Approved for UK beta
Privacy Policy
1. Controller and contact
Mughal 42 Limited (company number 16605168), trading as Drafted, is the controller. Registered office: 49 Valley Road, Chandler’s Ford, Hampshire, United Kingdom, SO53 1GS. Contact drafted@mughal42.com.
2. Information we use
- Account data: email address, username, user ID, verification and account status.
- Game data: lobby membership, draft choices, line-ups, scores, power-ups, substitutions, results, rankings, rewards, wallet ledger, Collection Book, pack receipts and trades.
- Communications and safety data: support messages, chat content, reports, moderation and enforcement records.
- Device and technical data: notification tokens, browser/device information, IP-derived security signals, timestamps, diagnostics and authentication/security logs.
- Transaction data for purchases: product, price, currency, payment status, Stripe identifiers, receipts, refunds and disputes. Stripe handles full payment-card details; Drafted stores transaction references, not your full card number. We also record the policy versions you accepted, server-recorded acceptance time, eligibility declarations and any separate digital-delivery consent.
3. Why we use it and lawful bases
| Purpose | Lawful basis |
|---|---|
| Create and secure accounts; deliver lobbies, scoring, cards, rewards and support | Contract |
| Prevent fraud, cheating, abuse and service failures; diagnose and improve performance | Legitimate interests in operating a safe, fair service |
| Accounting, consumer-rights and legal records | Contract and legal obligation |
| Optional push notifications or marketing | Consent where required; users can switch these off |
| Handle legal claims and regulator requests | Legal obligation and legitimate interests |
4. Where information comes from
Most data comes from you and your use of Drafted. Authentication, payment and device data may come from our service providers. Fixture, team, line-up and match-event data comes from football-data providers; when combined with your account activity it may form part of your game record.
5. Who receives it
We may use vetted providers for cloud hosting, authentication, databases, notifications and diagnostics (including Google Firebase/Google Cloud); payments and fraud prevention if activated (Stripe); football data; customer support; and professional legal, accounting or security services. We may disclose information where law requires it or as part of a properly managed business transfer. We do not sell personal data.
6. International transfers
Some providers may process data outside the UK. Where personal data is transferred to a country without UK adequacy regulations, we require an appropriate safeguard such as the UK International Data Transfer Agreement or UK Addendum and assess the transfer where required. Contact us for information about the safeguard relevant to your data.
7. Retention schedule
| Record | Period |
|---|---|
| Active account/profile | While the account is active |
| Deletion request and removable profile data | Delete or anonymise within 30 days, subject to required exceptions |
| Game, wallet, purchase, refund and prize audit records | Up to 6 years where needed for contracts, tax, disputes or fraud prevention |
| Support and safety cases | 2 years after closure, longer only for an active dispute or legal need |
| Routine security/diagnostic logs | Up to 12 months unless needed for an incident |
| Notification delivery records | Up to 90 days; device tokens until disabled, invalid or the account is deleted |
8. Your rights
Depending on the circumstances, UK data protection law may give you rights to access, correct, erase, restrict or port your data, and to object to processing. Where processing relies on consent, you may withdraw it. You may also complain to the UK Information Commissioner’s Office. Contact us first if you would like us to investigate.
9. Age restriction
Beta registration is limited to UK residents aged 18 or over. We record the user’s eligibility declaration but do not collect a full date of birth. If we learn that an account belongs to someone under 18, we may restrict the account and delete or retain information as required by law, safety and our documented retention rules. Contact us if you believe an under-18 has registered.
10. Cookies, local storage and notifications
Drafted uses storage needed for sign-in, security, account state and core app operation. Any non-essential analytics, advertising or similar technology must be listed and, where required, remain off until the user consents. Push notifications are optional and can be disabled in Drafted or device settings.
11. Security and automated decisions
We use access controls, authenticated backend actions, audit ledgers and monitoring designed to protect accounts and game integrity. No system is completely secure. Drafted may use automated rules to score games, detect invalid activity and rank players; material enforcement decisions should offer human review through support.
12. Updates and contact
Material new uses will be explained before they begin and policy updates will be versioned. For privacy questions, rights requests or deletion, email drafted@mughal42.com. You may complain to the UK Information Commissioner’s Office at ico.org.uk. Do not send passwords, codes or full card details.