1. Introduction and scope
This Privacy Policy applies to the Madist website (including www.madistapp.com and related pages) and the Madist mobile applications for iOS and Android (together, the "Services"). It is issued by AM Digital Life srls (VAT No. 03845960131), with registered office at Viale Repubblica 73, 22060 Cabiate (CO), Italy. We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and other applicable privacy laws in the countries where users access the Services. This single policy covers both the website and the app.
2. Data controller
The data controller is AM Digital Life srls, VAT No. 03845960131, Viale Repubblica 73, 22060 Cabiate (CO), Italy. SDI code: M5UXCR1. PEC: AMDigital@pec.it. Privacy contact: info@madistapp.com.
3. Data we may collect
Depending on how you use the Services, we may process the following categories of data:
- identity and contact data: name, email address, messages sent via contact or support forms;
- account data: Firebase user ID, email, email verification status, display name, sign-in method (email/password, Google, Apple on iOS);
- profile data: team name, preferred language, country of residence, profile image (uploaded from the device gallery or chosen from templates);
- game and community data: virtual wallet/credits, trades, rankings, private leagues, invite codes, Premium status and related dates;
- website community content: feature requests, comments and votes submitted after login;
- support tickets created in the app or via the website contact form;
- push notification token (FCM) and match-alert preferences, if you enable notifications;
- technical data: IP address, user agent, timestamps, server logs, app/device information needed to operate and secure the Services;
- authentication session data on the website (secure auth cookie holding session tokens after login);
- local device storage: language preference, cookie notice flag, tutorial progress and trade watchlist stored on your device.
4. Purposes of processing
We process data to: provide and operate the Services; create and manage accounts; enable live trading with virtual credits, rankings, leagues and related features; respond to contact and support requests; moderate community content (including feature requests); send service or match alerts you choose; improve security and prevent abuse; meet legal obligations; and, only where allowed, send optional Madist-related communications.
5. Legal bases
Depending on the activity and your location, we rely on: performance of a contract or pre-contractual steps (account, gameplay, support); legitimate interests (security, fraud prevention, service improvement, essential website operation); legal obligations; and consent where required (for example optional marketing or certain device permissions such as push notifications).
6. Website-specific processing
The website offers informational and sports content (match previews, results, league stats, squads), a contact form, login with the same Madist account used in the app, and authenticated Feature Requests (ideas, comments, votes). The website does not provide in-browser trading, wallet spending or card payments. Login creates an essential authentication cookie. Feature-request texts may be machine-translated to help multilingual users. A first-party football captcha protects the contact form.
7. Mobile app-specific processing
The app is where gameplay happens: authentication via Firebase (email/password, Google Sign-In, Sign in with Apple on iOS), profile management, avatar upload from the photo gallery, live market data (including read-only Firestore feeds), trades with virtual credits, rankings, private leagues, invites, support tickets, optional push notifications, and Premium status. Football statistics and live ratings may originate from specialised third-party sports data providers processed through our backend. We do not use the camera, precise geolocation or microphone for the current app features described here. Firebase Analytics may be present as an SDK dependency; we do not currently log custom analytics events from the app client.
8. Sharing and processors
We do not sell personal data. We may share data with service providers acting on our instructions, including: Google (Firebase Authentication, Cloud Messaging, Firestore and related Google Cloud services; Google Sign-In); Apple (Sign in with Apple where used); hosting, email and infrastructure providers; and specialised football data providers for match/player information (generally not used to identify you as a person). Data may also be disclosed where required by law or to protect rights, safety and the integrity of the Services.
9. Retention
We keep personal data only as long as needed for the purposes above, then delete or anonymise it unless a longer period is required by law:
- contact / support messages: up to 24 months from the last interaction, unless a dispute or legal duty requires longer;
- account and game profile: for the life of the account and for a limited period after deletion or inactivity as needed for security, backups and legal claims;
- Feature Requests and related community content: for as long as needed to operate the community feature and moderate content;
- website auth session cookie: while the session is active (sliding expiry, longer if "remember me" is selected);
- language cookie: up to 12 months; Feature Requests translation preference cookie: for the browsing session/preference period;
- technical logs: short periods with rotation, for security and operations.
10. Security
We apply reasonable technical and organisational measures to protect personal data against unauthorised access, loss or misuse. No online service can guarantee absolute security; please protect your credentials and device.
11. International transfers and worldwide availability
The Services are offered internationally. Personal data may be processed in the European Economic Area and in other countries where our providers operate (including countries outside your country of residence). Where GDPR requires safeguards for transfers outside the EEA/UK, we rely on adequacy decisions, standard contractual clauses or equivalent measures. Providers such as Google and Apple may process data in the United States or other regions under their respective compliance frameworks.
12. Your rights
Where GDPR or similar laws apply, you may request access, rectification, erasure, restriction, objection and portability of your personal data, and withdraw consent where processing is based on consent, without affecting prior lawful processing. You can update certain profile fields and delete your account from the app settings. Outside the EEA/UK, you may also have rights under local law (for example access or deletion rights). To exercise rights, email info@madistapp.com.
13. Complaints
You may lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali — garanteprivacy.it) or with the supervisory authority of your EU/EEA country of residence. Users outside the EU/EEA may contact their local privacy regulator where available, in addition to contacting us.
14. Children
The Services are intended for users aged 16 or older. We do not knowingly collect personal data from children under 16. If local law requires a higher age for digital services or for consent, that higher age applies. If you believe a minor has provided data, contact us for deletion.
15. Cookies and similar technologies
The website uses essential cookies and local/session storage (language, authentication, Feature Requests translation preference, cookie notice, antiforgery). Details are in our Cookies.
16. No sale of data; regional notices
We do not sell personal data. Where laws such as the California Consumer Privacy Act (CCPA/CPRA) or similar statutes apply, we process personal information to provide the Services, for security and for the purposes described above. You may contact us to exercise applicable access or deletion rights. We do not knowingly sell or "share" personal information for cross-context behavioural advertising on the Madist website.
17. Privacy contact
For privacy requests write to info@madistapp.com.