YOUR DATA. CLEAR RULES.

01Scope and our role

Instinct XI is a trading name of M2FT Ltd. M2FT Ltd is the data controller for the Instinct XI website, manager accounts, Fantasy XI, virtual Market, Matchday, leagues, notifications, support and Instinct IQ features.

This policy applies to signed-out visitors and registered managers. It does not cover websites or services operated independently by another organisation.

02Information we collect

• Account and identity information, including first name, verified email address, authentication identifier and date of birth.
• Game information, including club name, squad, lineups, captaincy, leagues, virtual holdings, trades, achievements, scores and account preferences.
• Technical and security information, including device/browser information, session data, coarse request information, rate-limit fingerprints, service events and error logs.
• Communications information, including support requests and notification preferences.
• Subscription information if Pro billing is activated, including Stripe customer and subscription references, status and billing events. Instinct XI does not store full payment-card details.
• Instinct IQ questions, relevant game context, responses and limited usage records when a manager deliberately uses that feature.

03Why we use information

• To create and authenticate accounts, provide the game, save progress and perform our contract with managers.
• To calculate scores, virtual prices, standings, achievements and enforce game integrity.
• To provide requested support and account communications.
• To deliver optional push notifications after device permission and account opt-in.
• To protect the service, prevent fraud, abuse, duplicate accounts, automation and security incidents under our legitimate interests.
• To administer Pro billing if activated, meet accounting obligations and handle consumer requests.
• To improve reliability using limited service analytics. We do not sell personal information or use it for third-party behavioural advertising.

04Children and age-appropriate use

Instinct XI manager accounts are available from age 13. We collect date of birth to apply age-appropriate access. Managers aged 13–17 receive the free core game only and cannot purchase Instinct XI Pro or enter a future real-world prize promotion.

Dates of birth, email addresses and real names are not displayed to other managers. League-facing identity is based on the manager’s chosen club name. We do not request precise location, enable targeted advertising or ask children to weaken privacy settings. Push notifications begin off and require an account choice plus device permission. A parent or guardian can contact us about a child’s account through Help & Support.

A shorter explanation written for ages 13–17 is available in Privacy for Young People. M2FT Ltd maintains a children’s privacy impact assessment and reviews it when the service changes.

05Who receives information

• Supabase for standalone authentication and verified account sessions.
• Cloudflare and OpenAI’s Sites infrastructure for hosting, security and persistent application storage.
• OneSignal for optional web-push delivery after opt-in.
• Stripe for subscription checkout, billing and account management if live Pro billing is activated.
• OpenAI’s API for a manager’s Instinct IQ request and the minimum relevant game context when live inference is enabled and used.
• Professional advisers, regulators, courts or law-enforcement bodies where reasonably necessary or legally required.

06Football data

Sportmonks supplies football fixtures, lineups, events and player statistics used by the game. Instinct XI normally sends provider identifiers and fixture requests—not manager account information—to retrieve this data.

07Cookies and similar technologies

We use essential authentication and security storage to keep managers signed in and protect requests. OneSignal may use device identifiers when a manager enables push notifications. The landing page records limited, pseudonymised interaction events for reliability and product measurement; it does not use an advertising cookie profile.

Where a non-essential technology requires consent, it will not be enabled for that purpose until valid consent is obtained.

08Retention

Account and gameplay records are kept while an account is active so the game can preserve squads, trades, scores and competition history. After a verified closure request, directly identifying profile information is scheduled for deletion or anonymisation within 30 days unless it must be retained for security, dispute, legal, accounting or game-integrity purposes. Residual encrypted backups are allowed to expire through the normal backup cycle rather than being restored for ordinary use.

Billing and accounting evidence is normally retained for six years after the relevant financial period. Security and service logs are retained only for the documented operational period, normally no more than 12 months unless an incident, dispute or legal duty requires longer. Support, scoring and transaction evidence may be anonymised and retained where it remains necessary to protect other managers and the integrity of settled competitions.

09International processing and security

Some service providers may process information outside the United Kingdom. Where required, we use recognised safeguards such as adequacy regulations or approved contractual protections.

We use access controls, encrypted connections, restricted administration, request validation, audit records and data minimisation. No online service can promise absolute security, but suspected incidents are assessed and notified where the law requires.

10Your rights

• Ask for access to your personal information or download the in-app personal-data export.
• Ask us to correct inaccurate information.
• Ask for deletion, restriction or portability where the relevant right applies.
• Object to processing based on legitimate interests or withdraw consent without affecting earlier lawful processing.
• Complain to the UK Information Commissioner’s Office at ico.org.uk. Please contact us first if you would like us to resolve the issue directly.

11Changes and contact

We may update this policy when the product, providers or law changes. Material changes will be presented in the service before they take effect where appropriate, and the version accepted at registration is recorded.

Submit a privacy or account request through Help & Support while signed in. If you cannot sign in, write to M2FT Ltd at the registered office shown above and identify the email address connected to your Instinct XI account. Do not send passwords or full payment-card details.