Privacy Policy
We collect only the data we need to operate Transfer365. We do not sell your personal data to third parties. You can request deletion of your data at any time by emailing support@transfer365.net.
1. Who We Are
Transfer365 is operated by Transfer365 Ltd ("we", "us", "our"). We are the data controller for personal data you provide when using Transfer365 at transfer365.net. For privacy enquiries, contact us at support@transfer365.net.
2. Data We Collect
We collect personal data in the following categories:
2.1 Account Data
When you create an account, we collect:
- Your email address (required)
- Your name (optional, as provided)
- Authentication credentials (password is hashed; we never store it in plain text)
2.2 Usage Data
When you use Transfer365, we automatically collect:
- Pages and features accessed, and timestamps of access
- Player profiles viewed and alert rules configured
- Search queries entered (to improve search quality)
- Device type, browser type and approximate geographic region (country level)
2.3 Payment Data
Payments are processed by LemonSqueezy. Transfer365 does not receive or store your full card details. We receive confirmation of successful or failed transactions, your billing country and your plan tier.
2.4 Communication Data
If you contact us by email or use our in-app support, we retain the content of that communication to help us respond and improve the Service.
2.5 Cookies and Tracking
We use essential cookies to maintain your login session. We do not use advertising cookies or third-party tracking pixels. We may use anonymised analytics (such as page view counts) to understand platform usage. No personally identifiable information is shared with analytics providers.
3. How We Use Your Data
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account | Performance of a contract |
| Delivering alerts and platform features | Performance of a contract |
| Billing and subscription management | Performance of a contract; legal obligation |
| Sending product updates and service communications | Legitimate interest; consent where required |
| Detecting and preventing fraud or abuse | Legitimate interest |
| Improving the Service based on usage patterns | Legitimate interest |
| Complying with legal obligations | Legal obligation |
4. Third Parties Who Receive Your Data
We share limited personal data with the following categories of trusted third parties who help us operate the Service:
- Supabase — secure database and authentication infrastructure (EU/US data processing)
- LemonSqueezy — payment processing and subscription management
- Netlify — website hosting and deployment infrastructure
- Resend — transactional email delivery (for account confirmations and alerts)
We do not sell, rent or trade your personal data to any third party for marketing or commercial purposes. We do not share your data with football clubs, player representatives or other market participants.
5. Data Accuracy and Third-Party Content
Transfer365 displays information aggregated from publicly available third-party sources. This information relates to football players, clubs and market activity — it is not personal data that you have provided to us. Such third-party data may be inaccurate, incomplete or outdated. We do not control its accuracy and take no responsibility for errors in third-party data displayed on the platform.
If you believe that information displayed on Transfer365 concerning you personally is inaccurate, please contact us at support@transfer365.net.
6. Data Retention
- Account data: retained for as long as your account is active, plus 90 days after account closure to allow for reactivation requests
- Usage logs: retained for up to 12 months, then anonymised or deleted
- Billing records: retained for 7 years to comply with financial record-keeping requirements
- Support communications: retained for 2 years from last interaction
7. Your Rights
Depending on your jurisdiction, you may have the following rights in relation to your personal data:
- Access: request a copy of the personal data we hold about you
- Rectification: request correction of inaccurate personal data
- Erasure: request deletion of your personal data (subject to legal retention requirements)
- Portability: receive your data in a structured, machine-readable format
- Objection: object to processing based on legitimate interest
- Restriction: request that we restrict processing of your data in certain circumstances
- Withdrawal of consent: where processing is based on consent, withdraw it at any time
To exercise any of these rights, email support@transfer365.net. We will respond within 30 days.
8. International Data Transfers
Transfer365 uses infrastructure providers (including Supabase and Netlify) that may process data outside the European Economic Area. Where such transfers occur, we rely on Standard Contractual Clauses or equivalent safeguards approved under applicable data protection law.
9. Security
We implement industry-standard security measures to protect your personal data, including encrypted storage, TLS in transit and restricted access controls. No system is completely secure, and we cannot guarantee that your data will never be subject to a breach. In the event of a material breach affecting your personal data, we will notify you as required by applicable law.
10. Children
Transfer365 is not intended for persons under the age of 18. We do not knowingly collect personal data from minors. If you believe we have inadvertently collected data from a minor, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email. The date at the top of this page shows when it was last updated. Continued use of the Service after a change constitutes acceptance of the updated policy.
12. Contact and Complaints
For privacy questions or complaints, contact us at support@transfer365.net.
If you are located in the EU/UK and believe we have not handled your data correctly, you have the right to lodge a complaint with your local data protection authority.