1. Who is responsible
Leven2k Media Ltd is the data controller for NBF Fantasy and the NBF website. Our registered address is 124 City Road, London, EC1V 2NX. We are registered in England and Wales under company number 15719526.
For privacy questions or rights requests, email [email protected]. We are registered with the UK Information Commissioner's Office under reference ZC172051.
2. Information we use
We process the following information when it is relevant:
- Discord identity: your Discord user ID, username or display name and avatar. We ask Discord only for the basic identity scope and do not receive your Discord password.
- Fantasy activity: manager name, squad selections, MVP choice, contest and region, league membership or ownership, timestamps, scores, ranks, awards and moderation outcomes.
- Technical data: session and security-cookie data, IP-derived rate-limit signals, request and security logs, device or browser information, and error diagnostics. After an account is closed, this can include a keyed cryptographic marker derived from the Discord ID. The marker is not the raw ID and is used only to recognise a later sign-in from the same closed or suspended identity.
- Usage data: limited, cookie-free product analytics events when analytics is enabled. We use these to understand whether core journeys work, not to build advertising profiles.
- Competitive match data: player handles and results obtained from competitive Fortnite data providers and public sources so that contests can be priced and scored.
We create an internal placeholder email address from a Discord ID because the account database requires a unique account key. It is not a real inbox and is never used to contact you.
3. What other people can see
NBF Fantasy is a leaderboard game. Your manager name, avatar, squad, league membership, score, rank, awards and results may therefore be visible to other players and may appear in an NBF Discord result recap. Do not use a manager or league name that reveals information you want to keep private.
We do not intentionally publish your Discord user ID, placeholder account email, IP address, security logs or private support correspondence.
4. Why we use it
- To create and secure your account, save squads, run leagues, score contests and publish standings. We rely on performance of our contract with you and our legitimate interest in providing the game.
- To prevent abuse, moderate names, investigate faults, protect the service, honour an account-closure instruction and keep contest results fair. We rely on our legitimate interests in security, community safety and contest integrity.
- To understand and improve the beta through limited analytics and error monitoring. We rely on our legitimate interest in operating a reliable service, with privacy-preserving settings and data minimisation.
- To respond to privacy requests and meet legal obligations. We rely on legal obligation and, where needed, our legitimate interest in establishing or defending legal claims.
5. Earlier contest reminders
Between June and July 2026, the former NBF Hub site collected email addresses through an opt-in whose wording covered Fantasy contest reminders, event updates, offers and marketing emails. That separate legacy system stores the address, the relevant contest or region, the consent wording and time, delivery status, and unsubscribe or suppression status. In practice it was used for contest-open reminders through Resend; other opted-in records were never sent.
The current NBF Fantasy site does not collect reminder emails and those records have not been copied into this database. We will not use the old list for a broader or newly defined marketing purpose, and sending from the legacy reminder system is paused. If reminders return, we will first introduce a fresh, specific choice and a complete migration that preserves every unsubscribe and suppression record rather than silently relying on the old broad wording.
Consent was the lawful basis for emails covered by that opt-in. We keep minimal unsubscribe and suppression information under our legitimate interest in making sure someone who opted out is not emailed again. To withdraw consent or ask us to remove an old NBF Hub reminder record, use the privacy email above. The signed-in account deletion control cannot reliably identify every legacy guest email record.
6. Cookies and device storage
We use only storage needed for sign-in and the game experience:
| Item | Purpose | Duration |
|---|---|---|
| nbf_fantasy_session | Keeps a signed-in account active. | 7 days |
| nbf_discord_identity | Used only by the separate legacy Discord call-in flow. A normal Fantasy sign-in does not set this cookie. | 24 hours |
| nbf_discord_oauth_state | Protects a Discord sign-in attempt against forgery. | 10 minutes |
| Local Fantasy preferences | Stores unsaved squad drafts, theme and dismissed guidance on your device. | Until you delete it, clear site data, or close your account |
Plausible analytics is configured without advertising cookies. We do not use Plausible to build advertising profiles. If advertising is enabled, Google and its advertising partners may place or read cookies, use web beacons, or process device and IP-address data to deliver, measure, secure and personalise ads where you have given the required consent. Where consent is not available, advertising may be limited or non-personalised. Visitors in the UK, EEA and Switzerland are shown an advertising consent choice through a Google-certified consent management platform before consent-based advertising storage is used.
8. How long we keep information
- Direct account identifiers are kept while the account is active. Closing the account removes or replaces those identifiers. The keyed closure marker remains while the closure instruction or a suspension must be enforced. You can ask us to review whether it is still needed.
- Pseudonymised contest entries, picks, scores and awards may remain for as long as the corresponding competition history is kept, so other players' results do not change.
- Security, rate-limit, error and infrastructure logs follow short operational or provider retention schedules. A relevant extract may be kept longer while an abuse report, security incident or legal claim is active.
- Legacy reminder data is kept only while needed to honour the original reminder choice, evidence consent, manage delivery, or preserve an unsubscribe or suppression. We will remove or minimise it when those purposes end.
- Backups and replicas may retain a protected copy until they roll off under the provider's backup schedule. Deleted data is not restored to live use.
9. Your choices and rights
Depending on the circumstances, you can ask for access, correction, deletion, restriction, portability, or object to our use of your personal data. You can withdraw email consent at any time. These rights are not absolute, but we will explain any lawful reason we cannot fully meet a request.
Signed-in Fantasy players can use the real self-service account deletion path. It removes the Discord ID, avatar, account name and internal account key; replaces public manager names with a neutral label; leaves shared leagues; disables owned invite links; clears the session; removes saved squad drafts from that browser; and securely queues cleanup of an account-linked legacy reminder record. NBF keeps the keyed closure marker described above so the same Discord identity cannot silently create a clean replacement account. Historical scores and audit facts may remain under the neutral label where needed for contest integrity, security or legal claims.
For an access request, a guest legacy reminder record that was never linked to Discord, a staff account, or anything the self-service path does not cover, email [email protected]. We may need to verify that the information belongs to you. We aim to respond without undue delay and normally within one month.
If you are unhappy with our response, you can complain to the Information Commissioner's Office.
10. Younger players
NBF Fantasy is for people aged 13 and over. If you are under 18, ask a parent or guardian to help if anything here is unclear. We design the service with high-privacy defaults, collect only what the game needs, do not run behavioural advertising, and do not use personal data to push younger players to spend money.
A parent or guardian can contact us about a young person's account or rights. We will consider the young person's best interests and verify the requester before disclosing information.
11. Automated decisions and changes
Scoring and ranking are calculated automatically from published game rules and competitive match data. They affect game standings only; we do not make solely automated decisions about you that have legal or similarly significant effects.
We will update this notice when the product or our processing changes. Material changes will be dated here and, where appropriate, called out in the product or NBF community.