Privacy Policy
Last updated June 2, 2026
This Privacy Policy describes how FHQ collects, uses, retains, and protects your personal data.
1. Introduction
This Privacy Policy describes how FHQ, the platform available at fhq.lovable.app (the "Service"), collects, uses, retains, and protects your personal data.
The data controller is Cédric Marrouat, an entrepreneur established in French Polynesia ("FHQ", "we").
Contact for any question regarding your data: marrouatcedric@gmail.com
This policy supplements the Terms of Use (ToU) and the Terms of Sale (ToS) of the Service. By using FHQ, you acknowledge having read it.
Given the international nature of the Service, this policy is designed to comply with the regulations applicable in French Polynesia, the General Data Protection Regulation (GDPR) for users in the European Union and the European Economic Area, and the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) for California residents.
2. Data we collect
| Category | Data concerned | Source |
|---|---|---|
| Account data | Email address, password (stored in encrypted/hashed form), Google sign-in identifier if applicable | Provided by you at registration |
| Franchise data | Game data imported from the EA Companion App (rosters, statistics, league configuration, etc.) | Imported by you |
| Payment data | No banking data is collected or stored by FHQ. Payments are processed by Paddle (see §5) | Processed by Paddle |
| Technical and usage data | IP address, browser type, pages visited, connection logs | Collected automatically |
| Communications | Content of your exchanges with support | Provided by you |
Imported franchise data consists of game data and does not, in principle, contain sensitive personal information. We invite you not to include unnecessary personal data in it.
3. Purposes and legal bases for processing
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Account creation and management | Account | Contract performance |
| Provision of analysis tools | Account, franchise | Contract performance |
| Subscription and payment management | Account (via Paddle) | Contract performance / legal obligation |
| Security, fraud and abuse prevention | Technical, usage | Legitimate interest |
| Service improvement and audience measurement | Technical, usage | Legitimate interest |
| Responding to support requests | Communications | Legitimate interest |
| Compliance with legal obligations | As applicable | Legal obligation |
4. Cookies and trackers
The Service only uses strictly necessary cookies for its operation (authentication, session, security). These cookies do not require your consent.
FHQ does not place any advertising cookies or third-party trackers for profiling purposes. Audience measurement is carried out via Lovable in a privacy-friendly manner, without non-essential cookies. No consent banner is therefore necessary.
You can configure your browser to block cookies; however, blocking strictly necessary cookies may prevent the Service from functioning properly.
5. Recipients and processors
We do not sell your personal data. Your data may be shared with the following processors, strictly for the purposes described above:
| Processor | Role | Data concerned |
|---|---|---|
| Authentication (Google sign-in) | Account identifier, email | |
| Paddle | Payment processing as Merchant of Record (legal seller, invoicing, taxation) | Payment and billing data, managed under Paddle's privacy policy |
| Supabase | Database hosting and data storage | All Service data |
| Lovable | Application hosting platform and audience measurement | Technical and usage data |
Each processor is required to guarantee an adequate level of data protection. As Paddle acts as Merchant of Record, the processing of your payment data falls under its own privacy policy, which we invite you to consult.
Your data may also be disclosed to a competent authority when required by law.
6. International data transfers
FHQ is established in French Polynesia and uses service providers (including Supabase, Lovable, Google, and Paddle) that may host or process data outside your country of residence — in particular in the European Union or the United States — so your data may be subject to international transfers.
Where such transfers involve data subject to the GDPR, they are governed by appropriate safeguards (in particular the European Commission's standard contractual clauses) or by an adequacy decision.
7. Retention periods
| Data | Retention period |
|---|---|
| Account data | For the lifetime of the account, then deleted within 30 days after account deletion |
| Imported franchise data | Until deleted by you, or upon account closure |
| Payment / billing data | Retained by Paddle in accordance with its obligations; accounting records retained according to applicable legal periods |
| Technical logs | 12 months |
| Support communications | 24 months after the last exchange |
8. Security
We implement reasonable technical and organizational measures to protect your data against unauthorized access, loss, or alteration (password encryption, restricted access, secure HTTPS communications). As no system is infallible, we cannot guarantee absolute security.
9. Your rights
9.1 Rights applicable to all users
You have the right of access, rectification, erasure, portability, as well as the right to object to and restrict the processing of your data. You can also delete your franchises and your account directly from your personal area.
To exercise these rights: marrouatcedric@gmail.com. We respond as promptly as possible and, in any event, within the time limits set by applicable regulations.
9.2 Specific provisions — European Union / EEA (GDPR)
If you reside in the EU/EEA, you also have the right to withdraw your consent at any time (without retroactive effect) and the right to lodge a complaint with your competent data protection supervisory authority.
9.3 Specific provisions — California (CCPA / CPRA)
If you reside in California, you have the following rights:
- Right to know which categories of personal data are collected, their purposes, and their recipients;
- Right to delete your personal data;
- Right to correct inaccurate data;
- Right to opt out of the sale or sharing of your personal data;
- Right to non-discrimination for exercising your rights.
FHQ does not sell or share your personal data within the meaning of the CCPA/CPRA. No action is therefore required on your part in this regard, but you may exercise all your rights at the address indicated above.
10. Minors
The Service is exclusively intended for persons aged at least 18 years. It is not intended for children and we do not knowingly collect data concerning persons under 18. If we learn that a minor has provided us with data, we will delete it.
11. Changes to this policy
We may modify this Privacy Policy to adapt it to legal or technical developments. The version in force is the one published on this page. In the event of a material change, you will be informed by email and/or by notification within the Service.
12. Contact
For any question or to exercise your rights regarding your personal data:
Cédric Marrouat — FHQ
Email: marrouatcedric@gmail.com
The French version of this Privacy Policy shall prevail. Any translation is provided for informational purposes only.