Account data: Name, email address, and hashed password when you register.

Entitlement data: Purchase records, subscription status, and payment method tokens (processed by our payment provider; we do not store full card numbers or CVV).

Usage data: Pages visited, features used, and preferences (e.g., notification opt-ins) collected to improve the Service.

Technical data: IP address, browser type, and device identifiers collected automatically for security and abuse prevention.

• To create and manage your account and authenticate your sessions.
• To deliver premium content and verify entitlements server-side.
• To process payments and manage subscription billing and cancellations.
• To send notifications you have explicitly opted in to receive.
• To analyze usage patterns and improve our analysis and Service.
• To detect, prevent, and investigate fraud or abuse of the Service.

We do not sell, rent, or trade your personal information to third parties.

• Contract: to provide the Service you requested, including premium access.
• Consent: for notifications and optional analytics, withdrawable at any time.
• Legitimate interest: security, fraud prevention, and Service improvement.
• Legal obligation: tax and record-keeping requirements.

Account and entitlement data are stored on the platform’s managed backend (Cloud) using industry-standard encryption at rest and in transit. Access is restricted to authorized personnel and protected by row-level security policies.

Payment card data is handled entirely by our PCI-compliant payment provider and never touches our servers.

• Account data: Retained while your account is active and up to 30 days after deletion.
• Payment records: Retained for the period required by tax and accounting law (typically 7 years).
• Usage logs: Retained for up to 12 months, then aggregated or deleted.

We share data only with the following categories of processors, and only as necessary:

• Cloud provider: Hosts our database, authentication, and file storage.
• Payment provider: Processes subscription and one-time payments.
• Email provider: Delivers transactional and notification emails you opt in to.
• Sports data providers: ESPN and SportsDataIO supply fighter records and event schedules.

We may also disclose data when required by law, court order, or to protect our legal rights.

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Delete your account and associated data.
• Export your data in a portable format.
• Object to processing based on legitimate interest.
• Withdraw consent for optional processing at any time.

To exercise any of these rights, contact us at privacy@grandwizmma.com. We respond to verified requests within 30 days.