Privacy Policy

At Footy Brain, we take your privacy seriously. This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our website and services.

This Privacy Policy describes our data practices. By using Footy Brain, you acknowledge that you have read and understand this policy.

1. Geographic Scope

Footy Brain serves users in the United States, European Union, European Economic Area, and United Kingdom with full regulatory compliance. Our primary markets are the United States and United Kingdom.

Users from other regions may access our service, but do so at their own risk and are solely responsible for compliance with applicable local laws. We make no representation that our service is appropriate, lawful, or available for use in any location outside our primary markets.

For users in the EU/EEA, we comply with the General Data Protection Regulation (GDPR). For users in the UK, we comply with the UK GDPR. See Section 7 below for your specific rights under these regulations.

2. Information We Collect

We collect information in the following ways:

Information You Provide

• Account information: When you create an account, we collect your email address and password. You may also provide your name.
• Payment information: When you subscribe, our payment processor (Stripe) collects your payment details. We do not store your full credit card number.
• Preferences: Favorite teams, leagues, and notification settings you configure.
• Communications: Information you provide when contacting our support team.
• Age confirmation: When you create an account, we record your confirmation that you meet the minimum age requirement (18 or the legal gambling age in your jurisdiction, whichever is higher).

Information Collected Automatically

• Usage data: Pages visited, features used, time spent on the service, and interaction patterns.
• Device information: Browser type, operating system, device type, and screen resolution.
• Log data: IP address, access times, and referring URLs.
• Cookies and similar technologies: See our Cookie Policy for details.

3. Legal Basis for Processing (EU/UK Users)

For users in the European Union, European Economic Area, and United Kingdom, we process your personal data under the following lawful bases:

• Contract: Processing necessary to provide our service to you, including account creation, subscription management, and delivering predictions.
• Consent: Marketing communications and optional analytics cookies. You may withdraw consent at any time.
• Legitimate interest: Analytics to improve our service, fraud prevention, and security monitoring. We have conducted balancing tests to ensure our interests do not override your rights and freedoms.
• Legal obligation: Compliance with applicable laws, such as tax and financial reporting requirements.

You have the right to object to processing based on legitimate interest. See Section 8 for details on exercising your rights.

4. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our services
• Process transactions and manage your subscription
• Send you service-related communications (account updates, security alerts, support messages)
• Personalize your experience based on your preferences and favorite teams
• Analyze usage patterns to improve our platform and user experience
• Detect, prevent, and address fraud and security issues
• Comply with legal obligations

We do not: Sell your personal information to third parties, use your data to profile your gambling behavior, or share your information with sportsbooks or betting operators.

5. Information Sharing and Disclosure

We may share your information in the following circumstances:

• Service providers: With third-party vendors who assist us in operating our platform (payment processing, analytics, email delivery, cloud hosting). These providers are contractually obligated to protect your data.
• Legal requirements: When required by law, court order, or government request, or to protect the rights, safety, or property of Footy Brain, our users, or the public.
• Business transfers: In connection with a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• With your consent: When you explicitly agree to share your information for a specific purpose.

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

6. Third-Party Services

We use the following third-party services that may collect and process your data:

• Better Auth: Authentication and user management (Privacy Policy)
• Stripe: Payment processing (Privacy Policy)
• Convex: Database and backend services (Privacy Policy)
• Vercel: Website hosting and analytics (Privacy Policy)
• Resend: Transactional email delivery (Privacy Policy)
• FootyStats: Sports statistics and match data. We send match identifiers to retrieve statistics; no personal user data is shared with FootyStats (Privacy Policy)

Each of these services has its own privacy policy governing how they handle data. We encourage you to review their policies.

7. Data Retention

We retain your personal information for the following periods:

• Account data (email, name, preferences): For the duration of your account, plus 30 days after deletion
• Usage logs (pages visited, feature usage): 12 months
• Payment records (transaction history, invoices): 7 years (as required by tax and accounting laws)
• Support communications: 3 years after resolution
• Security logs (login attempts, IP addresses): 90 days

Sports data from third-party providers is cached for performance optimization. Cached match data is retained for the current season plus one prior season, after which it is archived or deleted.

When you delete your account, we will delete or anonymize your personal information within 30 days, except where we are required to retain it for legal, tax, or regulatory purposes as described above.

8. Your Rights

As a user of Footy Brain, you have the following rights regarding your personal data:

Rights for All Users

• Access: Request a copy of the personal information we hold about you.
• Correction: Request correction of inaccurate or incomplete information.
• Deletion: Request deletion of your account and personal data.
• Opt-out: Unsubscribe from marketing communications at any time via the unsubscribe link in emails or through your account settings.

Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources of that information, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: Request deletion of your personal information, subject to certain exceptions.
• Right to correct: Request correction of inaccurate personal information.
• Right to opt-out of sale/sharing: We do not sell or share personal information for cross-context behavioral advertising, so this right does not apply.
• Right to limit use of sensitive information: We do not use sensitive personal information for purposes beyond what is necessary to provide our services.
• Non-discrimination: We will not discriminate against you for exercising your privacy rights.

Additional Rights for EU/EEA and UK Users (GDPR/UK GDPR)

If you are located in the European Union, European Economic Area, or United Kingdom, you have the following additional rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right to portability: Request your personal data in a structured, commonly used, machine-readable format, and have it transferred to another controller where technically feasible.
• Right to restrict processing: Request that we limit the processing of your personal data in certain circumstances.
• Right to object: Object to processing of your personal data based on legitimate interest or for direct marketing purposes.
• Right to withdraw consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: Lodge a complaint with a supervisory authority in your country of residence. For UK users, this is the Information Commissioner's Office (ICO). For EU users, contact your local data protection authority.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.

How to Exercise Your Rights

To exercise any of these rights, please contact us at privacy@footybrain.app. We will verify your identity and respond within the following timeframes:

• EU/EEA and UK users: Within 30 days, as required by GDPR/UK GDPR. We may extend this by two months for complex requests.
• California residents: Within 45 days, as required by CCPA/CPRA.
• All other users: Within 45 days.

You may designate an authorized agent to make a request on your behalf. If we need additional time, we will notify you of the extension and the reason.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS/SSL
• Encryption of sensitive data at rest
• Regular security assessments and monitoring
• Access controls and authentication requirements
• Secure data centers with physical security measures

However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

Data Breach Notification

In the event of a data breach that affects your personal information, we will notify you and relevant authorities within the timeframes required by applicable law. We will provide information about the nature of the breach, the data affected, and steps you can take to protect yourself.

10. Data Location and International Transfers

Footy Brain is based in the United States. Your data is stored and processed in the United States by our service providers (Convex, Vercel, Stripe).

For EU/EEA and UK Users

When your personal data is transferred from the EU/EEA or UK to the United States, we ensure appropriate safeguards are in place:

• Stripe: Certified under the EU-US Data Privacy Framework and maintains Standard Contractual Clauses (SCCs). See Stripe's Data Processing Agreement.
• Convex: Implements appropriate technical and organizational measures for data protection.
• Vercel: Maintains Standard Contractual Clauses for international transfers.

For Users Outside Primary Markets

If you access our services from outside the US, EU/EEA, or UK, your information will be transferred to and processed in the United States. By using our service, you consent to this transfer. We will still honor data subject requests (such as deletion) as a matter of goodwill, though we may not be legally obligated to do so under your local laws.

11. Children's Privacy

Footy Brain is not intended for individuals under the age of 18 (or the legal gambling age in your jurisdiction, if higher). We do not knowingly collect personal information from children. All users must confirm they meet the minimum age requirement via an age consent checkbox during account creation.

If we become aware that we have collected personal information from a child, we will take steps to delete that information promptly. If you believe we have inadvertently collected information from a child, please contact us at privacy@footybrain.app.

12. Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Keep you signed in to your account
• Remember your preferences and settings
• Understand how you use our service
• Improve our platform based on usage patterns

For detailed information about the cookies we use and how to manage them, please see our Cookie Policy.

13. Do Not Track and Global Privacy Control

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want your online activity tracked. There is currently no uniform standard for how websites should respond to DNT signals. At this time, Footy Brain does not respond to DNT signals.

We do not currently respond to Global Privacy Control (GPC) signals. Since we do not sell or share personal information for cross-context behavioral advertising, GPC opt-out signals are not applicable to our service.

14. Automated Processing and Predictions

Footy Brain uses machine learning models to generate match predictions and probability assessments. These automated systems analyze historical sports data to produce statistical outputs.

Our predictions are informational only and do not result in legal or similarly significant effects on users. We do not use automated processing to make decisions about your account access, pricing, or eligibility for services.

The predictions you see are the same for all users viewing the same match — they are not personalized based on your individual data.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

When we make material changes, we will notify you by email or through a prominent notice on our website at least 14 days before the changes take effect. We encourage you to review this Privacy Policy periodically.

16. Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

For general inquiries about our service, please see our Terms of Service.