Privacy policy
Who is responsible for Red Half Lab, what information we process, how long we keep it and how to exercise your rights.
Draft last checked:
1. Operator, scope and contact
Red Half Lab is operated by Pumpkin Active LTD, 27 Old Gloucester Street, London WC1N 3AX, England. Pumpkin Active LTD is the controller responsible for the personal information it processes for this website. In this policy, “we”, “us” and “our” refer to that company operating Red Half Lab.
This policy covers the Red Half Lab website at redhalflab.com, including its articles, REDS content, local match challenges, voluntary-support payments and correspondence about those services. The intended markets are the United Kingdom, United States and European Union. Other projects operated by the same company have their own notices; using this site does not create an account with those projects or automatically combine your records with theirs.
For privacy questions, rights requests, corrections or complaints, email contact@redhalflab.com, or write to the postal address above. There is no requirement to use a special online form.
Review draft, updated on 24 October 2026. Operator details, contact, intended markets and the adult audience have now been confirmed. The retention rules below are the policy being adopted, rather than a claim that every deployment setting already enforces them. Hosting providers, log configuration and transfer arrangements still require a deployment check before final publication. The date is a revision date, not an announcement that the website has launched.
2. Browsing and the information involved
Reading articles and REDS answers does not require registration, sign-in or a name or email address. The current website does not provide account registration or cross-device account synchronisation.
Your browser nevertheless sends network requests. The server processes the address reported for the connection, requested URLs and relevant request headers to deliver a response. Those details can include personal information. We therefore do not describe browsing as processing no personal information at all.
If you email us, we receive your email address, the name or signature you provide, the message and any attachments you choose to send. We use these to respond, investigate the issue and maintain an appropriate correspondence record. Please send only information relevant to the request, and do not send a password, complete card details or identity documents in an initial message.
3. Match-challenge choices on your device
The REDS match challenge uses browser local storage to remember your selected answers, position in the question sequence and answers you have revealed. The match-specific entry starts with ask-reds-play-v2-. Older entries with that prefix may remain after a fixture or version changes.
The current challenge code reads and writes these records on your device. It does not send the saved choices to an account server or synchronise them between devices. Fetching the challenge content itself is a separate network request.
The code sets no automatic expiry for those entries. They remain until you remove them, the browser removes them or the browser profile is deleted. Closing a tab does not necessarily remove them. This device-controlled storage is distinct from the server-side retention rule in section 9.
You can delete the entries by clearing this site’s stored data in your browser settings. This removes the saved choices and progress in that browser; it does not delete information from other devices, server logs or Stripe. There is no account-based restore facility. If storage is blocked, you can still interact during the current visit, but progress may be lost on reload. See the Cookies Policy for the detailed inventory and controls.
4. REDS search and selected answers
The REDS search box can send text as you type, without a separate submit action. The current interface sends a URL query parameter to the site’s search endpoint, which forwards the request to the content backend to match the existing catalogue.
The reviewed search handler does not create an account search-history record in the content database. Requested URLs can nevertheless appear in server or proxy logs. Opening an answer also sends its content identifier, and the browser URL can contain the selected answer identifier so that it can be revisited or shared.
Use the search to find football content. Do not enter personal, financial, health or confidential information. We do not infer from the absence of an application search-history table that all infrastructure is free of search records.
5. Payment-request limits and connection data
The checkout-session endpoint uses the client address reported by the server as a key in an in-memory record of request timestamps. This limits repeated attempts to create payment sessions.
The limiter looks at recent activity over 60 seconds. This is a counting window, not a deletion period. The current implementation has no scheduled removal of inactive address keys. It updates a key when that address is used again; that process’s memory disappears when the process ends. Separate logs can persist independently. The reported address can also depend on proxy configuration, so it is not guaranteed to be the visitor’s direct public address or an anonymised value.
6. Voluntary support, payment information and thanks
Support is optional and separate from reading the site. When configured, the feature creates a one-off Stripe Checkout payment for £2, £5 or a custom amount within the accepted limits. The browser sends the amount choice, custom amount if any and interface language to our server.
Our server sends Stripe the relevant product or price, amount and currency, return URLs and labels identifying the site, voluntary support and amount option. Card details are entered on Stripe’s hosted checkout, not a card-entry form operated by this website. Stripe can process payment, contact, billing, device and fraud-prevention information under its own notices. The merchant receiving support is Pumpkin Active LTD. The actual payment methods and bank-statement descriptor still need to be checked against the live Stripe account.
On return, a checkout-session identifier in the URL is used to retrieve the session from Stripe. The confirmation page shows payment status and, once confirmed, the amount. The response can include additional checkout details even though the page displays only the status and amount. Keep the return URL and transaction reference private.
