Privacy Policy

Data We Collect

We collect the following categories of personal data:

• Account data (email address
• password hash)
• Subscription and billing data (plan type
• payment status — full payment details are handled by Stripe)
• Usage data (predictions viewed
• coupons generated
• analytics interactions)
• Settings and preferences (risk profile
• timezone
• notification preferences)
• Technical data (IP address
• browser type
• device information via cookies)

Legal Basis for Processing

We process your data under the following legal bases: contract performance (account and subscription management), legitimate interest (service improvement, fraud prevention), and consent (analytics cookies, marketing emails).

How We Use Your Data

We use your data to operate and improve the platform, process payments, personalize your experience, send transactional emails, monitor service performance, and detect fraud or abuse.

Data Sharing

We do not sell your personal data. We share data only with: Stripe (payment processing), Resend (transactional emails), PostHog (analytics, with your consent only). All processors are GDPR-compliant and bound by data processing agreements.

Data Retention

Active account data is retained while your account exists. Prediction data older than 90 days is archived. Odds data older than 180 days is deleted. After account deletion, personal data is removed within 30 days, except where retention is required by law.

Your Rights (GDPR)

Under GDPR, you have the right to:

• Access your personal data (data export available in Account Settings)
• Rectify inaccurate data
• Erase your data ("right to be forgotten")
• Restrict processing
• Data portability (JSON export via /api/v1/export/gdpr/json)
• Object to processing
• Withdraw consent at any time

Security Measures

We implement industry-standard security measures including encrypted data transmission (TLS), hashed passwords, CSRF protection, rate limiting, and regular security audits.

Cookies

We use essential cookies for authentication and session management. Analytics cookies (PostHog) are only activated after your explicit consent via the cookie banner. You can change your cookie preferences at any time.

Children's Privacy

Our service is not intended for individuals under 18 years of age. We do not knowingly collect data from minors.

Policy Changes

We will notify you of material changes to this policy via email. Continued use after notification constitutes acceptance.

Contact & DPO

For privacy inquiries or to exercise your rights, contact [email protected].