Privacy Notice
Last updated 1 September 2026
This notice explains what personal data Football Brain collects, why, who it is shared with and where it is stored. Football Brain is operated by Joseph & Dean Limited (“we”), a company registered in England and Wales, which is the data controller for the purposes of the UK GDPR.
1What we collect
We collect only what the product needs to run. We do not buy personal data, and we do not build advertising profiles.
| Data | Where it comes from |
|---|---|
| Email address, name and profile image | You, when you create an account — handled by our authentication provider, Clerk. If you sign in with Google, Google provides these. |
| Your stated role (journalist, agent, club staff, broadcaster, analyst) | You, during onboarding. Optional. |
| Subscription tier and billing identifiers | Stripe, when you subscribe. We store Stripe's customer and subscription IDs — never your card number. |
| Query count and reset date | Generated by us, to enforce plan limits. |
| Preferences and saved alerts | You, as you use the product. |
| The questions you type | You. These are sent to AI providers to answer them — see section 3. |
| Administrative audit records | Generated when an administrator edits data, recording who made the change and what changed. |
We do not store your payment card details. Card data is collected and held by Stripe and never reaches our servers.
2Why we use it
To provide the service you have asked for: authenticating you, running your queries, applying your plan’s limits, taking payment, and contacting you about your account. We also use aggregate usage information to understand which features are worth building.
Where we rely on legitimate interests, that interest is operating and improving a subscription product. You can object — see section 7.
3Your queries and AI providers
Football Brain answers questions by sending them to third-party AI services. When you ask a question, the text of that question is transmitted to one or more of OpenAI, Anthropic, Perplexity and Exa, depending on what is needed to answer it.
Please do not enter confidential or personal information about other people into the query box. Football Brain is an intelligence tool for publicly reported information about professional football; it is not a secure store for private material.
We record traces of these calls for quality and cost monitoring using Langfuse, hosted in the EU (Ireland), with masking applied.
4Who we share it with
We use the following processors. Each receives only what it needs.
| Provider | Purpose | Region |
|---|---|---|
| Clerk | Authentication and account management | United States |
| Stripe | Subscription billing and payments | United States / global |
| Neon | Our primary database | United Kingdom (London, eu-west-2) |
| Vercel | Application hosting | United Kingdom (London) — functions; global edge for static assets |
| Upstash | Caching and rate limiting | Global |
| OpenAI | Answering queries | United States |
| Anthropic | Answering queries | United States |
| Perplexity, Exa | Web retrieval for queries | United States |
| Langfuse | AI quality and cost monitoring | EU (Ireland) |
| Resend | Sending transactional email | United States |
| Crisp | Support chat during the beta | EU (France / Netherlands) |
We do not sell personal data, and we do not share it with advertisers.
5International transfers
Your account data is stored in the United Kingdom. Our database and the application compute that reads it are both in London, and our AI monitoring is in the EU. Some of our processors are not: authentication, payments and the AI providers that answer queries are US-based, as set out in section 4, so some personal data is still transferred outside the UK.
Where personal data is transferred outside the UK, we rely on the appropriate safeguards required by the UK GDPR, including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on a UK adequacy decision where one applies to the recipient.
6How long we keep it
We keep your account data for as long as your account is open. If you close your account, we delete or anonymise your personal data, except where we must keep records for legal or accounting reasons — invoices and payment records are generally retained for six years.
Administrative audit records are retained as a security measure, so that changes to data can be attributed.
7Your rights
Under the UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you;
- ask us to correct it if it is wrong;
- ask us to delete it;
- ask us to restrict how we use it, or object to our using it;
- ask us to transfer it to another provider;
- withdraw consent at any time, where we relied on consent; and
- complain to the Information Commissioner’s Office at ico.org.uk.
To exercise any of these, email us at the address in section 9. We will respond within one month.
8Cookies
We use only the cookies needed to keep you signed in and to keep the service secure. These are set by Clerk as part of authentication. We do not use advertising or third-party tracking cookies.
9Contact
Joseph & Dean Limited, England and Wales.
Email: privacy@josephdean.co.uk
10Changes
If we change this notice we will update the date at the top, and for material changes we will tell you by email before they take effect.