FOUR STANDS — PRIVACY NOTICE Version 2026-09-06-v2 | Effective 6 September 2026 1. Who is responsible Lewis McColl, trading as Four Stands, is the controller responsible for personal information used to operate fourstands.co.uk. This notice covers the website and its home-screen web-app experience. For privacy questions, account closure and data-rights requests, email privacy@fourstands.co.uk or use our contact form. 2. Information you provide Account information includes first and last names, date of birth, display name, email, authentication information and the terms version and acceptance time recorded at signup. Supabase handles password authentication; your password is not displayed in your profile. Profile information includes your chosen club, appearance settings, optional telephone number and optional postal address. Address fields currently store information you choose to put in your profile; there is no delivery or location-tracking feature using them. You can leave them blank or remove their contents. We also store separate email and text marketing choices and the recorded time/version of changes. Your Groundhopper Passport can contain planned and visited grounds, visit dates, ratings, notes and checklist entries you choose to save. Problem reports contain the name, email, category, message and affected page you submit. The form does not take a screenshot. It stores the page path without its query string or fragment, which may contain private values. Please do not include passwords, payment details or unnecessary information about other people. 3. Technical information and external resources Hosting, authentication, email and security services process technical information needed to deliver requests, such as IP addresses, request details and browser/device information. To limit repeated reports, the report endpoint stores a daily changing hash derived from an IP address, or an email fallback if the address is unavailable. This field does not store the raw IP address, although hosting and security providers can process IP addresses separately. Your browser can contact external providers when loading images or crests, following publisher links, or using the direct football-data fallback. Those providers receive connection information and may handle it under their own privacy notices. 4. Why information is used Accounts and requested features: information necessary to provide account access, confirmation/recovery emails, cloud sync and Passport functionality is used to perform our agreement with you. Account administration, profile preferences and the 16+ rule: we rely on legitimate interests in operating the service, administering the profile you choose to maintain and applying its eligibility rule. The age check uses the date you enter; it is not independent identity or age verification. Optional profile contact fields are not required for browsing or core football features. Security: legitimate interests in protecting visitors and the service support authentication, CAPTCHA where enabled, submission limits and investigating misuse. Support: legitimate interests in investigating faults and responding to visitors support handling contact messages. Performance of our agreement can apply where a request is necessary to support an account feature. Promotional email and text: we rely on your separate consent for the channel you choose. Account creation and accepting the terms do not give marketing consent. Legal matters: information may be processed to meet a specific legal obligation or, where appropriate, for legitimate interests in establishing, exercising or defending a legal claim. We consider the purpose, necessity and effect on your rights when relying on legitimate interests. 5. Required information and choices Signup requires first and last names, date of birth, display name, email, a password and agreement to the terms. The form will not create an account without the required details or with an entered age under 16. Public browsing remains available without an account. Contact numbers, postal addresses and marketing choices are optional. The report form asks for your name, email and a message so a problem can be investigated and followed up. Sending a report does not subscribe you to marketing. 6. Marketing preferences Email and text marketing are separate choices and start unticked. You can withdraw either choice in Profile and save the change. Withdrawal does not affect the lawfulness of earlier processing based on consent. Marketing choices are stored separately from essential confirmation, security and password-recovery messages. Optional marketing is not required to use the account. Before promotional sending begins, messages must have a working opt-out route and withdrawals must be respected. A minimal suppression record may be retained to prevent further marketing after an opt-out. 7. Providers and sharing OpenAI Sites and Cloudflare infrastructure provide website hosting and site storage, including the private problem-report database. Supabase provides account authentication and stores synced account/profile and Passport data. Resend sends transactional account emails. Cloudflare Turnstile processes security challenges on the forms where it is enabled. These services receive information needed for their functions; not every provider receives every profile field. Publishers and external image or data providers may receive information when your browser connects to them. Four Stands does not sell your profile information or treat a marketing opt-in as permission for third-party marketing. Information may also be disclosed when required by law or where reasonably necessary to investigate fraud, address security risks or handle legal claims. 8. Processing locations The services used by Four Stands operate infrastructure in multiple countries. This notice does not promise that all processing stays in the UK. We have not yet confirmed a complete account-specific list of processing locations and international-transfer arrangements for every provider. Use the privacy contact form to ask about processing locations or safeguards. This section will be updated as those arrangements are verified; it should not be read as confirmation that a particular international-transfer mechanism has already been checked. 9. How long information is kept Account/profile and Passport data remain stored while you use the account, unless removed through the available controls or following a request. The current service has no automatic deletion rule for inactive authentication accounts. Problem reports are saved in private site storage and remain there until manually deleted. There is currently no automatic time-based deletion of reports or their associated abuse-control hashes. Retention decisions must consider whether a report is still needed to resolve an issue, prevent abuse or deal with a legal claim; storage without a time limit is not a reason to keep information that is no longer needed. Marketing preference and acceptance records remain associated with the account unless changed or deleted. Any retained consent or suppression evidence should be limited to what is needed to respect choices and address disputes. Hosting/authentication logs and backups can have separate provider retention settings. Those exact periods have not yet been verified for every service. We cannot promise immediate removal from every backup when an active record is deleted. You can ask for the retention information relevant to your request. 10. Cookies and browser storage Four Stands uses browser storage for sign-in sessions, club/appearance choices and locally saved Passport data. A service worker caches a small offline page and icons. Its current configuration does not cache account pages, API responses or live scores. Clearing site data can sign you out and remove unsynced local entries. Cloud copies can remain until deleted separately. Cookies, local storage and offline caches are different ways information can be held on your device. Turnstile and hosting/security services process technical signals and may use storage according to their configuration. The current application does not have a configured advertising or audience-analytics integration. Any future non-essential tracking will require a fresh assessment and appropriate information and controls. 11. Your rights Depending on the circumstances and lawful basis, you may request access, correction, erasure, restriction or portability of personal information. You can object to processing based on legitimate interests and to direct marketing, and withdraw consent where it is relied upon. These rights have conditions and are not all absolute. Use the contact form to make a request. We may ask for proportionate information to verify your identity, but do not send your password. Requests must be handled within the applicable legal time limit, normally one month, with any permitted extension explained where relevant. You can raise a concern with the UK Information Commissioner’s Office without contacting us first. Its complaints service is available at ico.org.uk/make-a-complaint/. 12. Deleting data and closing an account The current Delete cloud data control removes synced profile/Passport records and clears specified profile metadata. It does not close the Supabase authentication account. Browser copies and separately held reports are also outside that control. For full account closure or a broader erasure request, use the contact form. Any information that must lawfully be retained will need to be considered separately. Deleting a local browser copy does not itself delete a synced cloud copy. 13. Age checks and updates Accounts are intended for people aged 16 and over. Contact us if you believe an account belongs to a younger child. Automated checks include the entered-date age check, CAPTCHA and report-submission limits. If one appears to block you incorrectly, use the contact form for help. This notice will be updated when purposes, providers or features change. Important changes will be brought to users’ attention where required. An unrelated earlier marketing choice will not be treated as permission for a new purpose.