Privacy policy

1. Data controller

• Owner: Alex Martínez Herrera
• National ID (DNI): 43692186Y
• Email: info@internetfutbolmanager.com

2. What data we collect

• Registration data: name, email address and password (stored encrypted). If you sign up with Google, we only receive the name and email Google shares with us.
• Public manager profile: your name, points and honors are always visible on your public profile (/managers/tu-id), as part of the game itself (rankings and competition). Your country is shown by default but you can hide it, and your email is only shown if you turn that option on — both adjustable in your profile. This page is excluded from search engines (noindex + robots.txt).
• Game data: team managed, country, city, club name and crest, results and stats from your matches.
• Community: the messages you post in a game's community are shown with your manager name and your club crest, and are visible to any visitor (except Support and Committee, logged-in only, and private games, members only). You can edit them for 15 minutes and delete them whenever you want; do not include personal data of yours or of third parties.
• Machine translation: if you or whoever reads your message enable translation, the text of a message or a community post is translated: Spanish ↔ Catalan on our own server (Apertium); when English is involved, the text is sent to the MyMemory service (Translated S.r.l., EU) only to translate it. You can turn it off in your profile ("Never translate"); translations are stored so the operation is not repeated.
• Payment data: if you buy IFM PRO or a private game, the payment is processed by Paddle (Paddle.com Market Limited) as Merchant of Record. We do not store or have access to your card details — Paddle processes them directly under its own privacy policy.
• Anti-fraud data: to ensure fair play (one person = one account), we log access data (IP, browser and a device fingerprint) with the sole purpose of detecting the use of multiple accounts. It's kept for a maximum of 12 months and is only accessible to the admin team and the anti-fraud commission. For the same purpose, a security cookie stores in your browser the numbers of the accounts that have logged in from it.
• Usage statistics: to know how many people use IFM and from what kind of device, we record each day you sign in: whether you use the installed app or the browser, the device type (phone, tablet or computer) and the system (Android, iOS, Windows…). We do not store your IP or the exact model. This is internal data, only seen by the administration, and kept for 24 months.
• Access request: if you request access without a code, we store what you enter in the form (name, email address, country and notes) and, to prevent multiple accounts, the IP address, browser and a device fingerprint at that moment. We use them to review the request and compare it with existing accounts and with data from the original IFM. If we approve it, your account is created with that data.
• Where you came from: when you create your account or request access, we store with it the page you first landed on, the website you came from and the link's campaign (if any), to know which promotions work. We do not use cookies for this: it is taken from the first page you visit.
• Inviting a friend: if you invite a friend, we store their email address (and their name, if you enter it) to send them a single email with your invitation; any message you add only goes in that email and is not stored. If they sign up, the two accounts are linked for fair-play checks. Whoever sends the invitation must have reason to believe their friend wants to receive it. If someone uses your personal referral link and creates an account or requests access, we also record that they came through you.
• IFM in your language: if you ask for IFM in another language, we keep the language, your email address, the country and your comment (if you write one) to count the requests for each language and let you know if we translate it; if you volunteer, also to ask for your help with the translation.
• Original IFM data: if you were a user of the original IFM (until 2015), we keep from that time your name, email address, country, score, whether the account was blocked or deleted and the teams you managed, with their dates. They are used to recognise you as a former manager, link that history to your current account and prevent multiple accounts. We never keep the passwords or IP addresses from back then.
• Internal mail between managers: the messages you exchange with other managers inside the game are kept even if you delete them from your inbox (they are only hidden), as a record for investigating rigged transfers between accounts. Only the administration can read them, and only when there is a specific suspicion of fraud.
• Browsing data: IP address, browser type and pages visited: with your consent (Google Analytics analytics cookies) or, if you do not give it, only as anonymous measurements without cookies — see the details in the Cookie policy.
• Newsletter: if you have an account, we use your email to send you the “Did you know…?” newsletter from time to time with tips and news about the game (including IFM PRO and private leagues). You can unsubscribe at any time from the link in each email or in Notification preferences.
• Email tracking: the emails we send you include an invisible 1×1 pixel image and their links go through a tracking subdomain (links.internetfutbolmanager.com) run by our email provider, Resend. This tells us whether an email was opened and whether a link was clicked; we use it only to check that emails arrive and to improve delivery, not to build profiles. If you don't want it recorded, turn off automatic image loading in your email client or write to us at info@internetfutbolmanager.com.

