Privacy policy

This Privacy Policy explains how RYSI Labs Pty Ltd, trading as Fanzava, handles personal information when you use the Fanzava platform. It applies alongside the Fanzava Platform Terms of Use.

1. Introduction and Our Roles

1.1 Who we are. Fanzava is a trading name of RYSI Labs Pty Ltd (ABN 99 692 790 435, ACN 692 790 435, “Fanzava”, “we”, “us”), of 228A St Vincent Street, Port Adelaide SA 5015, South Australia, Australia. RYSI Labs operates the Fanzava platform (the “Platform”). This Policy explains how we handle personal information.

1.2 Our two roles in handling your data.

(a) Fanzava as Data Controller. We collect and decide how to use a minimal set of personal information to secure the service, deliver platform-level features, prevent fraud and abuse, keep audit records, run our own platform analytics, and manage Hub Administrator accounts and billing. We are the Controller of that information. On Free Hubs we are the Controller of all participant information (see section 1.3).

(b) Fanzava as Data Processor. On paid Hubs (Starter, Growth, Pro, Scale, and Enterprise), the Hub Administrator is the Controller of your participant account for that Hub and of your competition-related data. They decide how that data is collected, used, exported, and shared. Fanzava processes that data on the Hub Administrator’s instructions. For questions about how a specific paid Hub uses your data, refer to that Hub’s Privacy Notice.

1.3 Free Hubs. Free Hubs are hosted on Fanzava-branded URLs (such as yourhub.fanzava.com) and may display advertising. On Free Hubs, Fanzava is the Controller of all participant information, including your account, your competition entries, and your Banter Board posts, and this Policy is the privacy notice for Free Hubs. Requests about your information on a Free Hub come to us (section 9.5). The Free Hub Administrator can see participant information to run the competition and can export a participant list; the Free Hub Admin Agreement limits their use of that information to running the competition, and they are responsible for any copy they export.

1.4 One account per Hub. Each participant account belongs to a single Hub. If you join more than one Hub, you hold a separate account in each, even if you use the same email address. Each account has its own sign-in, settings, and multi-factor authentication, and no Hub can see or change your account in another Hub. Your data for a Hub is stored in that Hub’s cell (see section 6).

2. Information We Collect as a Controller

Sections 2.1 and 2.3 describe participant account information. Fanzava is the Controller of that information on Free Hubs. On paid Hubs, the Hub Administrator is the Controller and Fanzava processes it on their behalf (see section 3); Fanzava remains the Controller of the security, abuse-prevention, and audit records described in sections 2.4 and 2.5.

2.1 Participant account data. To create a participant account on a Hub we require: email address (used for authentication and security alerts); display name (you choose); and timezone and locale. We do not require a phone number for ordinary participation; a phone number is processed only where you provide one for notifications or verification. We do not collect a postal address, government identifier, or special-category data as part of ordinary participation. Where you are asked to confirm your age or enter your date of birth at signup, we use it only to check that you meet the Hub’s minimum age. We record whether you meet it, and do not retain your date of birth.

2.2 Hub Administrator data. If you create or operate a Hub, we additionally collect business and operational information including: legal name of the Promoter or organisation, and any trading names; registered or business address and primary jurisdiction; administrator contact name, email, and phone number for support and billing; and billing details processed via our payment processor (see section 4).

2.3 Authentication data. The Platform supports email and password, magic link, and Google and Microsoft sign-in. On Enterprise plans, single sign-on (SSO) through your organisation’s identity provider is available from launch. The authentication layer stores password hashes (hashed with Argon2id), session and token identifiers, and, where you enable multi-factor authentication, time-based one-time password (TOTP) enrolment metadata. We do not retain your password in plain text at any time.

2.4 System, security, and abuse-prevention data. To operate, secure, and audit the Platform we automatically collect: IP address, and approximate geolocation derived from it; device and browser information (User Agent string); activity timestamps and event logs (login events, configuration changes, moderation actions); and referral and attribution data (UTM parameters, where supplied). We also collect bot-protection signals (browser and interaction signals processed by Cloudflare Turnstile) on the sign-up, sign-in, and password-reset forms to distinguish humans from automated traffic. Where we no longer need a record in identified form, we shred the IP address and other directly identifying fields so that the underlying record is anonymised but operationally useful. The retention periods for raw IP addresses and the anonymisation cadence are set out in section 7.

2.5 Compliance and audit data. To support the Platform’s clickwrap and attestation processes, we retain timestamps and IP addresses associated with key acceptance events, for example your acceptance of the Platform Terms of Use, your acceptance of a Hub’s Competition Terms, or (for Hub Administrators) the Promoter Attestation completed when launching a public competition. This data is retained as described in section 7.

2.6 Mobile application and push notifications. This section applies once the Fanzava mobile application is launched. If you use the Fanzava mobile application, we collect your device type and operating system version, and, where you enable push notifications, a push notification token. Push notifications are delivered through the Expo Push Service, with Apple and Google push services operating behind Expo. You can turn push notifications off at any time in your device settings.

3. Information We Process as a Processor (on Hub Administrator Instructions)

When you join a paid Hub, we process the following data on the Hub Administrator’s behalf: competition entries, tips, and bracket selections; group memberships and leaderboard positions; Banter Board posts and reactions; and prize-claim information you supply at the Hub Administrator’s request, which may include a postal address, identity verification, or tax information. We also process your participant account for that Hub (the information in sections 2.1 and 2.3) on the Hub Administrator’s behalf. On Free Hubs, Fanzava is the Controller of all of this information (see section 1.3).

The Hub Administrator decides whether and how this data is exported, retained, or used for marketing. To exercise rights regarding Hub-specific data, including marketing opt-out, deletion of competition history within a Hub, or data export to a third-party customer relationship management (CRM) system, contact the Hub Administrator directly using the contact information in their Hub Privacy Notice.

4. Sub-processors

To operate the Platform we share data with the following sub-processors. Each is bound by a data-processing agreement and processes data only on Fanzava’s instructions or under its own legal obligations. This list is kept consistent with Schedule 3 of the Fanzava Data Processing Agreement.

Sub-processor	Purpose	Data categories	Region
Cloudflare, Inc.	Application hosting, edge compute, storage, CDN, TLS, security (WAF and Turnstile), in-app analytics, and AI Round Recap generation (Workers AI, with no external AI provider)	All Platform traffic and configuration; for Round Recaps, round results, leaderboard data and participant display names	Global edge
Databricks, Inc. (Neon)	Primary PostgreSQL database	All Platform records: account, hub, and competition data	The Hub’s cell: Australia (Sydney), European Union (Frankfurt), or United States
Stripe, Inc.	Subscription billing and payments	Hub Administrator billing details; Fanzava does not receive card data	US / Global
Amazon Web Services (Simple Email Service)	Transactional and engagement email delivery	Email address, message content	The Hub’s email zone: Australia, United States, European Union, United Kingdom, or France
Expo (Expo Push Service) (from mobile app launch)	Mobile push notification delivery; Apple APNs and Google FCM operate behind Expo as Expo’s sub-processors	Device push token	US / Global
PostHog, Inc.	Product analytics and session replay (typed inputs masked)	Usage events and session recordings, including on participant pages	US
Microsoft Clarity	Web analytics and session replay on fanzava.com and Hub Administrator sign-up; not used on participant pages	Interaction and usage signals	US
Google Analytics 4 (Google LLC)	Web and product analytics on fanzava.com and Hub Administrator sign-up; not used on participant pages	Usage events and online identifiers	US / Global
Meta Platforms, Inc. (Meta Pixel and Conversions API)	Advertising analytics and conversion measurement on fanzava.com and Hub Administrator sign-up; not used on participant pages	Sign-up and conversion events and online identifiers	US / Global
Sentry (Functional Software, Inc.)	Error and performance monitoring	Stack traces, request metadata, redacted identifiers	US
Twilio Inc.	Messaging, for example SMS notifications and verification where a number is provided	Phone number where provided, message content	US / Global
Google Chat (Google LLC)	Hub chat and notification integration	Message content and participant display names	US / Global
Klipy (Kikliko, Inc.)	GIF search within the Banter Board (the member’s browser calls Klipy directly)	Search terms, IP address, browser User-Agent and a pseudonymous member identifier	Global
Sign-in providers: Google, Microsoft	Social sign-in, only where you choose to use it	Authentication identifiers	US / Global

