Privacy policy

Last updated: 4 August 2026

This policy explains what personal data FanSay collects, why, and what rights you have over it. FanSay is provided by Hutch Media Group Ltd, trading as FanSay (“we”, “us”), contactable at privacy@fansay.co. We are the data controller for the personal data described below.

Who this applies to

FanSay is used by two kinds of people, and we collect different data for each:

• Fanssubmitting feedback through a club’s public FanSay page.
• Club administratorswho sign up, manage their club’s branding, and read submitted feedback.

What we collect

From fans submitting feedback

• The feedback message itself.
• An email address, only if you choose to provide one, so the club can reply.
• Your IP address, used solely to prevent spam and abuse (rate-limiting and blocking repeat abusive senders). It is not used to identify you for any other purpose and is not shared with the club.

Submitting feedback does not require creating an account. If you don’t provide an email address, your submission is effectively anonymous to us and to the club.

From club administrators

• Email address and password (stored as a one-way hash, never in plain text).
• Club name, short bio, badge image and brand colour, as entered in the dashboard.
• Billing details, handled entirely by Stripe. We never see or store your card details; we hold only a Stripe customer/subscription reference.

Why we process this data

• Providing the service: to run your club’s feedback inbox, dashboard, and billing (necessary to perform our contract with you).
• Preventing abuse: rate-limiting and blocklisting rely on IP addresses and, where given, email addresses (our legitimate interest in keeping the service usable).
• Legal obligations: such as retaining billing records where required by tax law.

Who we share data with

We use a small number of service providers to run FanSay. Each only sees what it needs to do its job:

• Supabase (hosted in London, UK): our database and login system.
• Stripe: payment processing and subscription billing.
• Vercel: application hosting.
• Resend: delivering account and transactional emails (invites, password resets, and new-feedback notifications to admins who’ve opted in).

We do not sell personal data, and we do not use it for advertising.

How long we keep data

• Feedback submissions are kept for as long as the club’s account is active, or until the club deletes them.
• Club administrator accounts are kept until the account is closed.
• Billing records are kept for as long as required by UK tax law after that.

Your rights

Under UK GDPR, you can ask us to:

• Show you the personal data we hold about you.
• Correct it, if it’s wrong.
• Delete it, subject to any legal retention requirements (e.g. billing records).
• Stop processing it, in some circumstances.

To exercise any of these, email privacy@fansay.co. If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office (ICO).

Children

FanSay’s public feedback form doesn’t require an account or age check, since many fans of grassroots and amateur clubs are minors. We recommend clubs don’t ask for or publish anything that could identify a child from a submission without a parent or guardian’s involvement. Club administrator accounts are intended for club staff, not children.

Changes to this policy

If we make significant changes to how we handle personal data, we’ll update this page and, where appropriate, let club administrators know directly.