Privacy Policy

This Privacy Policy explains how Bizexpanders LLC collects, uses, discloses, retains, and protects personal data when you use the Tuga Futebol website, mobile applications, community features, AI features, and related services (collectively, the Services).

1. Controller and contact details

Tuga Futebol is operated by Bizexpanders LLC, a Delaware limited liability company, file number 10483314 ("Bizexpanders", "we", "us", or "our"). Bizexpanders is the controller of personal data described in this Privacy Policy.

For privacy questions, rights requests, or concerns about how we process personal data, contact us at [email protected]. For security vulnerabilities or critical security reports, contact [email protected].

Our registered and correspondence details, including postal addresses, are available in the Legal Notice on the Tuga Futebol website.

If applicable law requires us to appoint an EU or UK representative, we will update this Privacy Policy with that representative's details.

2. Personal data we collect

We collect personal data directly from you, automatically when you use the Services, from authentication providers, from payment providers, and from our service providers.

Account and profile data

When you create an account, we collect your first name, last name, email address, password, and date of birth. You may optionally add a profile picture and select football teams, clubs, competitions, or other preferences. We use your date of birth to verify that you are eligible to use the Services.

You may create or sign in to an account through Google. Where you choose this option, we may receive information made available by Google, including your unique Google account identifier, email address and its verification status, display name, given name, family name, profile-image URL, and language or regional preference. We use this information to create, authenticate, and secure your account.

Subscription and transaction data

We collect information about your subscription tier, subscription status, purchases, invoices or receipts, payment status, and relevant billing information. Payment-card details are processed by Stripe for website payments, Apple for Apple in-app purchases, and Google for Google Play billing. We do not store full payment-card details on our own systems.

AI chat data

If you use an AI feature, including the AI chatbot, we process the prompts, conversation content, relevant chat context, and outputs associated with your use of that feature.

Community data

If you use our community features, we collect the content you post, including posts, comments, replies, reactions, reports, blocks, and moderation history. Community content may be publicly visible, indexed by search engines, and shared through public links where those features are enabled.

Users should avoid including personal, confidential, sensitive, financial, account, location, contact, or other information in public community content that they do not wish to be visible to others.

Technical, usage, security, and advertising data

We automatically collect online identifiers and technical information, including IP address, cookie identifiers, consent preferences, browser type, device and operating-system information, timestamps, pages or features accessed, referring URLs, approximate location inferred from IP address, diagnostic information, error reports, security events, and application or server logs.

Where enabled and permitted, our analytics, advertising, and marketing partners may collect cookie identifiers, advertising identifiers, device identifiers, event data, and information about interactions with our website or app. On iOS, we request permission through Apple's App Tracking Transparency framework before engaging in tracking that requires that permission.

Our sign-up and age-verification pages use Google reCAPTCHA to tell humans from automated abuse. The check loads Google code that collects device and interaction signals, which may include IP address and Google cookies, and sends them to Google for a risk score. Google's Privacy Policy and Terms of Service apply to that check.

Functional and fair-use data

We collect and use functional data, such as login-session information and article views by guest users, to operate the Services, enforce fair-use limits, protect security, and prevent abuse. We may require a guest user to create a free account to continue accessing certain features, such as personalised Newsfeed, community features, AI-chat features, personalised Newsfeed, or content based on followed clubs.

Communications and marketing data

We collect communications you send to us, your support requests, and your newsletter or marketing preferences. Newsletter subscription is optional. We retain records of consent, including the date, time, method, and source of your consent or withdrawal.

Notifications on your phone

If you install Tuga Futebol on your phone and turn notifications on, your phone's push service gives us a delivery address and two encryption keys for that phone, and we store them with your account together with the kind of phone (iPhone or Android) and which kinds of notification you have chosen. We use them only to send the notifications you turned on. We do not store the phone's model, browser or any other detail about it.

Nothing is sent until you turn notifications on, and you can turn them off at any time under Settings, Preferences, or in your phone's own settings. When you turn them off, or delete your account, the address and keys for that phone are deleted. The installed app also records when it was last opened on each of your phones, so that the website knows whether to offer installing it again; that record is deleted with the account.

3. How we use personal data

We use personal data to:

• Create, authenticate, maintain, and secure your account.
• Provide personalised football news, match information, feeds, and analysis based on your selected clubs and preferences.
• Operate and improve the Services, including AI features and content-generation workflows.
• Process subscriptions, purchases, payments, receipts, and account entitlements.
• Operate, moderate, and maintain the community features.
• Enforce fair-use limits, prevent fraud, abuse, spam, piracy, and other violations of our rules.
• Respond to enquiries, provide support, and send service messages, including password resets, security notices, receipts, subscription changes, and material service notices.
• Send newsletters or other marketing communications where you have opted in or where otherwise permitted by law.
• Measure use of the Services, understand audience engagement, improve functionality, and troubleshoot errors.
• Deliver or measure advertising on our free tier where you have given the consent required by applicable law.
• Comply with legal obligations, enforce our agreements, protect our rights, and respond to lawful requests.

4. Legal bases for processing

Where the GDPR, UK GDPR, Brazilian LGPD, or similar privacy laws apply, we rely on the following legal bases:

• Performance of a contract: to provide accounts, subscriptions, community features, AI features, customer support, and other requested Services.
• Legitimate interests: to secure the Services, prevent fraud and abuse, enforce fair-use limits, maintain platform integrity, moderate community content, improve performance, and establish, exercise, or defend legal claims. We balance these interests against your rights and provide opt-out rights where required.
• Legal obligations: to meet accounting, tax, regulatory, recordkeeping, and lawful-request obligations.
• Consent: for non-essential cookies and SDKs, personalised advertising, certain analytics, and marketing newsletters where consent is required. You may withdraw consent at any time through Cookie Preferences, Your Privacy Choices, an unsubscribe link, or the relevant app settings.

If we need to process data for a purpose not described in this Policy, we will provide any notice or obtain any consent required by law.

5. AI features and AI-assisted content

Tuga Futebol uses artificial intelligence tools to generate and assist with football-related content and features, including text and, where available, images and video.

Our application infrastructure, databases, and AI-agent orchestration are hosted using DigitalOcean and related cloud infrastructure. To provide particular AI features, we may transmit prompts, conversation context, and relevant service data to selected third-party AI inference providers. Depending on the feature and model selected, these providers may include OpenAI, OpenRouter, Perplexity, MongoDB Voyage AI and, where enabled, Fireworks AI or Together AI.

We use licensed third-party football data feeds to support football statistics, fixtures, and related information. We do not scrape published articles from other sports websites. Our AI tools may use publicly available information made available through third-party search services to assist with research and content generation.

AI chatbot

When you use the Tuga Futebol AI chatbot, you are interacting with an artificial intelligence system and not a human. The chatbot may generate inaccurate, incomplete, outdated, or unsuitable responses. Its output is for general football discussion and informational purposes only; it is not professional, legal, financial, medical, betting, or other specialist advice.

Do not submit sensitive personal information, financial information, account credentials, health information, or other confidential information in AI prompts.

AI data minimisation and provider routing

We do not routinely send your email address, profile information, direct account identifiers, or unrelated personal data to AI providers. We transmit only the prompt, relevant football data, and the minimum context needed for the particular AI feature or request.

The provider used may vary according to the feature, selected model, availability, performance, and safety requirements. Where OpenRouter is used, we use approved provider and model configurations rather than unrestricted routing. A selected provider may process the relevant prompt, context, and output on our behalf.

Chat content and training

We do not use your AI-chat content to train, fine-tune, or improve our own AI models. We configure and contract with providers to process personal data only as necessary to provide the relevant service, subject to applicable provider terms, data-processing arrangements, and settings.

We retain AI-chat content to provide the chatbot service, maintain conversation context, prevent misuse, investigate security incidents, and comply with legal obligations. Chat content is deleted when you delete it or automatically deleted 30 days after the last activity in the relevant conversation, unless limited retention is necessary for security, legal, fraud-prevention, or dispute-resolution purposes.

AI-generated content

Tuga Futebol articles, summaries, analytical content, images, and future video content may be generated or materially assisted by AI. We label AI-generated or AI-assisted content where appropriate or required by law. For example, we may tell users that they are interacting with an AI assistant, label AI-generated images or video, and disclose when an AI-generated news or match summary has not received manual editorial review.

Where required and technically feasible, we may use machine-readable metadata, visual labels, watermarks, or other measures for synthetic or manipulated content.