Fanzava also uses business tools, including a customer relationship management system, to manage Hub Administrator and prospect relationships. Those tools process business-contact data (Hub Administrators and leads), not participant competition data.

This table is Fanzava’s current sub-processor list. Hub Administrators covered by the Fanzava Data Processing Agreement receive at least 30 days’ email notice of changes to it, as set out in that agreement.

5. Advertising

5.1 What advertising appears, and where. Advertising differs by plan:

(a) Fanzava house ads and third-party ads. Fanzava places its own promotional content (for example, Fanzava-product upgrade prompts and editorial content) on Free-Hub surfaces, and may also show ads from third-party advertisers, including through programmatic ad networks, in the same slots. All ads are labelled and appear only in designated ad slots.

(b) Self-serve creative on paid Hubs. Hub Administrators on paid plans (Starter through Scale) may upload their own creative assets to display within their own Hub. These are not third-party programmatic ads. Fanzava does not place external programmatic advertiser content on these tiers; programmatic advertising is available only on Enterprise Hubs, as described in (c).

(c) Programmatic advertising on Enterprise Hubs is available on request and configured under a separate Enterprise data-processing agreement that explicitly addresses the data flows involved.

5.2 What data feeds advertising on Free Hubs. Ads on Free Hubs, whether house or third-party, may use: Hub-level metadata (the sport configured for the Hub, the Hub Administrator’s plan tier, the Hub’s broad locale derived from the Hub Administrator’s selected region); your locale and timezone; and aggregated, non-identifying engagement signals at the Hub level. Fanzava does not use your email address, identity, fine-grained IP geolocation, or Banter Board content to personalise advertising. We do not share your name, email address or account details with advertisers.

5.3 Programmatic advertising on Free Hubs is contextual only. Ads on Free Hubs may be served through programmatic ad networks. These ads are selected based on the page and the Hub’s sport, not on your personal profile or browsing history. To deliver an ad, the ad network receives limited technical information such as your IP address and browser or device information. Analytics and session-replay technologies used across the Platform are described in section 10, and any tracking a Hub Administrator configures within their Hub is covered by that Hub’s own notice (section 5.5).

5.4 Selling and sharing. Fanzava does not sell your personal information for money. Fanzava does use analytics and advertising technologies described in section 10 (for example Google Analytics 4 and the Meta Pixel) that may share limited online identifiers with those providers. The California Consumer Privacy Act and California Privacy Rights Act apply only to businesses that meet certain thresholds (such as annual revenue over US$25 million or data on more than 100,000 California consumers); Fanzava does not currently meet any of them, so those laws do not presently apply to Fanzava. If they apply in the future, we will provide the corresponding consumer rights, including any required opt-out of “sharing” for cross-context behavioural advertising.

5.5 Hub-configured analytics and tracking. Hub Administrators on paid plans may configure their own analytics or tracking tools (for example a Meta Pixel or Google Analytics) within their Hub. Where they do, that data is collected under the Hub Administrator’s own Privacy Notice, and the Hub Administrator is the Controller for it; Fanzava acts only as processor.

6. International Data Transfers

Fanzava is an Australian business. The Platform runs in regional cells in Australia (Sydney), the European Union (Frankfurt), and the United States. Each Hub is placed in one cell, and that Hub’s participant accounts, competition data, and related records are stored in that cell’s database. Fanzava places each Hub in the nearest cell when the Hub is created, based on where it is set up; Enterprise customers can choose their cell. The Platform is delivered through Cloudflare’s global network, and some sub-processors process data outside the Hub’s cell, as shown in section 4. Some operational data, such as cached content, short-lived files, and participant list exports, is held in Cloudflare’s key-value storage, which is replicated across Cloudflare’s global network rather than kept in the Hub’s cell. Where data is transferred across borders, we rely on Standard Contractual Clauses (SCCs), the UK International Data Transfer Addendum, the EU-US Data Privacy Framework where applicable, and equivalent mechanisms appropriate to the destination.

