Privacy Policy

The controller of the personal data processed via the GameOdds service (website and mobile application) is Daïa Group. Full company details are available in the Legal Notice.

No Data Protection Officer (DPO) has been appointed, as the company does not meet the mandatory designation criteria of Article 37 GDPR.

For any question about this policy or to exercise your rights, contact us at contact@thegameodds.com.

In the course of providing the service, we process the following categories of data:

• Account data: e-mail address, display name and, where provided, an avatar image. These are collected when you create an account — either with e-mail and password, or through Google sign-in (in which case Google shares your name, e-mail and profile picture with us; we never receive your Google password). Authentication is handled by Supabase Auth.
• Subscription and usage data: your current plan (Free, Starter, Pro, Pro Annual) and counters of the AI analyses you generate, used to enforce plan limits.
• Generated analyses: the AI analyses you request are saved to your account so you can re-read them for free. Their content concerns public sports events (teams, players, scores) — not you.
• Technical and security data: IP address, browser and device type, and basic request logs, kept for security purposes on the basis of legitimate interest. From the IP address we derive an approximate location (country and city) at the time of the request, used for account security and service administration; the IP address itself is not stored in the application database. GameOdds does not use any advertising or audience-measurement trackers.

The sports data displayed in the app (fixtures, scores, lineups, rankings) is public information about public teams, competitions and professional athletes; it is not personal data about you.

We do not collect any “special category” data within the meaning of Article 9 GDPR (ethnic origin, political opinions, health data, etc.).

The purposes of processing and their legal bases under Article 6 GDPR are:

• Providing the service — legal basis: performance of the contract (Art. 6.1.b). Covers account creation and management, game browsing, and generating and storing your AI analyses.
• Enforcing plan limits and managing subscriptions — legal basis: performance of the contract (Art. 6.1.b).
• Security and fraud prevention — legal basis: legitimate interest (Art. 6.1.f), namely ensuring the integrity and security of the service.
• Service improvement — legal basis: legitimate interest (Art. 6.1.f), to the extent improvements directly benefit users without overriding their fundamental rights.
• Retention of billing records, where applicable — legal basis: legal obligation (Art. 6.1.c) under applicable tax and accounting rules.

Data is retained for the following periods:

• Account data (e-mail, name, avatar): for the life of the account, then deleted when the account is deleted.
• Generated analyses, subscription and usage data: for the life of the account; deleted with the account.
• Technical and security logs: up to 12 months from collection.
• Billing records, where applicable: up to 10 years, in line with statutory accounting retention obligations.

Deleting your account (see section 9) removes your account data, subscription, usage history and saved analyses immediately.

Your data is never sold to third parties. Strictly for the purpose of providing the service, we rely on the following processors:

• Vercel, Inc. (United States) — hosting and delivery of the website. Vercel handles network requests and may process visitor IP addresses.
• Supabase, Inc. (United States — data hosted in the European Union, AWS region eu-west-1, Ireland) — database, user authentication and server functions (Edge Functions). All user data is stored on servers located in the EU.
• Anthropic, PBC (United States) — generation of the AI game analyses. The requests sent to Anthropic contain sports data about the game being analyzed (teams, statistics, model predictions); they do not include your personal data. Requests are not retained by Anthropic beyond processing.
• Google Ireland Limited (Ireland) — Google sign-in (OAuth), when you choose it: Google shares your basic profile (name, e-mail, avatar) to create your account.
• Google Play (Google Ireland Limited) — processing of subscription payments made through the Android application. Payment details (card numbers) are handled entirely by Google Play; GameOdds never sees or stores them and only receives your subscription status.

This list is kept up to date; any substantial change will be reflected in this policy.

User data is hosted in the European Union (AWS eu-west-1, Ireland) via Supabase. However, some of our processors are established in the United States, which entails transfers outside the EEA for certain processing operations.

These transfers are governed by the following safeguards:

• EU-US Data Privacy Framework (DPF), for processors certified with the US Department of Commerce, recognized as adequate by the European Commission (decision of 10 July 2023).
• Standard Contractual Clauses (SCCs) adopted by the European Commission, incorporated into processing agreements for transfers to third countries without an adequacy decision.

For information on the specific safeguards in place with each processor, contact us at contact@thegameodds.com.

GameOdds uses essential cookies only:

• Authentication cookies (Supabase session tokens, JWT), strictly necessary for signing in and keeping your session active. They cannot be disabled without breaking the service. Duration: the session, or a few days for refresh tokens.

We use no analytics, advertising or cross-site tracking cookies — which is why the site shows no cookie banner. You can manage cookies in your browser settings; disabling essential cookies will prevent sign-in.

We implement the following technical and organizational measures to protect your data:

• Encryption in transit: all communication between your device and our servers uses HTTPS/TLS.
• Encryption at rest for data stored in the database.
• Row Level Security (RLS): database-level policies guarantee each user can only access their own data, even in case of a malformed request.
• Secure authentication based on short-lived JWT tokens managed by Supabase Auth.
• Regular automated database backups.
• Restricted access to production environments, limited to authorized persons.

No information system offers an absolute guarantee of security. In the event of a personal data breach, we undertake to notify the competent supervisory authority within 72 hours where required by Article 33 GDPR, and to inform affected users without undue delay where the breach is likely to result in a high risk to their rights (Article 34 GDPR).

Under Regulation (EU) 2016/679 (GDPR), you have the following rights over your personal data:

• Right of access (Art. 15) and right to data portability (Art. 20): obtain a copy of your data in a structured, commonly used, machine-readable format.
• Right to rectification (Art. 16): you can change your display name directly from the Profile screen; for anything else, contact us.
• Right to erasure (Art. 17), right to restriction (Art. 18) and right to object (Art. 21).
• Right to withdraw consent at any time, where processing is based on consent.
• Right to define directives on the fate of your data after death (Article 85 of the French Data Protection Act).

Account deletion — two options:

• Directly in the app: open Profile → “Delete account” and confirm. Deletion is immediate and irreversible: your account, subscription, usage history and saved analyses are erased.
• By e-mail: write to contact@thegameodds.com from the address associated with your account with the subject “Delete my account”. After identity verification, deletion is carried out within 30 days at the latest.

For data-copy requests, write to contact@thegameodds.com from your account address with the subject “Copy of my data”. We respond to all requests within one month of receipt; this can be extended by two months for complex or numerous requests, in which case we will inform you.

Where the law requires it, some data may be retained beyond account deletion (notably billing records — see section 4). If you have an active paid subscription through Google Play, remember to also cancel it in the Play Store; deleting the account does not refund the current period.

If you consider that the processing of your personal data does not comply with the GDPR, you may lodge a complaint with the competent supervisory authority:

Commission Nationale de l'Informatique et des Libertés (CNIL) 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France www.cnil.fr

GameOdds does not carry out any fully automated decision-making producing legal effects on you within the meaning of Article 22 GDPR. The AI analyses concern sports events and are provided for informational and entertainment purposes only — they are not betting advice, and they make no decision about you.

This policy may be updated to reflect legal, regulatory or functional changes to the service. In the event of a substantial change, we will inform you by e-mail or by a visible notice in the application at least 15 days before it takes effect. The date of the latest update appears at the top of this page.

For any question about this policy or the processing of your personal data:

• By e-mail: contact@thegameodds.com
• By post: Daïa Group, 9 Rue Robert Lavergne, 92600 Asnières-sur-Seine, France