No solely automated decisions with legal or similarly significant effects

We do not use AI to make decisions that produce legal effects or similarly significant effects concerning you, such as suspending or permanently banning an account. Automated tools, such as profanity or abuse filters, may pre-filter or flag content, but decisions to suspend an account, ban a user, or impose a material restriction for policy violations are subject to human review. Users may appeal moderation decisions as described in our Community Guidelines.

Rule-based access prompts, such as asking a guest user to log in after reaching an article-access limit, are not AI decisions or behavioural profiling.

6. Cookies, advertising, and analytics

We use cookies, SDKs, pixels, local storage, and similar technologies. Our Cookie Policy and Cookie Preferences provide further details about the technologies, purposes, and providers used.

Essential technologies

Some technologies are necessary to provide the Services, maintain security, remember consent choices, manage login sessions, process payments, prevent fraud, and enforce reasonable fair-use limits. You cannot disable these technologies through our Cookie Preferences, although you may be able to restrict them through browser or device settings. Restricting essential technologies may affect how the Services function.

Our own anonymous visit count

We count how many times each page is read, the country it was read from, and how many pages are read in one sitting, on our own server, so that we know which parts of the site are used and can find and fix problems. This count uses no cookies and no script, asks nothing of your device, keeps no IP address and no browser details, and cannot identify you: each visitor is represented by a code that changes every day and cannot be turned back into a person. The count is never combined with your account or any other information, is used only to run this website, and is never shared. Daily totals are kept for up to 25 months. Because it does not process personal data, it does not require your consent and cannot be switched off; we rely on our legitimate interest in understanding how the site is used.

We also count how many people install the app: the first time the installed app opens signed in on a new phone or computer, one is added to that day’s total for that kind of device. The total is a number per day – it does not record who installed the app – and the same opt-out and browser signals apply to it.

Analytics and advertising

Our free tier may use Google AdSense on the website and Google AdMob in mobile applications. We may also use Google Analytics and marketing/advertising technologies from Meta (including Facebook, Instagram, and Threads), Reddit, TikTok, and X.

Where required by law, we block non-essential analytics, advertising, and marketing technologies until you provide consent. For EEA and UK users, we use a Google-certified consent management platform and, where applicable, the IAB Transparency and Consent Framework. You can change or withdraw your choices at any time through Cookie Preferences or Your Privacy Choices.

For Ad-Free, Premium, and Pro subscriptions, we disable advertising and marketing pixels and SDKs used for advertising purposes. Essential security, account, subscription, and service technologies may still be used.

For iOS applications, where our activity constitutes tracking under Apple's rules, we request permission through App Tracking Transparency before engaging in that tracking.

We honour Global Privacy Control signals where required by applicable U.S. privacy law.

7. How We Disclose Personal Data and Key Service Providers

We do not sell personal data for money. However, our use of advertising and marketing technologies may constitute a "sale," "sharing," or "targeted advertising" under certain U.S. state privacy laws. You may opt out through Your Privacy Choices, Cookie Preferences, or an applicable browser-based opt-out signal such as Global Privacy Control.

We disclose personal data to service providers and other recipients as needed to operate the Services. The table below identifies our principal providers, the services they provide, and their primary processing or storage location.

Processing may also occur in other locations through a provider's authorised subprocessors, support operations, content-delivery networks, backup systems, and global infrastructure. We require service providers to process personal data under applicable contractual and legal safeguards.

We may also disclose personal data to professional advisers, insurers, auditors, authorities, law-enforcement bodies, and transaction parties where reasonably necessary for legal, accounting, compliance, enforcement, corporate-transaction, or lawful-request purposes.

Where personal data subject to EEA, UK, or Swiss transfer rules is processed outside the relevant jurisdiction, we use the transfer safeguards described in section 9 (International Data Transfers). You may contact [email protected] to request further information about our providers and applicable transfer safeguards.

8. Retention and account deletion

You may request deletion through Settings or by contacting us at [email protected]. We delete or de-identify account-profile data, authentication data, and chat content from active systems without undue delay after processing a valid deletion request.

Where you delete a community post, we may display a replacement such as "[This post has been deleted by the author]" to preserve the structure of a discussion. Replies by other users may remain. On account deletion, we remove or de-identify your account name and profile image associated with public community content. We will remove or redact community content where it identifies you or contains personal data that cannot reasonably remain published.

