Who is responsible
OddsLink is responsible for the personal data described here. Contact us through the site.
What we collect
| Data | When |
|---|---|
| Your email address and a password (stored only as a hash by our sign-in provider) | When you create an account |
| Your plan, and the subscription status and reference numbers our payment processor sends us | When you subscribe, renew, change plan or cancel |
| For each API key: its name, its first and last few characters, a one-way hash, and when it was created, last used and revoked | When you create or use a key |
| How many requests each key made in the current billing month | On every API call |
| IP addresses, the time and the path requested | In server logs, and when a sign-in or API key check fails |
| Your name, email address, topic and message | When you use the contact form; delivered to our support inbox |
| A temporary keyed hash of your IP address | When we limit repeated contact-form submissions |
When referrals are available, a referral link stores a first-party referral code and server-issued receipt in local storage for up to 30 days, separately from visit measurement. At signup we retain the referring account, attribution time and billing-credit records. We use payment-token reuse and temporary IP address hashes to review abuse; referrers never see referred customers' email addresses. Unclaimed expired receipts are removed by our billing worker; on account deletion, referral records are pseudonymised and their account links, saved card data, payment-token hashes and IP address hashes are erased. If the account took part in referrals or paid, we keep a keyed one-way fingerprint of its email address and payment token for 12 months after deletion, with no link to any account, to prevent repeat new-customer referral claims during that period. Expired fingerprints no longer affect referrals and are removed by our daily billing housekeeping. Pseudonymous credit records follow billing-record retention.
What we do not collect
- Card or bank details. Our payment processor takes the payment and we never see the card number.
- Full API keys. We keep only a hash, so we could not show a key to anyone, including you.
- Advertising or analytics trackers. The website sets no cookies. The account page keeps you signed in with your browser's session storage, which is cleared when you close the tab. We count page visits on this site ourselves, without cookies and without third-party analytics, recording the page, the referring site, campaign tags, your browser type and an anonymous mark that changes every day (made from your address and browser, so we can count visitors without following anyone); we keep these records for 90 days and after that only aggregate counts.
- Anything about your betting. We are a data service and never see what you do with the data.
Why we use it
- To provide the service you signed up for: your account, your keys, your plan and its limits.
- To bill you, and to meet tax and accounting duties.
- To keep the service secure: limiting repeated failed sign-ins, spotting abuse, and investigating faults.
- To talk to you about your account, security, billing, and changes to these policies. We do not send marketing email unless you ask for it.
Where the GDPR or UK GDPR applies, our legal bases are performing our contract with you, meeting legal obligations, and our legitimate interest in keeping the service secure.
Who else handles it
We do not sell personal data. A few providers process it for us, only to run the service:
- Supabase: account sign-in and the account database.
- Our payment processor: checkout, payments, invoices and tax. It handles your card details under its own privacy policy.
- Our hosting providers: the servers that run the API and the website.
- Our email provider: delivers your contact-form message to our support inbox and sends our replies to you.
Some of these providers may process data outside your country. Where that happens we rely on the safeguards the law requires, such as standard contractual clauses. We may also disclose data if the law requires it.
How long we keep it
- Account, key and plan data: while your account is open. When you ask us to close it, we delete it within 30 days.
- Billing records: as long as tax law requires, usually several years.
- Server logs that contain IP addresses: no longer than 30 days.
- Contact-form rate-limit identifiers: around one hour.
- