Privacy Policy
Effective 13 October 2026
We collect as little personal data as we can. We do not use advertising, analytics or tracking cookies, and we never sell your data.
1. Controller
The controller responsible for your data is the operator of OddsEdge. For any privacy question or request, contact [email protected].
2. What we collect and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address, optional name, password (stored only as a salted hash) | Creating and securing your account, signing in, service messages | Contract, Art. 6(1)(b) |
| Purchases: plan, date, amount, payment reference, your consent to immediate access | Giving you access, handling cancellations and refunds, accounting | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| IP address and request details | Protecting the Service against abuse (e.g. limiting password guessing) and fixing errors | Legitimate interest in security, Art. 6(1)(f) |
| Session cookie | Keeping you signed in and protecting forms against forgery | Strictly necessary; Art. 6(1)(b) and (f) |
We do not receive or store your card number. Card details are entered on Stripe's payment page and processed by Stripe.
3. Cookies
We use a single, strictly necessary session cookie. It is signed so it cannot be tampered with, and it expires after 14 days or when you sign out. We use no analytics, advertising or third-party cookies, so no cookie consent banner is needed.
4. Who receives your data
- Stripe (Stripe Payments Europe Ltd., Ireland) processes payments. For fraud prevention and legal compliance Stripe acts as an independent controller; see Stripe's privacy policy.
- Our hosting provider stores the Service's data on servers in the European Union on our behalf, under a data processing agreement.
We do not share your data with anyone else unless the law requires it.
5. Transfers outside the EU
We store your data in the EU. Stripe may process some data in other countries, including the United States, using safeguards approved by the European Commission (such as the EU-U.S. Data Privacy Framework and Standard Contractual Clauses).
6. How long we keep it
- Account data: until you delete your account.
- Purchase records: as long as tax and accounting law requires (generally up to 10 years), even after account deletion. These records are not linked to your email once your account is deleted.
- Security data (IP addresses for abuse protection): kept in memory for at most one hour; server logs are kept for up to 14 days.
7. Your rights
You have the right to access your data, correct it, have it deleted, restrict or object to its processing, and receive it in a portable format. You can delete your account yourself on your account page; for other requests contact [email protected]. We reply within one month.
You may also complain to a data protection authority, in particular the one in the EU country where you live.
8. Security
We use HTTPS, salted password hashing, protection against password guessing and form forgery, and restricted access to our servers and databases.
9. Age
The Service is only for people aged 18 or over. We do not knowingly collect data from minors.
10. Changes
We will publish any changes to this policy here with a new effective date, and tell members about significant changes in advance.