Privacy Policy

Last Updated: October 1, 2026

This Privacy Policy explains how FatPitches Ltd (“we”, “us”, or “our”) collects, uses, shares, and processes personal data when you visit or use FatPitches (fatpitches.com, the “Service”), in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR / RGPD).

1. Controller and Contact

FatPitches Ltd is the data controller responsible for processing your personal data under the EU General Data Protection Regulation (GDPR).

• Privacy Enquiries: privacy@fatpitches.com

For any privacy queries, to exercise your data protection rights, or to contact our privacy team, please write to privacy@fatpitches.com.

2. Data We Collect

Depending on how you interact with the Service, we collect:

1. Account and Identity Data: Email address, name, authentication provider identifier, and sign-in records.
2. Billing and Subscription Data: Subscription tier, trial and renewal dates, discounts applied, and payment provider references. At checkout, Paddle (see Section 4) collects your payment details and shares the order data with us: name, email address, billing address, tax ID if you provide one, and order details. We never receive your card details.
3. Technical and Security Data: IP address, device and browser details, operating system, access timestamps, log records, and security telemetry.
4. Support and Communication Data: Chat messages sent via tawk.to, support attachments, and transactional email interactions via Resend.
5. Optional Analytics Data: Page views, feature interactions, and performance metrics collected via PostHog and Google Analytics when you grant consent.

3. Purposes and Legal Bases for Processing

We process your personal data under the following legal bases pursuant to Article 6 of the GDPR:

• Performance of Contract (Art. 6.1.b GDPR): Creating and authenticating accounts, delivering core website features, managing subscriptions, sending transactional emails via Resend, and providing customer support via tawk.to.
• Legitimate Interests (Art. 6.1.f GDPR): Securing the Service, preventing fraud and abuse, monitoring service reliability, and analyzing backend activity.
• Compliance with Legal Obligations (Art. 6.1.c GDPR): Maintaining tax, accounting, and legal records.
• Explicit Consent (Art. 6.1.a GDPR): Executing optional browser analytics via PostHog and Google Analytics where prior consent is required, which you can grant or withdraw at any time via our cookie preference banner.
• Legitimate Interests (Art. 6.1.f GDPR): Executing the same analytics where prior consent is not required, and counting visits anonymously (no device storage, no identifier) when you decline analytics, to understand and improve the Service; you can object at any time via “Cookie preferences” in the site footer.

4. Recipients and Service Providers

We do not sell personal data. We disclose personal data to trusted third-party service providers acting as data processors under binding data processing agreements (GDPR Art. 28):

Payments (Paddle). Paid subscriptions are sold by Paddle.com Market Limited (United Kingdom) and its affiliates, which act as merchant of record. Paddle processes your payment, tax, fraud-prevention, and order-support data as an independent controller under its own Privacy Notice, and shares the order data listed in Section 2 with us so we can provide your subscription. Transfers to the United Kingdom rely on the European Commission’s adequacy decision; any onward transfers are covered by Paddle’s Privacy Notice.

We may also disclose data when required by applicable EU law, legal proceedings, or valid court orders.

5. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA)—such as to service providers based in the United States—we ensure appropriate safeguards are implemented in compliance with Chapter V of the GDPR. These safeguards include the European Commission’s Standard Contractual Clauses (SCCs) and certifications under the EU-U.S. Data Privacy Framework (DPF) where applicable.

6. Data Retention

We retain personal data only for as long as required for the purposes stated in this policy:

• Account and Profile Data: Retained while your account is active and deleted or pseudonymized within 90 days following account closure.
• Customer Support & Communications: Customer support communications via tawk.to and transactional emails via Resend are retained for up to 24 months to assist with ongoing support and service history.
• Operational Security Logs: Server and security telemetry logs are retained for up to 12 months.
• Billing and Tax Records: Invoice and accounting records are retained for the statutory period mandated by applicable commercial and tax legislation.
• Optional Analytics Data: Stored in PostHog or Google Analytics in accordance with service retention limits (up to 14–26 months).

7. Security

In compliance with Article 32 of the GDPR, we implement technical and organizational security measures to protect personal data against unauthorized access, loss, or alteration. These measures include:

• TLS (HTTPS) encryption in transit across all endpoints.
• Strict role-based access controls and passwordless/token-based authentication.
• Rate limiting, abuse detection, and active system monitoring.

8. Cookies and Tracking Technologies

We use cookies and browser local storage to keep the Service operational, secure, and to understand product usage. If you are in the European Union (outside Spain), the European Economic Area, the United Kingdom, or Switzerland, non-essential tracking technologies are disabled by default and are only activated if you grant consent through our preference banner. Elsewhere, including the United States and Spain, they are active by default and you can turn them off at any time through “Cookie preferences” in the site footer or by sending a Global Privacy Control signal from your browser.

Category 1: Necessary and Requested Functionality

These essential cookies and local-storage items enable core functionality such as user authentication, session security, fraud prevention, CSRF protection, and storing your privacy preferences.

Note: Because the Service cannot function properly without them, these technologies do not require prior consent under GDPR/ePrivacy laws and cannot be toggled off via the cookie banner.

Category 2: Optional Analytics

We use PostHog and Google Analytics to measure how visitors interact with fatpitches.com, track performance, and improve feature design.

• These tools collect pseudonymous usage metrics (such as pages visited, clicks, session performance, and session recordings).
• Where the law requires your prior consent (the European Union outside Spain, the European Economic Area, the United Kingdom, and Switzerland), they are loaded strictly after you accept analytics in our cookie banner. If you decline, we still count your visit anonymously: nothing is stored on your device, there is no session recording, and no identifier is created. PostHog derives a one-way hash on its own servers from your IP address and browser details with a salt that changes every day and is then deleted, so the hash cannot be traced back to you or linked across days.
• Elsewhere, including the United States and Spain, they load by default. You can switch them off at any time through “Cookie preferences” in the site footer, or by sending a Global Privacy Control signal, which we honor as an opt-out.
• Opting out or withdrawing consent never affects your access to the Service.

9. Your Data Protection Rights

Under Articles 15 to 22 of the GDPR, you have the right to:

1. Access: Request a copy of your personal data held by us.
2. Rectification: Request correction of inaccurate or incomplete data.
3. Erasure (“Right to be Forgotten”): Request deletion of your personal data under applicable conditions.
4. Restriction: Request that we restrict processing of your personal data.
5. Data Portability: Receive your data in a structured, machine-readable format.
6. Objection: Object to processing based on legitimate interests or direct marketing.
7. Withdraw Consent: Withdraw consent at any time for consent-based processing.

To exercise any of these rights, please contact us at privacy@fatpitches.com. We will respond within one month. You also have the right to lodge a complaint with your local EU Data Protection Supervisory Authority.

10. Automated Decision-Making

We do not carry out solely automated decision-making or profiling that produces legal or similarly significant effects concerning you.

11. Marketing Communications

Where permitted by law or based on your explicit consent, we may send product updates and service news. You can opt out at any time by clicking the unsubscribe link in any email sent via Resend or by contacting privacy@fatpitches.com. Essential transactional and security communications will continue to be delivered.

12. Children’s Privacy

The Service is intended for adults and is not directed at children under 16 (or the legal age of majority in your jurisdiction). We do not knowingly collect personal data from children.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect technical, legal, or operational developments. We will post revised versions with an updated date, and material changes will be announced on the Service or via email.

14. Contact Us

If you have any questions or concerns regarding this Privacy Policy, please reach out to us at:

• Email: privacy@fatpitches.com
• Brand: FatPitches (FatPitches Ltd)