Privacy Policy

1. Who We Are

SportsEdgePro ("we", "us", "our") is a football analytics subscription service. For GDPR purposes, we are the data controller for personal data collected through this service.

2. What Data We Collect

• Email address (required for account creation)
• Password (stored as a secure hash — we never store plain text passwords)
• Account tier and subscription status
• Login timestamps and IP addresses (for security purposes)
• GDPR consent timestamp

3. Why We Process Your Data

• Contract performance — to provide you access to the SportsEdgePro service
• Legitimate interest — to maintain security and prevent abuse
• Legal obligation — to comply with applicable laws
• Consent — for optional communications (you may withdraw at any time)

4. Data Retention

We retain your account data for as long as your account is active. Inactive accounts are deleted after 24 months. Login attempt logs are deleted after 90 days. You may request deletion of your account at any time.

5. Your Rights (GDPR)

If you are in the EU/EEA, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Data portability
• Lodge a complaint with a supervisory authority

To exercise any of these rights, email us at privacy@sportsedgepro.co.uk or use the account deletion option in your account settings.

6. Data Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We may share data with:

• Mailgun (email delivery) — subject to their privacy policy
• Our hosting provider (Hetzner) — for infrastructure purposes only
• Law enforcement — only when legally required

7. Cookies and Sessions

We use a single session cookie (fs_session) to keep you logged in. This is strictly necessary for the service to function. We do not use tracking cookies or third-party analytics.

8. Security

Passwords are hashed using PBKDF2-SHA256 with a unique salt. Sessions are stored server-side and expire after 30 days. We implement rate limiting to protect against brute force attacks.

9. Contact

For any privacy-related questions or requests: privacy@sportsedgepro.co.uk