Privacy Policy

This Privacy Policy explains how Fight Blueprint collects, uses, discloses and protects personal data when you use our website and services. Fight Blueprint is the controller of the personal data described here.

1. Data we collect

Data you give us

• Account data — sign-in identity (email address or the identifier supplied by your chosen sign-in provider), display name, avatar and optional profile bio.
• Scouting work — saved fighters, watchlists, saved comparisons, simulations, predictions and notes.
• Uploaded material — fight film and clip metadata you submit, together with the rights information you provide.
• Correspondence — the name, email address and message you send through the contact form, including takedown notices.

Data collected automatically

• Operational logs — request routes, timestamps and error information needed to run and debug the service.
• Security events — rate-limit triggers and unusual access patterns, recorded against a non-reversible fingerprint derived from request metadata rather than a stored raw IP address. These records never contain passwords or access tokens.
• Local storage — your browser stores your session so you stay signed in, plus interface preferences. We do not use third-party advertising or cross-site tracking cookies.

2. Why we use it, and our legal bases

• To provide the service — authentication, saving your work, generating reports. Legal basis: performance of a contract.
• To secure the platform — abuse prevention, rate limiting, protecting our database against bulk extraction. Legal basis: legitimate interests.
• To improve accuracy and features — aggregated, non-identifying usage analysis. Legal basis: legitimate interests.
• To respond to you — handling questions, corrections and rights requests. Legal basis: legitimate interests and legal obligation.

We do not sell personal data, and we do not share it for cross-context behavioural advertising.

3. Who processes data on our behalf

We use a small number of service providers acting under contract and on our instructions: cloud hosting and database infrastructure, authentication (including any sign-in provider you choose), email delivery, and AI model providers used to generate analysis text. Providers may process data outside your country; where personal data leaves the European Economic Area or the United Kingdom, transfers are covered by standard contractual clauses or another lawful transfer mechanism.

We may also disclose data where legally required, to enforce our terms, or in connection with a corporate transaction, in which case the recipient remains bound by this Policy.

4. Athlete information

Athlete pages describe publicly reported competitive information about people acting in a public professional capacity, together with Fight Blueprint analysis. They do not include private contact details, health records or other private personal data. Athletes and their representatives may request correction or removal through the contact page, and we will assess each request on its merits.

5. Retention

• Account and saved scouting work: for as long as your account is open, then deleted within 30 days of an account deletion request.
• Contact messages: up to 24 months, or longer where needed to handle a legal claim or takedown record.
• Security event records: up to 12 months.
• Aggregated, non-identifying statistics: retained indefinitely.

6. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent. California residents may request disclosure of the categories of personal information collected and may opt out of any sale or sharing (we do neither). You may exercise any of these rights through the contact page; we respond within the timeframe required by applicable law and will not discriminate against you for exercising a right. You may also complain to your local data protection authority.

7. Security

Data is held on managed infrastructure with encryption in transit, row-level access rules that restrict each account to its own records, least-privilege service credentials, and logging of privileged operations. No system is perfectly secure; we ask you to use a strong, unique password and to report any suspected compromise immediately.

8. Children

The service is not directed at children under 16, and we do not knowingly collect their personal data. If you believe a child has provided data, contact us and we will delete it.

9. Changes

We may update this Policy. Material changes will be signalled by updating the effective date above and, where appropriate, by notice within the service.

10. Contact

Privacy questions and rights requests can be submitted through the contact page.