The current payment handlers do not write a separate local payment ledger or customer profile. A signed Stripe notification, when configured, is verified and acknowledged. Stripe and our merchant account can still retain transaction records; authorised company personnel may need to consult these for a payment, refund, accounting or dispute.
Support contributes to continued project research, server and hosting costs, maintenance and other project operating costs. The confirmation page thanks supporters. We do not turn your payment identity into a public supporter listing automatically. You choose whether your name is made public. Unless you opt in, your name will not appear in a public acknowledgement. To opt in under the current manual process, email us your chosen display name and explicit permission to publish it; we do not substitute your billing name. You can contact us to request removal of an acknowledgement from pages we control; we cannot recall copies already made by others.
See the terms of use for the five-day change-of-mind refund policy. Stripe’s own processing is described in its Privacy Policy, Privacy Center and Cookie Policy. These do not replace our responsibilities for information we process.
7. Purposes and legal grounds
For UK and EEA processing, the relevant legal ground depends on the activity:
- Requested services and payments: processing necessary to arrange a requested support transaction, administer a refund or fulfil the corresponding arrangement can rely on taking requested steps or performing a contract. We do not use this ground for unrelated marketing or unnecessary tracking.
- Site delivery, search, security and correspondence: where appropriate, we rely on our legitimate interests in delivering requested football content, operating a reliable service, preventing misuse and responding to enquiries, balanced against people’s rights. Any required assessment must reflect the actual deployment and information processed.
- Legal obligations: records and disclosures necessary for applicable accounting, tax, regulatory obligations or lawful requests are handled on that basis.
- Consent: where required for optional storage or a separate public acknowledgement, consent or the applicable permission must be obtained for the specific purpose. Browsing alone is not blanket consent. Withdrawal does not make earlier lawful processing unlawful.
You can object to processing based on legitimate interests, including the delivery, security or enquiry activities described above where that ground applies. Email us with the activity concerned. Where the law permits continued processing for compelling grounds or legal claims, we will explain the relevant reason rather than treating the objection as an unconditional deletion instruction.
We do not ask visitors for sensitive information through content search or challenge features. If you send material relevant to a complaint, limit it to what is needed. Processing of public professional information is also subject to an appropriate basis and applicable safeguards; being public does not automatically remove privacy protection.
8. Recipients, locations and international transfers
The content backend receives search requests and selected content identifiers. Stripe handles the payment activities above. Email and infrastructure providers necessarily handle information needed for the services they supply. Information may also need to be disclosed where law requires it or to establish or defend a legal claim. Access should be limited to people and providers with a relevant task.
We do not combine the audiences of the company’s different projects merely because they share an owner. The reviewed site code does not include advertising, third-party audience analytics or a cross-site advertising tracker. We do not use this site’s visitor records for a data-selling or targeted-advertising programme.
The names and countries of the production host, email service, CDN, proxy and any security or monitoring service still need to be recorded. The UK, US and EU audience is not a statement that all data is hosted in those regions. Futrix Metrics’ hosting locations are not assumed to be Red Half Lab’s hosting locations.
Where a transfer requires safeguards under UK or EEA law, we must identify the relevant arrangement, such as an applicable adequacy framework or appropriate contractual safeguards, and provide a way to obtain information about it. This draft does not claim that an unverified provider or transfer agreement is already in place. Contact us about the locations and safeguards relevant to your information.
9. Retention, deletion and backups
We adopt the common retention approach used for our other project: keep personal information only as long as needed for the purpose, with an ordinary maximum of one year unless a longer period is required or permitted for an identified legal, accounting, tax or claims-related reason. A shorter period should be used when the information is no longer needed. The one-year rule is a policy limit, not a statement that all records must be kept for a year.
For access, search and security logs, the necessary period depends on investigating faults or misuse and the deployed configuration. For enquiries and privacy requests, it depends on resolving the request and retaining a proportionate record of its handling. Routine records should be deleted or anonymised when no longer needed within the ordinary maximum. An exception must be tied to a real purpose, not an indefinite “just in case” archive.
Transaction, refund, accounting and dispute records can need longer retention under applicable obligations or for a live claim. Retain only the information needed for that reason, restrict its use and review it when the obligation or claim ends. Stripe’s own duties and retention are separate from our ordinary records policy.
Where immediate deletion from a backup is not feasible, the information should be protected, isolated from ordinary use and removed when deletion becomes possible through the applicable backup process. It should not be restored to ordinary processing without applying the deletion requirement again.
The live log rotation, backup deletion schedule and responsible-provider settings have not yet been verified against this rule. The current payment limiter has the behaviour in section 5, and browser storage has the behaviour in section 3. No one-year automatic deletion job, fixed backup purge interval or 60-second address-deletion mechanism is claimed by this policy. Those implementation details must be checked before publication.