7. Retention

We retain personal information only as long as needed for the purpose for which it was collected, except where a longer retention is required by law or to demonstrate compliance.

Data category	Retention period
Account profile (email, display name)	Life of the account; removed on closure per section 9.2. Each account belongs to one Hub. On paid Hubs, held on the Hub Administrator’s instructions.
Authentication logs (login events, in identified form)	12 months. After that period, the IP address and other directly identifying fields are shredded; the anonymised log entry is retained for security analysis and capacity planning.
Raw IP address in security and abuse-prevention logs	90 days in identified form. After 90 days, the IP address is shredded; the surrounding record is anonymised and retained for ongoing abuse-prevention and integrity analysis.
UTM and attribution data	Pseudonymised at collection; aggregated after 90 days.
Audit-log events (clickwrap and Promoter Attestation)	Retained for 7 years to evidence consent and Promoter responsibility. After the underlying account is removed, the IP and email fields in these records are shredded; the timestamp, document version, and an opaque account token remain. See section 9.3.
Backups	Point-in-time recovery (PITR) backups are retained for 14 days, then age out. There is no separate staged backup-scrub process; personal data in backups ages out with the PITR window.
Analytics data	Held for the life of the Hub and deleted with it.
Hub competition data	Paid Hubs: controlled by the Hub Administrator; Fanzava holds it on the Hub Administrator’s instructions. Free Hubs: held by Fanzava for the life of the Hub, subject to the inactive Free Hub schedule below, except that tips, entries and leaderboards from completed competitions are deleted 183 days after the competition ends, unless the Hub has held a paid plan, Season Pass or Bracket Pass.
Inactive Free Hubs	Where neither the Hub Administrator nor any participant has signed in or taken any action in a Free Hub (automated activity such as scoring, automatic picks, and scheduled emails does not count), measured from the last such activity and at the earliest: an email warning to the Hub Administrator at 60 days; the Hub is archived and taken offline at 90 days, with an email to the Hub Administrator; it is marked for deletion at 120 days; and the Hub, its competition data, and the participant accounts held in it are permanently deleted at 150 days. The Hub Administrator can bring an archived Hub back by signing in and choosing to reactivate it before day 120, or ask us to restore it between day 120 and day 150. Backups age out within 14 days after deletion. This schedule does not apply to a Hub that has ever held a paid plan, Season Pass or Bracket Pass.

8. Children’s Privacy

Fanzava is intended for users aged 13 and over. You must be at least 13 years old to create an account or participate in a Hub. We do not knowingly collect personal information from anyone under 13; if we discover an account held by someone under 13, we will delete it. If you believe someone under 13 has provided personal information to us, contact privacy@fanzava.com.

9. Your Privacy Rights

9.1 Your rights. Depending on your jurisdiction, you may have rights including the right to access, rectify, erase, port, restrict processing of, or object to the processing of your personal information.

9.2 Closing your account or deleting your information. Each account belongs to one Hub, so these actions apply in that Hub only. If you hold accounts in other Hubs, act in each separately. On paid Hubs, we carry these out on the Hub Administrator’s behalf. You have two options:

(a) Close your account. You are signed out, can no longer sign in, and are removed from the Hub’s leaderboards straight away. For 30 days you can cancel, and your account, memberships, and entries are restored. At the end of the 30 days, your email address, real name, and sign-in records are deleted. Your display name stays on past round results, and your tips and results are kept without your contact details, so that other participants’ scores and the Hub’s history stay correct.

(b) Delete your information. Everything in (a), plus your display name is removed from all past results and leaderboard records, so nothing retained can be linked to you. The same 30-day window applies. A deletion request made to us or to a Hub Administrator is treated as this option.

