Privacy Policy

Introduction

At GoalStacker, your privacy is important to us. This Privacy Policy explains what data we collect, how we use it, and your rights under the UK General Data Protection Regulation (UK GDPR).

Who We Are

This service is operated by GOALSTACKER LTD, a company registered in England and Wales.
Company No: 16502515
Registered Office: 819 Manchester Road, Rochdale, OL11 3AH
We have not appointed a Data Protection Officer as we are not legally required to do so under Article 37 of UK GDPR.

Eligibility

GoalStacker is intended for users aged 18 or older. By registering an account, you confirm you are at least 18 years of age. We do not knowingly collect personal data from anyone under 18. If we discover such data, it will be deleted.

Data We Collect

• Email address
• Username
• Hashed password
• IP address
• Browser and device type
• Age (as a number)
• User role/permission
• Subscription status
• Session/authentication cookies

How We Collect Data

• When you register or interact with our site
• During your subscription process via Stripe
• Through automatic backend systems for logging and security
• Via cookies used for authentication and session management

Lawful Basis for Processing

We rely on the following lawful bases:

• Contractual necessity: To manage accounts and subscriptions
• Legitimate interest: Platform security and UX improvements
• Legal obligation: Compliance with financial and fraud laws
• Consent: Optional tracking (when introduced)

How We Use Your Data

• To manage your account and subscription
• To secure and monitor platform use
• To process payments via Stripe
• To improve user experience

Cookies and Tracking

We use essential cookies for authentication. If analytics or marketing cookies are introduced, you will be asked for consent through a cookie banner. These rules apply to any future mobile or cross-platform apps as well.

Data Sharing

We may share data with the following third parties:

• Stripe � payments and fraud protection
• SendGrid � transactional email
• Cloudflare � security and DDoS protection

Some data may be processed outside the UK. We use appropriate legal safeguards like SCCs for international transfers.

Data Retention

Data is retained during your account�s lifetime and up to 6 years after cancellation to meet legal and security requirements. You may request deletion when legally permissible.

Your Rights

Under UK GDPR, you may:

• Access or correct your data
• Restrict or object to processing
• Request deletion (when legally allowed)
• Request portability
• Lodge a complaint with the ICO: ico.org.uk

International Data Transfers

Transfers outside the UK are safeguarded using Standard Contractual Clauses (SCCs), adequacy decisions, or binding agreements.

Automated Decision Making

GoalStacker does not use automated profiling or decision-making systems.

Security

We apply industry best practices for account and data security, including hashed passwords, Stripe-secured payments, and platform monitoring.

Security Disclosure

If you find a security issue, please report it to: [email protected]. Do not share it publicly until we�ve addressed it.

Contact

For privacy concerns or requests, contact: [email protected]