Privacy policy

Last updated: 30 August 2026

1. Who we are

MercatoPeak ("we", "us") operates the mercatopeak.com website and application. The operator's identity and contact details are in the Legal info page. For any privacy matter, write to hello@mercatopeak.com.

2. What we collect, and why

• Account data — your name, email address and a hashed password (or your Google account's verified email if you sign in with Google). Needed to create and secure your account. Legal basis: performance of contract.
• Subscription and billing data — handled by our payment processor (Stripe); we never see or store full card numbers. Legal basis: performance of contract and legal obligations.
• Your club workspaces — the squads, scenarios, notes and figures you create in the app. They exist so the product works; they are yours, private to you (or, on the Club tier, to the members your club invites).
• Technical data — server logs (IP address, time, request) kept briefly for security and abuse prevention. Legal basis: legitimate interest.

3. What we do NOT do

• We do not sell your data, ever.
• We do not run advertising or share your data with ad networks.
• We do not read your private club workspaces except when you explicitly ask for support on them, or where the law requires it.

4. Cookies and local storage

The app uses browser local storage for your session token and working data (so your work survives a refresh). The marketing site sets no tracking cookies. If we ever add analytics, it will be privacy-respecting and disclosed here first.

5. Football data

Squads, contracts and match statistics shown in the product concern professional athletes in their public, professional capacity and come from licensed data providers. Valuations and verdicts are our own editorial estimates computed from that data.

6. Where your data lives, and who helps us

We use vetted processors to run the service — hosting and databases (currently Vercel and Upstash), email delivery (currently Resend), sign-in (Google, only if you choose it) and payments (Stripe). Each processes data only on our instructions. Some processors operate in the United States under the EU–US Data Privacy Framework or standard contractual clauses.

7. How long we keep it

Your account and workspaces are kept while your account exists. Delete your account and they are removed from production systems within 30 days, backups within 90. Invoices are kept as long as tax law requires.

8. Your rights (GDPR)

You can ask for access to, correction of, export of, or deletion of your personal data, object to or restrict processing, and complain to your supervisory authority (in Croatia: AZOP). Write to hello@mercatopeak.com — we answer within 30 days.

9. Children

MercatoPeak is not directed at children under 16, and we do not knowingly collect their data.

10. Changes

If this policy changes materially, we tell you by email or in the app before the change takes effect.