Privacy Policy

YFS Privacy Policy — Ready to paste into your WordPress Privacy Policy page

Last updated: March 2026

1. Introduction

YourFootballShirt.com (“YFS”, “we”, “our”, “us”) is a football shirt collector community and marketplace operated from France. We are committed to protecting your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the French Loi Informatique et Libertés, and other applicable data protection legislation.

This Privacy Policy explains what personal data we collect, how we use it, who we share it with, and your rights regarding your data.

Data Controller: YourFootballShirt / Sebastien Bee Contact email: yo***************@***il.com Website: https://yourfootballshirt.com

2. What Personal Data We Collect

2.1 Account Data

When you register on YFS, we collect:

Email address
Username / display name
Password (encrypted)
Profile information you choose to provide (avatar, bio, collector nickname)
Language preference

2.2 Collection & Marketplace Data

When you use our collector and marketplace features, we process:

Kit collection data (teams, brands, seasons, conditions, images, descriptions)
Product listings (prices, descriptions, images)
Transaction data (purchases, sales, payment information)
Auction bids and wallet balances
Bankroll and financial tracking data you provide (purchase prices, years)
Wishlist items
Make Offer negotiations

2.3 Social & Community Data

Messages between users
Activity feed interactions
Ratings and reviews
Kit transfers between collectors
Leaderboard rankings and Legend Status progress
Rewards and points

2.4 Instagram Integration Data

When you connect your Instagram account through our Instagram Import feature, we collect and process:

Your Instagram Business or Creator account username and user ID
Your Instagram access token (encrypted and stored securely on our servers)
Your Instagram media feed data (photos, captions, timestamps) — only when you actively use the Import feature
Media files (images) you choose to import into your YFS collection

Important: We access your Instagram data solely to allow you to import your football shirt posts into your YFS collection. We do not access your Instagram direct messages, followers list, stories, or any data beyond what is necessary for the import function. Your Instagram access token is encrypted using AES-256 encryption and is stored only on our servers. You can disconnect your Instagram account at any time from the Instagram Import settings, which immediately deletes your stored access token.

We use the Instagram API with Instagram Login (Business Login) provided by Meta Platforms, Inc. This connection does not require linking a Facebook Page. Only Instagram Business or Creator accounts can be connected. For more information about how Meta handles your data, please see Meta’s Privacy Policy at https://www.facebook.com/privacy/policy/.

2.5 Technical Data

IP address
Browser type and version
Device information
Pages visited, time spent, referring URL
Cookies and similar tracking technologies (see Section 7)

2.6 Payment Data

Payments are processed by third-party payment providers (PayPal, Stripe). We do not store your full credit card numbers or payment credentials on our servers. We only store transaction references and amounts necessary for order fulfilment and financial records.

2.7 Seller Verification Data

If you become a seller on YFS, you may be asked to submit identity verification documents. These are processed for verification purposes only and handled in accordance with applicable regulations.

3. How We Use Your Data

We process your personal data for the following purposes and legal bases:

Purpose	Legal Basis (GDPR)
Account registration and management	Contract performance (Art. 6(1)(b))
Providing collector and marketplace features	Contract performance (Art. 6(1)(b))
Processing transactions and payments	Contract performance (Art. 6(1)(b))
Instagram Import — connecting account and importing media	Consent (Art. 6(1)(a))
Publishing content to Instagram on your behalf	Consent (Art. 6(1)(a))
Sending transactional emails (order confirmations, kit transfer notifications)	Contract performance (Art. 6(1)(b))
Sending abandoned cart recovery emails	Legitimate interest (Art. 6(1)(f))
Sending marketing newsletters (if opted in)	Consent (Art. 6(1)(a))
Leaderboard, rankings, and rewards	Legitimate interest (Art. 6(1)(f))
Security, fraud prevention, and abuse detection	Legitimate interest (Art. 6(1)(f))
Website analytics and performance improvement	Consent (Art. 6(1)(a)) via cookie consent
Legal obligations (tax records, invoicing)	Legal obligation (Art. 6(1)(c))

4. Data Sharing

We share your personal data only in the following circumstances:

