This policy explains what personal information SuperPSL collects, why we collect it and what we do with it. It covers the SuperPSL apps for iOS and Android, the web app at app.superpsl.co.za and this website. We process personal information in line with South Africa’s Protection of Personal Information Act, 2013 (POPIA).

Who we are

SuperPSL is run by Paolo Rufrano (“we”, “us”), of Midrand, South Africa. We are the responsible party for your personal information.

Our Information Officer is Paolo Rufrano, who you can reach at hello@superpsl.co.za.

What we collect

Account details. When you create an account we collect:

your email address
your password, which is stored only as a one-way hash
if you sign in with Google or Apple, the account identifier, name and email address they share with us (Apple may give us a private relay address instead of your real one)

Your profile. This is your first and last name, which is shown to other players as your manager name in leagues and rankings, and your favourite club, if you choose one.

Game data. This covers:

your team name and squad
lineups, captains, transfers and chips
your points and rankings
the leagues you create or join, including league names and invite codes

Your team name, manager name, points and squad are visible to other players. For example, they appear when someone views a league you’re in.

Technical data. Our servers and hosting providers record standard request logs (IP address, browser or device type, the page or API route requested, and the time) to run the service, keep it secure and fix problems.

On your device. The app stores your sign-in session and an unsaved squad draft on your device: in secure storage on iOS and Android, and in your browser’s local storage on the web. Signing out removes the session.

Website analytics. This website (superpsl.co.za, not the apps or the web app) uses PostHog to measure how visitors use it. It records the pages you view, the links and buttons you click (for example “Open app” or our contact email), the help topics you open, your browser and device type, your approximate location worked out from your IP address, and errors that happen on the page. PostHog stores a random identifier in a cookie and your browser’s local storage so it can tell repeat visits apart. It doesn’t collect your name, email address or game data.

We don’t use advertising trackers, and we don’t sell your personal information.

Why we use it

We use your information:

to create and secure your account and sign you in
to run the game: scoring your team, applying transfers and chips, and showing leagues and rankings
to send service emails you ask for, such as email confirmation and password resets
to answer your messages, and to enforce our Terms of Use
to keep the service secure and working, and to meet our legal obligations
to understand how people use this website, so we can fix problems and improve it

Our lawful basis is that the processing is needed to provide the service you signed up for, together with our legitimate interest in running a secure and fair game and in improving this website.

We only share personal information with the service providers that help us run SuperPSL, and only for that purpose:

Hosting. Our API, database and sign-in service run on servers we manage at DigitalOcean in Amsterdam, the Netherlands. Nightly backups are stored in Cloudflare R2. The website and web app are hosted by Vercel.
Sign-in providers. If you choose to sign in with Google or Apple, they process that sign-in under their own privacy policies.
Email delivery. Resend sends our account emails.
Website analytics. PostHog processes this website’s analytics data on servers in the United States.

Some of these providers store or process data outside South Africa. When that happens, we rely on providers that are bound by data protection terms giving protection comparable to POPIA, as section 72 of POPIA requires.

We may also disclose information if the law requires us to, or to protect the rights and safety of our players or others.

How long we keep it

We keep your account and game data for as long as your account exists. Season results may be kept in anonymised form for historical rankings. If you delete your account, we delete or anonymise your personal information within 30 days, unless the law requires us to keep it longer. Backups are kept for 30 days, so deleted information can remain in a backup until it expires. Server logs are kept for no more than 30 days.

Your rights

Under POPIA you can:

ask what personal information we hold about you and get a copy
ask us to correct or delete it
object to how we process it
delete your account at any time

To use any of these rights, email hello@superpsl.co.za from the address on your account. We’ll reply within 30 days.

If you’re unhappy with how we’ve handled your information, you can complain to the Information Regulator (South Africa) at inforegulator.org.za.

Children

SuperPSL is not meant for children under 13. If you’re under 18, you need a parent’s or guardian’s permission to play. If you believe a child has given us personal information without that permission, contact us and we’ll delete it.

Security

Passwords are hashed. All traffic is encrypted with HTTPS. Access to our servers is restricted. No system is perfectly secure, but we take reasonable steps to protect your information, and we’ll tell you and the Information Regulator if a breach puts your information at risk.

Changes to this policy

We’ll post any changes on this page and update the date at the top. If a change is significant, we’ll let you know in the app or by email before it takes effect.

Contact

Questions about this policy? Email hello@superpsl.co.za or see our contact page.

Privacy Policy