10. Rights requests, verification and complaints
Email contact@redhalflab.com, or write to Pumpkin Active LTD at the address in section 1. Describe the information or interaction concerned, the approximate date and what you want us to do. “Privacy request” is a helpful subject line, but no particular wording or form is required. Do not send a complete card number or an identity document unless we have explained why a proportionate check is necessary and how to provide it safely.
Depending on the applicable law, you may request access and a copy, correction, deletion, restriction, portability, or object to relevant processing. You can withdraw consent for a consent-based activity. Rights can have lawful exceptions, including where information must be retained for a legal obligation or claim. If we cannot fulfil a request in full, we will explain the reason and available next steps.
We may need to verify that the request concerns you or that an agent is authorised. We will first use information already available where sufficient, and request only what is reasonably necessary for verification or locating the records. We do not require someone to open a site account to make a request. A request should not result in discriminatory treatment for exercising an applicable right.
For UK and EEA requests, the usual response period is without undue delay and within one month, subject to the rules that apply to the request. Where an extension is lawfully available for complexity or the number of requests, we will notify you within the initial period with the reason; the applicable extension can be up to two further months. Where a US privacy law applies, its deadlines and appeal requirements apply instead. We will not invent a shorter process merely because a template contains one. Requests are normally free; a fee or refusal will be used only where law permits it and with an explanation.
You can raise a privacy complaint with us at the same email address. For the United Kingdom, you can also contact the Information Commissioner’s Office. EEA residents can contact the relevant national data protection authority. You do not have to give up a regulator complaint right in order to use our internal route.
For Stripe’s independent processing, use its privacy-request options as appropriate. We remain responsible for requests about information controlled by us, including relevant merchant records. Deleting local browser data cannot itself delete server or payment records.
11. United States residents
Where an applicable US state privacy law covers the activity, rights can include knowing the categories and specific information processed, obtaining access, correction, deletion or a portable copy, and opting out of covered sale, sharing, targeted advertising or qualifying profiling. The particular rights depend on the law and its applicability; serving US readers does not mean every state statute automatically applies to the company.
The relevant information categories in this service can include contact identifiers and correspondence, connection and activity information, transaction references and payment-related records, and public professional information appearing in football content. Their sources, purposes, recipients and retention are described above. They are not a claim that all such information is collected about every visitor.
You or an authorised agent can send a request to the same contact address. We may verify identity and authority proportionately. Where a right of appeal applies, reply asking for an appeal; we will provide the reason for the outcome and any available route to the relevant state authority. We will not penalise a person for exercising a protected privacy right.
The reviewed site does not operate a sale, cross-context advertising or targeted-advertising programme. We do not currently claim a technical integration that records Global Privacy Control or Do Not Track signals. An emailed opt-out request can still be made. Any later introduction of covered tracking must be assessed and the required signal and choice handling implemented before use; absence of that integration is not permission to disregard an applicable right.
12. Football content, sources and attribution
The service presents professional players’ names, match events and performance predictions. Fan topics are presented as rewritten questions rather than republication of individual comments and supporter identities. These content subjects differ from visitors using a search or challenge.
The data and sources page describes the publication approach. Where we use public material or data, the applicable licence, source and named individual-author attribution must be respected. Naming an author does not by itself establish permission to publish or reuse the material.
If information about you in our content is inaccurate or you wish to raise a privacy objection, email the page address, the passage and relevant evidence. We will consider the applicable basis, rights, public-interest context and any lawful exception. This is not a promise that every historical match record will be erased, or that public professional data is outside privacy law.
13. Adults and security
The service is intended for adults aged 18 or over, and is not directed at minors. We do not invite children to use the search, challenges or support-payment feature. The site currently has no date-of-birth collection or technical age-verification system; the policy must not be mistaken for a claim that age has been verified.
If you believe we have received a child’s personal information, contact us. We will investigate and take appropriate steps to remove information that should not be held, subject to applicable legal requirements. No guardian-consent exception is offered as a way to open the service to minors.
Information should be protected using appropriate organisational and technical measures, including access limited to a relevant purpose. No online transmission or storage is guaranteed secure. The public infrastructure and its safeguards must be checked as part of deployment; this document does not certify an unaudited configuration or describe a security incident that has not occurred.
14. Cookies and updates
Read the separate Cookies Policy for cookies, local storage, payment-service technology, removal instructions and the distinction between current inventory and production checks. This notice does not treat a policy link as consent or imply that a cookie-settings control exists where none has been implemented.
We will revise this notice when purposes, providers or practices materially change, identify the revision date and use an appropriate notice method. Where consent is required for a new activity, an updated notice alone is not enough. Contact details and rights requests remain available through the address above.
The English version of this policy is authoritative. The Chinese version is provided as a translation. If the versions differ, the English wording controls, subject to applicable mandatory rights. The effective date will be set at public launch; the date above records the latest revision.