ad measurement, email admin@vireoanalytics.com and we will exclude you. You can also block or delete cookies in your browser settings, though doing so will sign you out.
How long we keep it
- Account information — for as long as your account exists, and for a short period afterwards to handle any final queries.
- Squads, drafts and plans — until you delete them, or until your account is deleted.
- Ad click details — with your account, for as long as it exists.
- Analytics and error information — retained by our analytics provider for the period that applies to our account with them. We will state that period here once it is confirmed, and you can ask us for it at any time.
- Sign-up reports sent to Meta or Google — kept by those platforms under their own policies.
Deleting your account
You can ask us to delete your account and everything associated with it by emailing admin@vireoanalytics.com from the address you signed up with. We will confirm and complete the deletion within 30 days. We delete your personal information other than anything we are required to keep by law.
Your rights
If you are in the United Kingdom or the European Economic Area you have the right to:
- Ask what we hold about you, and get a copy.
- Correct anything inaccurate.
- Delete your account and personal information.
- Object to or restrict how we use your information, including analytics and the ad sign-up reports.
- Take your information elsewhere in a portable format.
- Withdraw consent where we relied on it.
To exercise any of these, email admin@vireoanalytics.com. We will not charge you and we will not make it difficult.
If you are unhappy with how we have handled your information, you can complain to the UK Information Commissioner's Office at ico.org.uk.
Children
Vireo Analytics is not intended for anyone under 16. We do not knowingly collect information from children. If you believe a child has given us their information, email us and we will delete it.
Security
Access to your data is restricted so that you can read and change only your own records. Passwords are handled by our authentication provider and are never visible to us. No service can promise perfect security, but we keep the number of places your data lives deliberately small.
Changes to this policy
If we change this policy we will update the date at the top. If a change materially affects you — such as introducing payments, or adding a new provider that sees your personal information — we will tell you by email or in the app before it takes effect.
Contact
Vireo Analytics is not affiliated with the Premier League or the official Fantasy Premier League game.