Other YFS users: Your public profile, collection, and listings are visible to other users. Your display name on leaderboards and public pages uses a privacy-safe format (store name, collector nickname, or auto-generated YFS ID — never your email).
Payment processors: PayPal and Stripe process your payment data under their own privacy policies.
Meta / Instagram: When you use the Instagram Import feature, your authentication data is exchanged with Meta’s Instagram API. We request only the minimum permissions required (instagram_business_basic and instagram_business_content_publish).
Hosting providers: Our website is hosted by providers who process data on our behalf under data processing agreements.
Cloudflare: We use Cloudflare for CDN and security services, which processes request data (IP addresses, headers).
Legal requirements: We may disclose data if required by law, court order, or governmental request.

We do not sell your personal data to third parties. We do not share your data with advertisers.

5. Data Retention

Data Type	Retention Period
Account data	Until you delete your account
Collection and listing data	Until you delete the items or your account
Transaction records	10 years (French tax law requirement)
Instagram access tokens	Until you disconnect your Instagram account
Imported Instagram media	Until you delete the imported kits
Messages	Until you delete your account
Abandoned cart data	30 days after cart abandonment
Email unsubscribe tokens	Indefinitely (to respect your preferences)
Server logs	90 days
Cookie consent records	13 months

6. Your Rights

Under the GDPR, you have the following rights:

Right of access — You can request a copy of all personal data we hold about you.
Right to rectification — You can correct inaccurate or incomplete data via your account settings.
Right to erasure — You can request deletion of your account and associated data.
Right to restrict processing — You can request that we limit how we use your data.
Right to data portability — You can request your data in a structured, machine-readable format.
Right to object — You can object to processing based on legitimate interest, including marketing.
Right to withdraw consent — You can withdraw consent at any time (e.g., disconnect Instagram, unsubscribe from emails) without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at yo***************@***il.com. We will respond within 30 days.

You also have the right to lodge a complaint with the French data protection authority (CNIL): https://www.cnil.fr

7. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. We obtain your consent before placing non-essential cookies.

Essential Cookies

These are necessary for the website to function and cannot be disabled:

Session cookies (login, cart, CSRF protection)
WooCommerce functionality cookies
Cloudflare security cookies

Analytics Cookies (with consent)

Google Analytics — to understand how visitors use our site
We anonymise IP addresses in analytics

Third-Party Cookies (with consent)

Google Sign-In — if you choose to log in via Google
PayPal — during checkout
Instagram/Meta — only when using the Instagram Import feature

You can manage your cookie preferences at any time through our cookie consent banner or by contacting us.

8. International Transfers

Your data is primarily stored on servers within the European Union. Where data is transferred outside the EU (e.g., to US-based services like Cloudflare, PayPal, or Meta/Instagram), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

9. Data Security

We implement appropriate technical and organisational measures to protect your data:

HTTPS encryption on all pages
AES-256 encryption for stored Instagram access tokens
HMAC-signed tokens for email unsubscribe and cart recovery links
Encrypted passwords (WordPress salted hashing)
Cloudflare DDoS protection and WAF
Regular security audits and updates

10. Children’s Privacy

YFS is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Instagram Data Deletion

In compliance with Meta’s platform requirements, you can request deletion of all Instagram-related data stored by YFS:

Via the app: Go to Instagram Import → click “Disconnect” to remove your Instagram connection and access token.
Via email: Send a request to yo***************@***il.com with the subject “Instagram Data Deletion Request” and we will delete all Instagram-related data within 30 days.
Via Instagram: Revoke YFS access from your Instagram account settings (Settings → Apps and Websites → Remove).

Upon disconnection or deletion request, we delete:

Your Instagram access token
Your Instagram user ID and username from our connection records
Note: Imported kit posts (photos and descriptions) that have already been published to your YFS collection will remain as they are now part of your YFS data. You can delete these individually from your collection.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or sending an email. The “Last updated” date at the top indicates the most recent revision.

13. Contact

For any questions about this Privacy Policy or your personal data:

Email: yo***************@***il.com Website: https://yourfootballshirt.com