Privacidad y cookies

Who is responsible

The platform operator listed below is responsible for personal information processed by FUTStars and CareerModeStars. Use the contact form for privacy requests or the contact email below.

Accounts and login

We process your email address, account identifier, login requests and session records to create your account and deliver the features you request. Email addresses are encrypted in account storage; login and session tokens are stored as hashes. Magic Links expire after ten minutes and are single use. Sessions expire after seven days of inactivity and at most thirty days after creation.

Profiles and saved content

We store your username, display name, optional bio, profile settings, favorite players, scouting lists and creations. Public profiles and public creations can be viewed by anyone. Unlisted creations can be opened by people with their link or code. A private profile does not make a separately published creation private.

Profile photos and birth date

First-time profile setup stores a birth date separately from the public profile. It is not shown in public profiles or comments. Optional profile photos are decoded on the server, centre-cropped, resized and re-encoded; original files and their embedded metadata are not retained by this feature. Your selected photo is visible beside your public comments and on a public profile. Replacing or removing it removes the previous live photo file; browser and backup copies can persist according to their retention settings.

Challenge journals and screenshots

Your season journals and uploaded evidence are private to your account in the website. The operator and hosting provider may access stored data when necessary to administer the service or handle a request. Uploaded images can contain embedded metadata. Do not upload private information about other people. Archiving a journal keeps its data and screenshots.

Comments, applications and contact

Published comments show your display name, username, selected avatar and text. Replies link to their conversation, and likes are linked to the account that made them. Removing a parent comment clears its text but retains a placeholder when replies remain. Creator applications, reports and contact messages are available to administrators for review. Contact email and message details are encrypted in storage. We process this information to handle your request, moderate the community and protect the platform and its users.

Reasons for processing

Account features and requested storage are processed to provide the service you ask for. Abuse prevention, moderation and service security are based on the legitimate interests of operating a reliable community. Information required to handle a legal request may also be processed to comply with legal obligations. Optional publication follows the visibility you choose and can be changed through the available controls.

Cookies and device storage

Essential cookies hold your session and protect forms. Temporary login-confirmation and contact-receipt cookies last ten minutes. A language cookie stores your chosen language for up to one year. Column preferences, guest scouting choices, custom starting lineups, custom wheel entries and recent wheel results may be stored on your device until you clear them. Navigation state may last for the browser session. Advertising is disabled until our AdSense account and consent message are configured. When enabled, Google processes advertising identifiers, device and network information only after the required consent signal. The Privacy settings button reopens the consent message. Rejecting advertising does not prevent use of the site. Google and its partners are listed in that message, including their purposes and retention periods.

Newsletters and email records

Account login addresses are not automatically subscribed. We store newsletter choices, the notice version and wording shown, source, date of consent and withdrawal. Only you can opt in, through your authenticated account. Subscription requires an age of at least 16 in your profile. We use this information to manage the newsletter on the basis of consent; withdrawal takes effect in our list immediately. Only active subscriptions can be exported for a newsletter service. The operator must refresh exports before sending and synchronise withdrawals. Email addresses are not sold or provided for other companies’ own marketing.

Administration and measurement

Authorised administrators can search accounts and view their encrypted login address after decryption for administration, support and legitimate security needs. Roles, Pro grants, ranks, promo redemptions, account-list access and newsletter exports are logged. Login-mail records contain a pseudonymous email key, purpose, timestamp and transport result, not the message or login token. Transport acceptance is not delivery or opening. We do not add email tracking pixels. Partner-link measurement stores a daily count, without user IDs, IP addresses or email addresses in the click table; it is not a unique-visitor or sales report.

Creator AI

When an administrator enables Creator AI, public video metadata from configured YouTube channels is sent to the configured OpenAI API to classify career takeovers and draft original suggestions. We do not send login email addresses or account profiles. Drafts are stored privately with the source video link. Downloaded video descriptions are not retained in job logs; discovery IDs are cleared after 30 days of processing. AI suggestions remain until their owner deletes them. The operator must document its lawful basis, processor terms and any international transfers before activation. Creators may contact us to request correction or removal.

Recipients and external services

The hosting provider processes website data and technical logs; the configured email provider processes login emails. The current deployment is intended for STRATO hosting. Authorised administrators access data for operation and moderation. Any newsletter provider must act under a suitable processing agreement and must be identified in the deployment information before use. External sites have their own policies. Your browser may contact image sources where an external asset is used. Provider locations and any international-transfer safeguards must be confirmed in the operator’s deployment notice.

Email and administration retention

Login-mail records are pruned after 30 days on sending or scheduled maintenance. Admin audit logs are pruned after 365 days. Current consent evidence remains while subscribed; withdrawn consent records are pruned after two years. Account deletion removes newsletter records. Partner daily counts are kept for up to two years. These periods require the daily maintenance task to run; the operator monitors it. Downloaded newsletter lists must be deleted after use and within seven days. A newsletter service must apply matching withdrawal and deletion rules.

Retention

Account settings and saved content are retained while you keep the account and use those features, unless you remove them or ask for deletion. Archived challenge journals remain stored. Deleted comment text is removed from the live comment record. Resolved contact requests are eligible for deletion after ninety days and are removed on the next contact or request-management operation. Hosting log and backup retention depend on the operator’s configured policy. Security records are retained as needed for abuse prevention and incident handling; the operator must document the final periods before public launch.

Your choices and rights

You can edit your profile, change publication settings and remove supported saved items. Use the contact form to request access, correction, deletion, restriction or portability of your personal data, or to object where applicable. We may need proportionate information to verify the request. You may complain to your local supervisory authority, including the Dutch Autoriteit Persoonsgegevens.

Decisions and updates

Publication decisions in this release are reviewed by administrators. The platform does not make legal or similarly significant decisions about you solely through automated processing. This notice is updated when the service or its data practices change.