Privacy Policy

Accounts: Only the site operator has an account; visitors neither need nor get one. Operator account data is kept while the site runs. Telegram, Stripe (VIP), PostHog (with consent) and Data API keys are handled separately. Accounts created before sign-up closed on 23 October 2026 hold an email address (and a hashed password, if one was set) and nothing else; we can delete yours on request.

Usage analytics (only with your consent): If you tap “OK” on the cookie notice, we use PostHog (page views and a few product events), Microsoft Clarity (heatmaps and session recordings) and the Meta Pixel (page views). If you tap “OK”, PostHog may also record some visits to our public pages as a session replay — where you tap, scroll and stop reading — so we can fix the layout. Anything you type is hidden before it leaves your device, and sign-in, account and payment pages are never recorded. If you decline, or have not chosen yet, none of them load. You can change your choice at any time with “Cookie settings” in the footer of every page (choosing “No” there stops them), or by clearing this site’s data in your browser.

Preference data: Your in-app preferences are stored in our own database, on a server we rent from Hetzner in Helsinki, Finland (EU).

VIP subscription data: If you buy OddsIntel VIP, we store your Telegram user id and username, the email you give at checkout, and your Stripe customer and subscription ids, so we can let you into the VIP channel, remove you when the subscription ends, and answer billing questions. Legal basis: the contract. Card details stay with Stripe.

Supabase: Sign-in (authentication) provider: it stores your email address and a hashed password, or your Google sign-in.

Hetzner: Hosts our website and database in Helsinki, Finland (EU).

Sentry: Error monitoring. When a page fails, it receives technical details of the error (browser, page, time).

PostHog, Microsoft Clarity, Meta: Analytics, only after you accept (see above). PostHog processes data in the United States.

Stripe: Processes VIP subscription payments (name, email, card and billing details). We never see or store card details.

Resend:Sends our emails, including the football email list’s confirm email (see section 4), the OddsIntel Data waitlist’s confirm email (see section 5) and OddsIntel Data API key emails (see section 5a).

Telegram: Delivers the VIP channel and our VIP bot, which sees your Telegram user id and username when you use it.

Status: the football score email has not started, and sign-ups are closed for now. No score emails have been sent.

What we hold: if you signed up on our football scoreboard, we store your email address, when you signed up and confirmed, the consent sentence you saw next to the form, the page you signed up on and the link (utm tags) that brought you there, and a keyed hash of your IP address used only to spot abuse. It is stored in our own database in Helsinki, Finland (EU).

Purpose and legal basis: to email you our football score calls and how they went, and nothing else. The legal basis is your consent, which you give by confirming your address. You can withdraw it at any time with the one-click unsubscribe link in every email, or by emailing us.

Who sends the email:Resend (Plus Five Five, Inc., San Francisco, USA) sends our emails as our processor; it sent the confirm email. Resend processes data in the United States. The transfer is covered by the Standard Contractual Clauses (EU Commission decision 2021/914) in Resend’s data processing agreement.

How long we keep it: an address that is never confirmed is deleted once its confirm link expires (7 days; a nightly job removes it). A confirmed address is kept until you unsubscribe. After that it is reduced to a suppression entry (the address and the dates), so we never email it again.

Removal: to have your address removed, email [email protected].

Who: the controller is Codename OÜ, Estonia. The waitlist is for businesses that want to hear about the beta and launch of our odds-data service, OddsIntel Data.

What we hold: your email address, company, what you would use the data for, and, only if you give them, a line about who you are, your role, VAT number, budget band, timing and whether you ticked the launch-price intent box; the notice and consent sentences you saw; and when you signed up and confirmed. Stored in our own database in Helsinki, Finland (EU). We do not store your IP address in the waitlist. Our network provider (Cloudflare), our web server logs and our email provider (Resend) see it briefly for security and delivery, and Cloudflare may run a bot check (Turnstile) when you send the form.

Purpose and legal basis: to judge whether the service fits you and to email you about the OddsIntel Data beta and launch. The legal basis is our legitimate interest in answering a business enquiry (GDPR Art. 6(1)(f)); you can object at any time. Offers are emailed only if you ticked the separate, optional box (your consent, Art. 6(1)(a)), which you can withdraw at any time.

Double opt-in: we send one email asking you to confirm your address (Resend sends it as our processor, see section 4 for the transfer basis). You are on the list only once you confirm.

How long we keep it: an unconfirmed sign-up is deleted once its confirm link expires (7 days); every sign-up is deleted at the latest 12 months after it was made. A nightly job does both.

Deletion on request: email [email protected] from the address you signed up with and we delete your entry within 30 days.

Who: the controller is Codename OÜ, Estonia.

What we hold:when you request an OddsIntel Data API key, your name, work email address, company, what you would use the data for and the plan you are interested in. For a paid plan we also hold your company’s legal name, its VAT or registration number and your confirmation that you are buying for business purposes: paid plans are sold to businesses only, and we need these to contract with and invoice the right company. They are kept as long as the rest of your key request data (see below); where they appear on an invoice, the invoice is kept as long as accounting law requires. If we issue a key, we also hold its plan, limits and status, a fingerprint (hash) and short prefix of the key (never the key itself), and when it was issued or revoked. Stored in our own database in Helsinki, Finland (EU).

Your IP address: we do not store your IP address itself. To stop one person taking many free keys, we keep a keyed hash of it (a one-way fingerprint that cannot be turned back into the address) with your request for 14 days, then delete it. Our network provider (Cloudflare) and our server see the address briefly, for security and to limit repeated requests, and Cloudflare may run a bot check (Turnstile) when you send the form.

Purpose and legal basis: to review your request, issue a key and contact you about it. The legal basis is taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)).

API request logs: when you use a key, we log the key id, the endpoint called, the time and the response status. We use the logs to apply rate limits, to spot abuse and, once paid plans exist, for billing. Logs are kept for 90 days.

Key usage and shared keys: for each key and day we count the requests and the rows of data returned, and keep a one-way fingerprint of each network the key was used from (the network part of the IP address: the first three numbers of an IPv4 address, or the first 48 bits of an IPv6 address, hashed with a secret value and the date). A fingerprint cannot be turned back into an address and cannot be matched across days. We use it only to see whether a key is used from more networks than one customer would, and we delete it after 14 days. We never store the IP address itself. The daily request and row counts are kept as usage records for as long as the key request data. The legal basis is our legitimate interest in preventing abuse of the service and in applying the plan limits (GDPR Art. 6(1)(f)).

Who processes it: the same providers as the waitlist (section 5): our network provider (Cloudflare), our web server and database host in Helsinki, Finland (EU), and Resend, which sends our emails (see section 4 for the transfer basis).

How long we keep it: key request data is kept while the key is active and for 12 months after it ends. A request we decline, or never answer, is deleted after 90 days.

Your rights: if you are in the EU/EEA, you have the right to access your data, correct inaccurate data, request deletion, object to processing, and data portability. To exercise these rights, email us at [email protected]. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).