Privacy Policy
Pursuant to GDPR (General Data Protection Regulation). The German version is legally binding; this is a courtesy translation.
1. Controller
André Kipphard
Erlenbusch 12
33106 Paderborn
E-mail: [email protected]
2. Data collected and purposes
Account data
When you register we collect your e-mail address, username and a hashed password (we never store the plaintext password). This data is necessary for contract performance (Art. 6(1)(b) GDPR).
Telegram Chat ID
Users who enable notifications voluntarily provide their Telegram Chat ID. It is used exclusively to deliver value-bet signals (Art. 6(1)(b) GDPR).
Payment data
All payment processing is handled by Stripe. We do not store credit card numbers or raw payment instrument data. After a successful payment Stripe only sends us a subscription status signal (Art. 6(1)(b) GDPR).
Server and access logs
Our host (Hetzner Online GmbH) records technical data including IP address, timestamp, requested page, HTTP status code and bytes transferred. This data is processed for system security and error analysis (Art. 6(1)(f) GDPR — legitimate interest).
3. Legal bases
- Art. 6(1)(b) GDPR — Contract performance: account data, payment processing, Telegram notifications.
- Art. 6(1)(f) GDPR — Legitimate interests: server logs for IT security and error analysis.
- Art. 6(1)(a) GDPR — Consent: for web analytics via Google Analytics (only after your explicit opt-in via the cookie banner; withdrawable at any time, see Section 8).
4. Recipients and processors
Hetzner Online GmbH
Server hosting. Location: Germany. A data processing agreement (DPA) under Art. 28 GDPR is in place.
Stripe Payments Europe, Ltd.
Payment processing. Stripe processes payment data; we receive only the subscription status signal. Stripe transfers data to the USA on the basis of Standard Contractual Clauses (SCC) under Art. 46(2)(c) GDPR.
Telegram Messenger
Delivery of notifications to users who have provided a Telegram Chat ID. Telegram operates servers in various countries; transfers to third countries are possible.
Resend (Plus Five Five, Inc.)
Delivery of account-related e-mails (e.g. sign-in links / password reset). Resend processes the e-mail address and transfers data to the USA on the basis of Standard Contractual Clauses (SCC) pursuant to Art. 46 (2) (c) GDPR.
5. Third-country transfers
Stripe and Resend transfer data to the USA. Each transfer is based on Standard Contractual Clauses (SCC) approved by the European Commission under Art. 46(2)(c) GDPR. More information is available in the privacy policies of Stripe (stripe.com/privacy) and Resend (resend.com/legal/privacy-policy).
6. Retention periods
- Account data — until account deletion or expiry of statutory retention obligations.
- Invoices and payment records — 10 years pursuant to § 147 AO (German fiscal code).
- Server logs — short-term (typically 7–30 days), unless required longer for investigation of a specific incident.
7. Your rights as a data subject
- Access (Art. 15 GDPR) — right to know what data we process about you.
- Rectification (Art. 16 GDPR) — right to have inaccurate data corrected.
- Erasure (Art. 17 GDPR) — right to have your data deleted, unless statutory retention obligations apply.
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR) — right to receive your data in a machine-readable format.
- Objection (Art. 21 GDPR) — right to object to processing based on legitimate interests.
- Right to lodge a complaint — you may file a complaint with a supervisory authority. In Germany, the competent authority is generally that of the federal state in which we are based.
Please direct requests to: [email protected].
8. Cookies
To operate the service we use one technically necessary session cookie, set by our authentication system (Auth.js). This cookie is essential and does not require consent. Analytics cookies (below) are only set after your consent.
Analytics / statistics — Google Analytics 4
We use Google Analytics 4, a service of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to analyse how our website is used. Google Analytics sets cookies and processes, among other things, your (anonymised) IP address, the pages you visit, time on page and device information. IP anonymisation is enabled.
This processing takes place solely on the basis of your consent (Art. 6(1)(a) GDPR), given via our cookie banner. Without your consent, no analytics cookies are set and no Google Analytics script is loaded. You can withdraw your consent at any time with effect for the future via the “Cookie settings” link in the footer. Data is transferred to Google LLC in the USA on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More information: policies.google.com/privacy.
9. Privacy contact
For data protection enquiries please contact: [email protected].