Privacy notice
How NETFIGHT processes personal data. Updated 12 September 2026.
Controllers and contact
Fabian Kraushofer and Florian Bartl operate NETFIGHT jointly and are joint controllers. Address: Taborstraße 118/18, 1020 Vienna, Austria. You may exercise your rights against either of us through support@netfight.at. The planned Netfight FlexKapG has not yet been established and is not currently the controller.
Accounts, contracts and support
We process your name, email, salted password hash, verification status, sessions and watchlist. Passwords are not stored in plain text. Plans, payments and support also require plan, transaction, contract and correspondence data. Article 6(1)(b) GDPR covers requested pre-contractual steps and contract performance; statutory recordkeeping uses Article 6(1)(c). Without required account and payment data we cannot supply these services. Public pages remain available without an account.
Security, devices and views
Infrastructure providers process connection data including IP addresses. We use hashed rate-limit identifiers, device labels and recent activity to prevent abuse. An account can have three playback devices and one active player. Our legal basis is the legitimate interest in secure operation and enforcing agreed access (Article 6(1)(f)). Weekly popularity counts store at most one view per account, fight and day; only aggregate rankings are public. There is no automated decision with legal or similarly significant effects.
Cookies and browser storage
netfight_session maintains login for up to 30 days; netfight_device identifies a playback device for up to one year. Sessions and devices may be revoked earlier. The language preference is stored in the browser. These functions support the login, playback or language you request. We have not integrated our own advertising tracking. Fonts are served by NETFIGHT.
Email and Hot Fight News
Account, verification and reset emails provide requested services and security. Hot Fight News is optional and based on consent (Article 6(1)(a)). We record email, language, consent time and source. Newsletters require a separate email confirmation. Each edition includes an unsubscribe link; you may also email support@netfight.at. Withdrawal leaves your account and plan unchanged and does not affect earlier lawful processing. Account verification is separate from marketing consent.
Providers and international processing
Sites/OpenAI and Cloudflare provide hosting, databases, storage, security and streaming. Stripe processes payments and necessary account and transaction details; NETFIGHT does not store complete card details. Resend (Plus Five Five, Inc.) handles email addresses, messages and delivery information. Support mailboxes use World4You. Google processes connection and usage information when you explicitly load YouTube videos. Infrastructure and recipients may be outside the EEA, including the US. Applicable Chapter V GDPR safeguards, such as adequacy decisions or standard contractual clauses, govern transfers; contact us for details of the safeguards actually agreed. Provider notices linked below supplement this notice.
Retention and public sports information
Account data and watchlists are needed while the account exists. Verification links expire after 24 hours and password links after 30 minutes; expired links cannot be used. Security, delivery and consent records are retained only while needed for preventing abuse, evidencing consent or handling claims. Business records are subject to statutory retention, possibly longer for pending proceedings. Unsubscribed addresses may remain on a suppression list to prevent future marketing. Send deletion requests to support@netfight.at. Public fighter profiles, photos, gyms and results come from event records, participants and authorised material. Sports reporting relies on legitimate interests or consent where required. Contact us about inaccuracies or objections, particularly concerning minors.
Your rights
Subject to legal conditions, you may request access, correction, erasure, restriction and portability. You can object to legitimate-interest processing on grounds relating to your particular situation, and to direct marketing at any time. Consent can be withdrawn prospectively. We may request proportionate identity evidence. You may complain to Austria's Data Protection Authority (dsb.gv.at) or another competent authority. Contact support@netfight.at. Google and Apple sign-in are not enabled; no corresponding sign-in data is currently collected.
Optional visitor statistics
Only with your consent (Article 6(1)(a) GDPR), NETFIGHT uses netfight_analytics for up to 90 days. We store a hashed random browser identifier, consent version and time, page path and view time. Statistics do not store IP addresses, full user-agent strings, search terms or account links. Data is hosted by Sites/OpenAI and Cloudflare; no additional analytics provider is used. Only administrators can access reports. Records older than 90 days and expired identifiers are deleted on the next collection or report request and excluded from reports beforehand. You may decline or withdraw through “Statistics settings” at the bottom of the page; this also deletes statistics associated with your current browser identifier. netfight_statistics remembers only your choice: consent for up to 90 days, refusal for up to 180 days. Do Not Track or Global Privacy Control prevents recording. Different browsers or cleared cookies can count as multiple visitors. The website and your subscription work without this consent.