3. Legal basis for processing

• Performance of a contract (art. 6.1.b GDPR): account management and service provision, including purchases of IFM PRO and private games.
• Consent (art. 6.1.a GDPR): analytics cookies.
• Consent (Art. 6.1.a GDPR): “IFM in your language” requests.
• Legitimate interest (art. 6.1.f GDPR): platform security and prevention of multi-accounting/fraud.
• Legitimate interest (art. 6.1.f GDPR): review of access requests and recognition of former managers of the original IFM, to prevent multiple accounts.
• Legitimate interest (art. 6.1.f GDPR): sending a friend invitation at the request of the sender, and linking both accounts to prevent multi-accounting.
• Contractual relationship and legitimate interest (art. 6.1.f GDPR and art. 21.2 LSSI): sending the newsletter to registered users about services similar to the one contracted, with unsubscribe at any time.

4. Who we share your data with

We don't sell your data to third parties. We may share it with:

• Infrastructure providers: OVH SAS, France (server hosting).
• Backups: Microsoft (OneDrive), where we keep encrypted backups of the database.
• Email service: Resend (sending transactional emails).
• Payments: Paddle.com Market Limited (United Kingdom), as Merchant of Record for IFM PRO and private game purchases.
• Donations: Ko-fi, if you choose to voluntarily support the project.
• Analytics: Google Analytics (cookies only with your prior consent; without it, only anonymous measurements without cookies).
• OAuth: Google, solely to authenticate your identity if you choose to sign up that way.
• Anti-bot verification: Cloudflare Turnstile, on the contact and private-game request forms.

All providers process data in compliance with the GDPR or have adequate safeguards in place (Standard Contractual Clauses).

5. International transfers

Some providers (Google, Paddle, Resend) may be located outside Spain. In those cases, transfers are carried out with the appropriate safeguards provided for by the GDPR (adequacy decisions or Standard Contractual Clauses).

6. How long we keep your data

• Account data: for as long as the account is active or until you request its deletion.
• Game data (teams, statistics): kept as the game's history; private-game data is never made public or shown outside of that game.
• Anti-fraud data: maximum 12 months.
• Deleted accounts: we keep a record of the account (name, email address, IP, clubs you managed and pending operations) for 12 months to investigate fraud; after that we only keep one-way encrypted codes (of the email, the name and the device), from which that data cannot be recovered, to recognise whether the same person signs up again.
• Access requests: approved ones become part of your account; rejected or unconfirmed ones are deleted after 12 months.
• Friend invitations: if unused, the invitee's email address is deleted after 30 days.
• “IFM in your language” requests: until the language is available and we have let you know, or for a maximum of 24 months; you can ask us to delete them earlier at any time.
• Original IFM data: as long as they help recognise former managers; you can ask us to delete yours.
• Internal mail between managers: kept as part of the game's history, also after you delete it from your inbox.
• Payment data: kept by Paddle under its own legal obligations (billing, tax) — we don't store it.

7. Your rights (access, rectification, erasure, objection, etc.)

You can exercise the following rights by sending an email to info@internetfutbolmanager.com:

• Access: find out what data we hold about you.
• Rectification: correct inaccurate data.
• Erasure ("right to be forgotten"): request the deletion of your account and data.
• Objection: object to certain processing.
• Restriction: restrict processing in certain cases.
• Portability: receive your data in a structured format.

For payment data already processed by Paddle, those rights are also exercised directly with Paddle — see its privacy policy.

You can also file a complaint with the Spanish Data Protection Agency (AEPD).

8. Security

We apply appropriate technical and organizational measures: HTTPS encryption, hashed passwords, restricted access to personal data and periodic backups.

9. Minors

The service is not aimed at minors under 14. If we detect that a minor has provided their data without parental consent, we will delete it as soon as possible.

10. Changes to this policy

We may update this policy. We will notify you of relevant changes by email or via a notice on the platform.