Privacy policy

PEPs ("we", "our") is a prediction service for the 2026 FIFA World Cup operated by Matos SRL, a Belgian limited liability company registered with the Crossroads Bank for Enterprises (BCE), headquartered in Belgium. This policy explains what personal data we collect when you use peps.football, why we collect it, and what your rights are. For any question, write to us at studio@matco.tv.

We follow a data-minimization principle. PEPs only collects:

• Your email address (to sign you in via magic link and to send recap emails).
• Your display name and public handle, chosen at sign-up.
• A profile picture, if you upload one (optional).
• Your predictions, any changes you've made, and the leagues you belong to.
• Your notification preferences, and the push tokens of your devices if you enable notifications.
• Standard server logs (IP address, user agent, timestamps) for security and abuse-prevention purposes.

We do not ask for your date of birth, phone number, postal address, or detailed payment information. If we ever turn on payments, they will go through a provider (Apple, Google, or Stripe) which handles its own payment data — we do not store your card numbers.

We process your data on three bases:

• Consent — when you create an account and agree to receive service-related emails.
• Contract performance — to operate the game itself (record your predictions, compute your points, display the leagues you join).
• Legitimate interest — for security server logs, to prevent abuse, and to safeguard the integrity of the service.

• Run PEPs: record your predictions, compute points, rank leagues.
• Send the emails and notifications you have opted into (round recaps, sign-in magic link, Changes window).
• Detect and prevent abuse, spam, and result-manipulation attempts.
• Understand, in aggregate, how the service is used in order to improve it.

We do not sell your data. We do not track you outside of PEPs. We do not use your data for behavioral advertising.

We rely on infrastructure providers that host or transmit your data on our behalf:

• Cloudflare — content delivery network (CDN) and DDoS protection.
• Railway — hosting for the web app and the PostgreSQL database.
• Resend — delivery of transactional emails (magic link, recaps).
• Cloudflare R2 — file storage (avatars), when this feature is enabled.
• Sentry — error monitoring, when this feature is enabled.
• Apple Push Notification service and Firebase Cloud Messaging (Google) — push notification delivery, when you enable them.

Each of these providers is bound by a data-processing agreement and only processes your data on our instructions.

We retain your data while your account is active. If you delete your account from the Profile screen, we remove your email address and mark the account as deleted immediately; associated data (predictions, league memberships) is kept in anonymized form for 30 days then deleted permanently. Server logs are retained for at most 90 days.

Under the GDPR, you have the following rights regarding your data:

• Right of access — to know what data we hold about you.
• Right of rectification — to correct inaccurate data (you can edit your display name and handle directly in the app).
• Right to erasure — to delete your account (available under Profile → Delete my account).
• Right to data portability — to receive your data in a machine-readable format, on request.
• Right to object — to object to processing based on legitimate interest.
• Right to lodge a complaint — with the Belgian Data Protection Authority (APD/GBA): autoriteprotectiondonnees.be.

To exercise these rights, write to studio@matco.tv. We respond within one month.

PEPs uses only cookies that are essential to operating the service: a session cookie to keep you signed in, and a language preference cookie (peps_locale). We do not use advertising trackers or third-party behavioral analytics.

PEPs is not intended for children under 16. We do not knowingly collect personal data from minors. If you believe a minor has signed up, contact us at studio@matco.tv and we will delete the account.

We may update this policy. The last-updated date appears at the top of this page. For substantial changes, we will notify you by email before they take effect.

For any question about this policy or your data, write to studio@matco.tv. Postal address: Matos SRL, Belgium (full address available on request, in line with our BCE registration).