How Stat Notes collects, uses, stores, and protects personal data. Written to answer the questions an enterprise procurement team and a GDPR data subject will actually ask.
This is a working draft of the Stat Notes Privacy Policy. Final legal text will be reviewed by counsel before any production contract is signed. The substance below accurately describes current practice; the phrasing is subject to legal review.
Stat Notes is a software-as-a-service (SaaS) product that delivers real-time statistical notes from a broadcast stats desk to on-air talent monitors. It is operated by Fat Brain Group, LP ("Stat Notes," "we," "us"). The founder and operator of record is Colin DeFord.
This Privacy Policy describes how we collect, use, disclose, and protect personal data when you or your organization use the Stat Notes service at statnotes.app and any tenant subdomain (e.g. customer.statnotes.app). It applies to tenant administrators, end users within a tenant, and visitors to the marketing site.
For the avoidance of doubt: we are a data processor with respect to the content a customer's users place inside their workspace (notes, user accounts, audit log entries), and a data controller with respect to the account and billing information we collect directly from a tenant administrator.
We collect only the information we need to operate the service. No marketing profiles. No device fingerprints. No behavioral tracking.
acme for acme.statnotes.app).We use the information described in §2 only for the following purposes:
We do not use personal data for advertising. We do not sell personal data. We do not share personal data with data brokers. We do not use customer content to train machine-learning models, ours or anyone else's.
For individuals in the European Economic Area, the United Kingdom, and Switzerland, we rely on the following legal bases under Article 6 of the GDPR / UK-GDPR:
| Purpose | Legal basis |
|---|---|
| Providing the contracted SaaS to the tenant | Contract — Art. 6(1)(b). Necessary to perform our agreement with the customer. |
| Billing and subscription management | Contract — Art. 6(1)(b). |
| Security, audit logging, fraud prevention | Legitimate interest — Art. 6(1)(f). Necessary to secure our service and protect customers; balanced against the minimal data retained. |
| Transactional service communication | Contract — Art. 6(1)(b) for magic links and receipts; legitimate interest for security alerts. |
| Responding to data subject requests and legal process | Legal obligation — Art. 6(1)(c). |
| Any future optional feature requiring consent | Consent — Art. 6(1)(a). Withdrawable at any time; we have none of these today. |
We use the following sub-processors to deliver the service. Each has been selected for its security posture and its willingness to sign a Data Processing Addendum. We do not add sub-processors without updating this list.
| Sub-processor | Role | Data processed | Privacy policy |
|---|---|---|---|
| Cloudflare, Inc. | CDN, DNS, WAF, DDoS protection, TLS termination at the edge for every tenant subdomain | IP addresses, request metadata, TLS handshake data | cloudflare.com/privacypolicy |
| Stripe, Inc. | Payment processing, subscription management, invoicing | Billing email, card details (held by Stripe only), subscription status, invoice history | stripe.com/privacy |
| Hostinger International Ltd. | VPS hosting (origin server) and transactional email (SMTP) for magic links and service notifications | Email addresses, magic-link bodies (in transit only), application and database files on the VPS | hostinger.com/privacy-policy |
We do not use any analytics, tag manager, marketing automation, advertising, A/B testing, session-replay, or behavioral-tracking vendor. The list above is the complete list.
If you are in the European Economic Area, the United Kingdom, Switzerland, California, or another jurisdiction with equivalent data protection law, you have the following rights with respect to the personal data we hold about you. We honor these rights for every data subject regardless of location.
California residents have parallel rights under the CCPA/CPRA (right to know, delete, correct, and opt out of "sale" or "sharing"). We do not sell or share personal information as those terms are defined by the CCPA/CPRA.
Email [email protected] with the subject line "Data Subject Request" and a short description of what you are asking for. You do not need a template; a plain-English request is fine.
We will acknowledge receipt within 5 business days and respond substantively within 30 days (or within the shorter period required by applicable law). If we need to extend the response window because of the complexity or volume of a request, we will tell you why and when to expect a response.
If you are an end user within a tenant (for example, a user at an ESPN-run workspace), your tenant administrator is your first point of contact for access, correction, and deletion — they can do all of those things directly in the admin page. If they are unable to help, we will route a request through them to preserve the customer relationship.
We will verify the identity of the requestor before fulfilling a request. For tenant users, verification is typically done by confirming the request from the email address on file. For larger requests, we may ask for additional verification.
Stat Notes hosts all production data in the United States, single region, no cross-border replication (see the Security Overview, §8). Cloudflare operates a global edge network and may terminate TLS and serve cached assets from points of presence outside the United States, but the origin database and application server are US-based.
For customers and data subjects in the European Economic Area, the United Kingdom, or Switzerland, we are happy to enter into the Standard Contractual Clauses (SCCs) published by the European Commission (Module 2: controller-to-processor) as part of a Data Processing Addendum. The UK IDTA and the Swiss addendum are available on the same basis. Email [email protected] to request a DPA.
We have performed a transfer impact assessment aligned with the Schrems II framework. Our technical safeguards (TLS 1.3 in transit, AES-256-GCM for secrets at rest, strict tenant isolation, minimal data collection) are designed to provide protection equivalent to EU standards against unauthorized access, including government access requests. We will notify affected customers of any government request for their data to the extent legally permitted.
The technical and organizational measures we use to protect personal data are described in detail on the Security Overview. The summary:
No security program is perfect, and we are honest about the gaps we have not yet closed — see the Compliance posture and known gaps section of the Security Overview.
Stat Notes is a business-to-business tool for professional broadcast operations. It is not directed at children and is not intended for use by anyone under the age of 16. We do not knowingly collect personal data from children under 16. If you believe we have inadvertently collected such data, email [email protected] and we will delete it promptly.
We may update this Privacy Policy from time to time — for example, to reflect a new sub-processor, a new feature, or a change in applicable law. When we make a material change, we will:
Historical versions of this policy are available on request.
Privacy questions, data subject requests, DPAs, SCCs, or anything else in this policy:
Email: [email protected]
Subject line: "Privacy" or "Data Subject Request"
Owner: Colin DeFord, Founder
Legal entity: Fat Brain Group, LP
Response target: acknowledgment within 5 business days, substantive response within 30 days
If your organization requires an EU or UK representative under GDPR Article 27, contact us to discuss — we will appoint one as part of the DPA process where required.