What if your AI just leaked your fans to OpenAI?

Every football club wants AI on their fan messages. The problem: every fan message is full of names, emails, booking IDs, and addresses. Most AI pipelines just forward all of it to the LLM.

That was the challenge Raumdeuter AI posed at the Campus Founders AI Hackathon. Build something that lets clubs actually analyze fan messages without exposing personal data to external models. Our team won the challenge category.

Afzaal Afzal presenting the Raumdeuter AI privacy challenge solution at Campus Founders hackathon — Opening the pitch with the question every sports club using AI should be asking.

The problem is bigger than it looks

Football clubs sit on millions of fan messages: ticket inquiries, complaints, transfer rumors, personal requests. That data has real value for understanding sentiment, urgency, and what fans actually need. But a message like "I want to book two seats, my email is [email protected], booking ref #48291" cannot go to an external LLM as raw text.

Most teams handle this in one of two ways: skip AI analysis entirely, or send the raw message and assume the model provider handles data responsibly. The first wastes the data. The second is a GDPR problem waiting to happen.

The Raumdeuter challenge made the stakes concrete. Football clubs are sitting on fan message datasets worth millions in untapped insight, and the privacy risk is the only thing blocking them from using it.

Team presenting the fan data opportunity at Campus Founders AI hackathon — Presenting the business case, and the team after winning the challenge track.

Raumdeuter AI hackathon winning team with Campus Founders prize bags — Presenting the business case, and the team after winning the challenge track.

What we built

The pipeline has four stages, and the core invariant is simple: raw personal data never reaches the LLM.

Detect. A named entity recognizer scans each message for PII: names, email addresses, phone numbers, booking references, home addresses.

Mask. Every detected entity is replaced with a typed placeholder. [email protected] becomes [EMAIL_1]. #48291 becomes [BOOKING_ID_1]. The message structure and intent stay intact.

Verify. Before anything leaves the system, a second pass runs against the original text to confirm no PII survived the masking step. This is the check most pipelines skip and the one that matters most.

Send. Only the anonymized message reaches the LLM. The model returns structured output: sentiment, urgency level, topic, a short summary, and a recommended action for the club.

The output is genuinely useful fan intelligence. The input that produced it contains no personal data that could be exposed, logged, or retained by an external provider.

The result

Out of roughly 100 applicants, 17 teams were selected across five real-world challenge tracks. We placed first in the Raumdeuter AI track and advanced to the final pitch rounds.

The judge on the Raumdeuter side was a co-founder of the company, and he had posed the challenge himself. Winning with a working implementation rather than a concept was the part I am most proud of.

The team: Areej Anjum, Bilal Muhammad, and me, all from 42 Heilbronn.

Following the hackathon, Raumdeuter extended an internship offer to me based on the work we presented. I did not join due to personal reasons, but the offer was a meaningful signal that the solution held up well beyond the competition context.