Effective date: 10 October 2026.
The Real MVP is operated by Renjy Razanavahy, individual, established at Carrer de Toledo 12, 08014 Barcelona, Spain. Data contact: admin@real-mvp.com.
This policy covers the Symfony application play.real-mvp.com and the WordPress editorial website real-mvp.com.
We process your login email, hashed password, account creation date and roles; your optional public name, favourite team and preferences; your Picks, changes and timestamped publications, Results and competition data, including MVP Coins records. Sessions may hold guest drafts, language and security information. Protection mechanisms also use technical data, including IP addresses and session or account identifiers.
Public WordPress registration is disabled. Settings permit comments on new posts: where a comment form is actually offered, it requests a name and email; content may become public after moderation. Comment and moderation notifications are enabled. Gravatar avatars are enabled in settings; actual loading must be checked on relevant pages. No contact-form plugin was identified in the installed list. No comments or posts were present in the administration inspected on 8 October 2026. Legal pages do not offer comments. If a new form or embedded service is enabled, this policy will be updated to describe its processing.
This information supports account management, Pick storage, competition features, their public presentation within the service and abuse prevention. The legal bases for each purpose and any relevant legitimate interests are: performance of the requested service for accounts, Picks and competition; legitimate interest in service security and abuse prevention; consent for optional Analytics measurement. Attribution is reviewed separately below. Required and optional data and the consequences of not providing them are: email and password are required to create an account; registration cannot complete without them. Public name, favourite team and preferences are optional. The service is intended for people aged 16 or older in the European Union. Current registration collects neither a date of birth nor proof of age; this access rule is not a technical age check.
Your public name or an opaque identifier may appear on public competition surfaces. Publishing a Pick creates a page accessible through its link. Your login email is not used as your public identity. To request correction or removal of published personal data, write to admin@real-mvp.com; requests are assessed under the rights procedure and applicable obligations.
A recognised acquisition link may store a source, medium, campaign, optional content and navigation context in the session only after your Analytics consent. This attribution measures the source of publications and relies on your consent. Without consent, it is not stored. Refusal or withdrawal immediately stops its use in the page and triggers session removal; if the cleanup request fails, the server removes it on the next request without consent. Granting consent again does not restore earlier attribution. After consent, the context expires within at most 30 days or after your next successful publication. Without attribution, /court offers the default challenge.
After your Analytics consent, Google Analytics 4 measures visits and the journey to publication. The five application events are sign_up_started, sign_up_completed, pick_started, pick_saved and pick_published. Properties are limited to Pick type, season and controlled attribution when present. No email, password, Pick content or application user identifier is added to these events. GA4 uses pseudonymous identifiers and browsing, device and location information, including city-level location. Google Signals and user-provided data collection are not enabled in the property inspected on 8 October 2026. These settings do not make the data anonymous.
Hosting is provided by Railway for the Symfony application and PostgreSQL, in US West, California, United States; Infomaniak for WordPress, on a shared Web Hosting plan. Google provides Analytics; Cloudflare provides services including Turnstile and backup storage. During registration, server-side Turnstile verification transmits a token and, when available, the IP address. Recipients and their roles are: Railway (application and database hosting), Infomaniak (WordPress hosting and the admin@real-mvp.com mailbox), Google (GTM and GA4), Cloudflare (Turnstile and R2) and CookieYes Limited (WordPress consent management and logging). R2 database backups are private; the console displays Western Europe (WEUR). This indication does not establish a European jurisdictional restriction. Identified providers are Railway Corporation (United States), Infomaniak Network SA (Switzerland), Cloudflare, Inc. (United States) and CookieYes Limited (United Kingdom). Google provides GA4 under its data processing terms. Providers and their subprocessors may process data outside the European Union. Processing locations and applicable transfer safeguards are: Railway, Cloudflare and CookieYes DPAs provide Standard Contractual Clauses for relevant transfers. Railway and Cloudflare also provide for the Data Privacy Framework where applicable. Google processing terms are accepted in the GA4 property. You can request relevant information and safeguards at admin@real-mvp.com. This description does not certify compliance of all processing.
Retention periods or criteria by category are: Owner-selected draft policy: accounts without participation, 3 months without activity; participating accounts, while active with review after 12 months of inactivity; Picks, versions and Results, the relevant season plus 3 months before deletion or anonymisation when the purpose ends; unused guest drafts, 30 days; routine logs, 30 days with justified incident exceptions; database backups, 30 rolling days. Current implementation: During this beta, automatic deletion corresponding to these targets is not fully implemented. Accounts and Picks currently remain in the database until deletion or anonymisation is performed. These targets therefore do not guarantee automatic purging when the periods end. Publication deletion and backup handling are: Requests are handled manually by the controller. Completed R2 backups currently have no automatic expiry; Railway and WordPress backups use separate mechanisms. Deletion from the active database does not immediately erase all backup copies. Their removal and prevention of reintroduction during restoration must be addressed as part of the request. The service automatically calculates Results, MVP Coins and rankings from Picks and competition rules. No real-money betting is offered.
Subject to applicable conditions, you may request access, rectification, erasure, restriction, portability or objection at admin@real-mvp.com. You may withdraw Analytics consent through “Manage cookies”. You may complain to the competent supervisory authority, including the AEPD where relevant. Request procedures and applicable deadlines are: Renjy Razanavahy handles requests. We normally reply within one month; a justified extension of up to two additional months, where GDPR conditions apply, is communicated within the first month. Proportionate identity verification may be necessary where there are reasonable doubts.
GA4 is configured to retain event and user data for 14 months. Reset on new activity remains enabled: new activity can extend retention of data associated with a user. Standard aggregated reports do not necessarily follow these periods.