Point-in-time backups age out within 14 days and are used only for disaster recovery, never to restore a deleted account.

Under option (a) we keep your display name on past results, and under both options we keep de-identified tips and results, because they continue to serve legitimate purposes (Hub Administrator reporting, platform-integrity analysis, abuse-prevention modelling). The audit-log carve-out described in section 9.3 is a narrower retention category that retains a small set of fields for evidentiary purposes.

9.3 Audit-log retention. As noted in section 7, we retain a minimal record of your acceptance of the Platform Terms of Use and this Privacy Policy (timestamp, document version, and an opaque account token after closure) for 7 years, in case we need to demonstrate that consent was obtained or that a Promoter completed the required attestation. After your account is closed, the IP address and email address fields in these records are shredded along with your other identifying data; the timestamp, document version, and opaque token remain. These records are not used for any other purpose.

9.4 Hub-controlled data. If your request relates to data under a paid Hub Administrator’s control, for example your account on a paid Hub, your tipping history within a specific paid Hub, or your inclusion in a Hub Administrator’s CRM, contact the Hub Administrator using the details in their Hub Privacy Notice. We will help you identify the right contact if needed. On Free Hubs, Fanzava is the Controller of all participant information, so contact us directly (section 9.5).

9.5 How to exercise your rights. Contact privacy@fanzava.com or write to: RYSI Labs Pty Ltd (Fanzava): Privacy, 228A St Vincent Street, Port Adelaide SA 5015, South Australia, Australia. We respond to verified requests within 30 days.

9.6 Complaints. If you believe we have not handled your personal information appropriately, you may complain to us first using the contact details above. You may also complain to the Office of the Australian Information Commissioner (oaic.gov.au) or to the privacy regulator where you live, including your local supervisory authority if you are in the EU or UK.

9.7 Data breach notification. If a data breach involving your personal information is likely to result in serious harm, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and any other regulator where required by applicable law.

10. Cookies and Similar Technologies

10.1 What we use, and why. The Platform and Fanzava’s websites use cookies and similar local-storage technologies for: essential functions (authentication, session management, and security such as cross-site request forgery protection), without which the Platform cannot operate; product and web analytics, including session-replay tools (for example Microsoft Clarity and PostHog) that record on-page interactions; and, on the sign-up and marketing surfaces, advertising and conversion technologies (for example Google Analytics 4 and the Meta Pixel). The sub-processors behind these are listed in section 4.

10.2 How consent is given. Essential cookies do not need consent. For analytics and advertising technologies, what happens depends on where you are. If you are in the European Economic Area, the United Kingdom or Switzerland, or we cannot tell where you are, they stay off until you choose Accept in the cookie notice, and Reject keeps them off. Everywhere else, including Australia, they run by default and no notice is shown, and you can switch them off at any time (section 10.3). We work out where you are from your connection and keep the result in a cookie (fz_region) for 30 days. Your choice is kept in a cookie (fz_consent) for six months and applies across fanzava.com, docs.fanzava.com and the Platform. Do Not Track browser signals are not currently acted on.

10.3 Changing or withdrawing consent. You can change your choice at any time using Cookie preferences in the footer of any page, which reopens the cookie notice. Choosing Reject turns analytics and advertising technologies off and deletes our analytics identifier and any HubSpot cookies. You can also configure your browser to refuse cookies, or close your account (see section 9.2). Refusing essential cookies will prevent the Platform from functioning correctly.

10.4 Browsing without an account. Marketing and documentation pages on fanzava.com and docs.fanzava.com that do not require sign-in use essential cookies plus analytics and advertising technologies (for example Microsoft Clarity, PostHog, Google Analytics 4, and the Meta Pixel). Analytics and advertising technologies follow the consent rules in section 10.2. No personal account is required to view these pages.

11. Changes to This Policy

We will update this Policy from time to time. For material changes, we will email registered users and post a change notice on the Platform at least 14 days before the change takes effect.