How we handle & protect your data

Privacy Policy

Version 2026-08-16.

This policy explains what Free Float Analytics collects and how it is used. We keep data in our own systems and do not sell it.

Who is responsible for your data

The data controller is Free Float Analytics, LLC, West Hartford, Connecticut, USA. For any privacy question or to exercise your rights, contact matt@freefloat.llc or use Your data & privacy rights.

What we process, why, and our lawful basis

For visitors in the EU/UK, the table below states, for each category, what we collect, why, the lawful basis we rely on, how long we keep it, who can see it, and whether it leaves the region.

Category	Why	Lawful basis	Kept	Shared / region
Account (email, display name, password hash)	Create and operate your account	Contract	While your account is active, until you delete it	Internal only · stored in the U.S.
Product-usage analytics (sign-ins, pages, searches, exports, game actions)	Operate, secure, and improve the service	Legitimate interest	While your account is active	Internal only · not sold · U.S.
Security & traffic logs (IP, approximate country, path/method/status, browser)	Security, abuse and scraper detection	Legitimate interest	90 days, then auto-deleted	Internal only · not sold · U.S.

Only the account data rests on contract; the analytics and security logging run on legitimate interest (kept to the minimum needed to operate and protect the service, never sold or used for advertising). Where we rely on legitimate interest, you have the right to object — see your rights below.

Information we collect

Account information you provide: email address and display name.
In-house usage analytics. To understand how the platform is used and to improve it, we record product-usage events tied to your account, including:
- sign-ins (login history),
- pages you view, including which companies and directors you look up,
- searches you run,
- scenarios you run,
- data exports (Excel) you generate,
- fantasy-game actions (opting in, drafting, trades, free-agent moves).
Security & traffic logs. To keep the service secure and to detect abuse, scraping, and attacks, we automatically record technical details of the web requests our servers receive. For each request we log:
- your IP address (the real client IP);
- your approximate location — the country, derived from your IP address, captured only when it is available;
- the pages you visit — the request path, the HTTP method, and the response status;
- your browser and device (the user-agent your browser sends);
- your account identifier (an internal user id) when you are signed in;
- the product-usage events described above (actions taken in the app).
We use these security logs only for security, abuse and scraper detection, and operating the service. They are not sold and are not used for advertising. Security traffic logs are kept for 90 days and are then automatically deleted.

How we use it

To operate, secure, and improve the product.
To understand aggregate usage and individual account activity for support and product decisions.

Who can see it

Usage analytics are internal only, visible to Free Float administrators. They are not shown to other users or to clients, and we do not sell or share them with third parties for their own marketing.

How we protect it

Free Float Analytics operates its information-security program in conformance with the NIST Cybersecurity Framework. Our safeguards include:

U.S.-only data storage. Customer and account data is stored and processed on infrastructure located in the United States.
Encryption. Data is encrypted at rest and in transit.
Access controls. Access to systems and data is restricted to authorized personnel on a least-privilege basis, with authentication and audit logging.
Breach notification. In the event of a data breach affecting personal information, we will investigate, remediate, and notify affected users and any required authorities without undue delay, consistent with applicable law.

We do not train AI on your data

Free Float Analytics does not contribute customer data, account data, or usage analytics to the training of third-party or public artificial-intelligence models.

Confidentiality

We treat customer and account information as confidential and use it only to provide, secure, and improve the service. We do not sell personal information.

Retention

We retain your account and usage data for as long as your account is active, or as needed to operate the service, meet legal obligations, and resolve disputes; when you delete your account we erase your personal data across our systems. Security traffic logs (IP address, approximate location, pages visited, browser/device) are kept for 90 days and then automatically deleted — long enough to investigate abuse and attacks, short enough to minimize what we hold.

Your rights & how to exercise them

You have the right to access, rectify, erase, and port your personal data, and to object to processing based on legitimate interest. There is a working route: signed-in users can request access or deletion at Your data & privacy rights; anyone can email matt@freefloat.llc. We action erasure requests by deleting the account and its personal data. This policy is version 2026-08-16.