Privacy Policy

1. Who we are

SportsLab (the "Service") is the data controller for personal information processed through this site. Contact details are on the Contact page.

2. What we collect

• Account data: email address, password hash, account creation timestamp.
• Forecast inputs: the questions, sports, leagues, events, and selections you submit.
• Forecast outputs: probabilities, evidence summaries, and resolution status linked to your account.
• Bet-tracker entries: stake, odds, settlement, and notes you choose to log. These stay private to your account.
• Usage telemetry: pages visited, feature usage, error reports, IP address, device and browser metadata.
• Billing data: handled by our payment processor; we receive transaction status, last-4 digits, and country — not full card numbers.

3. How we use it

• To operate the Service: produce forecasts, render your history, process payments, send operational email.
• To improve calibration: aggregate, de-identified outcome data feeds the engine's learning loop.
• To keep the Service safe: detect abuse, prevent fraud, enforce acceptable-use rules.
• To comply with law: respond to lawful requests and regulatory obligations.

4. Legal bases (GDPR / UK GDPR)

We rely on: contract (to provide the Service), legitimate interests (security, product improvement), consent (optional notifications), and legal obligation (tax, regulatory).

5. Sharing

We do not sell personal information. We share it only with:

• Infrastructure providers (hosting, database, email) bound by contractual confidentiality and processing terms.
• Payment processor (for subscription billing).
• Law enforcement or regulators when legally required.

6. International transfers

Some processors operate outside your country. Where required, transfers from the EEA/UK rely on Standard Contractual Clauses or equivalent safeguards.

7. Retention

• Account & forecast data: kept while your account is active, plus 12 months after closure.
• Billing records: kept for 7 years to comply with tax law.
• Usage telemetry: aggregated after 90 days; raw logs deleted after 12 months.
• Backups: rotated within 35 days.

8. Your rights

Depending on your jurisdiction you may request access, correction, portability, deletion, restriction, or objection. See Your Data Rights for how to exercise them.

9. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access is limited to authorised personnel under role-based controls. We will notify affected users and applicable regulators of any qualifying personal-data breach without undue delay.

10. Children

The Service is for adults aged 18+. We do not knowingly collect data from anyone under 18; contact us if you believe a minor's data is held and we will delete it.

11. Cookies

See the Cookie Policy for what we set and how to manage preferences.

12. Changes

Material changes will be notified by email or in-app at least 14 days before they take effect.

13. Contact

Privacy requests, questions, or complaints: /legal/contact.