We retain limited data for the following periods, unless a longer period is required or permitted by law, or retention is necessary to establish, exercise, or defend legal claims:

9. International data transfers

Bizexpanders is a U.S. company. Our core infrastructure is primarily hosted in Frankfurt, Germany, but personal data may be processed in the United States and other countries where our providers, subprocessors, or partners operate.

When personal data subject to EEA, UK, or Swiss transfer rules is transferred outside the relevant jurisdiction, we use an appropriate legal transfer mechanism. Depending on the recipient and transfer, this may include an adequacy decision, participation in the EU-U.S. Data Privacy Framework where the relevant recipient is certified and the framework applies, Standard Contractual Clauses, the UK International Data Transfer Addendum or International Data Transfer Agreement, or another mechanism permitted by applicable law.

You may contact [email protected] to request further information about applicable transfer safeguards.

10. Your privacy rights

Depending on where you live and the law that applies, you may have rights to:

• Access and obtain a copy of personal data we hold about you.
• Correct inaccurate or incomplete personal data.
• Request deletion of personal data.
• Object to, or request restriction of, certain processing.
• Receive personal data in a portable format where applicable.
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Opt out of targeted advertising, sale, or sharing where applicable.
• Appeal a decision we make about a privacy request where applicable.
• Lodge a complaint with a data-protection authority, including your local EEA supervisory authority where GDPR applies.

To exercise rights, contact [email protected]. We may verify your identity before acting on a request. Normally, we verify an account-related request by asking you to contact us from the email address associated with your account and may request an in-app or email confirmation for higher-risk requests.

Where GDPR applies, we aim to respond without undue delay and generally within one month. Where U.S. state privacy laws apply, we respond within the statutory timeframes. Marketing opt-outs take effect through the unsubscribe mechanism or relevant consent settings; opt-outs from sale, sharing, or targeted advertising are handled as required by applicable law.

Authorised agents may make requests where permitted by law. We may request evidence of the agent's authority and verify the request directly with the user.

11. U.S. state privacy notice / California: Your Privacy Choices

This section applies to residents of U.S. states with applicable privacy laws, including California where the California Consumer Privacy Act, as amended (CCPA/CPRA), applies.

In the preceding 12 months, we may have collected the following categories of personal information: identifiers; customer/account records; commercial and subscription information; internet, device, and network activity; approximate location inferred from IP address; preferences and inferences; user-generated community content; AI-chat content; and technical, diagnostic, security, and advertising data.

We collect these categories from users, devices/browsers, authentication providers, payment providers, analytics/advertising providers, and service providers. We use and disclose them for the purposes described in sections 3 and 7.

We do not sell personal information for money. However, where permitted advertising or marketing technologies disclose identifiers and online activity to third parties for cross-context behavioural advertising, that activity may be a sale or sharing under California law or targeted advertising under another state law. You may opt out through Your Privacy Choices, Cookie Preferences, or a recognised Global Privacy Control signal where required.

California residents may have rights to know, delete, correct, opt out of sale/sharing, limit certain uses of sensitive personal information, and not be discriminated against for exercising privacy rights, subject to applicable exceptions. Submit a request using [email protected].

12. Children's privacy

Tuga Futebol is intended only for individuals aged 18 or older. You must be at least 18 years old to create an account or use our community features, AI-chat features, personalised advertising features, or paid subscription services.

We collect date-of-birth information during registration to apply and enforce this age requirement. If the date of birth entered indicates that a person is under 18, we will not permit account creation. We may use limited technical and security measures, such as a temporary browser or device identifier and rate limiting, to help prevent repeated attempts to bypass our age gate.

We do not knowingly collect personal data from, or knowingly permit accounts belonging to, persons under 18. If we learn or reasonably suspect that an account belongs to a person under 18, we may restrict or suspend the account while we investigate and will close and delete the account and associated personal data without undue delay. We may retain limited information where necessary for legal compliance, safety, fraud prevention, the protection of users, or the establishment, exercise, or defence of legal claims.

Users may report a suspected underage account, grooming, exploitation, harassment, threats, or other safety concern through the in-app reporting tools or by contacting [email protected].

Tuga Futebol is not an emergency service. If a person—particularly a child—may be in immediate danger, contact local emergency services immediately and do not wait for us to respond to a report.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated effective date and, where required, provide additional notice or obtain consent before a material change takes effect.

14. Contact

For questions, rights requests, or privacy concerns, contact:

Bizexpanders LLC
Email: [email protected]
Security reports: [email protected]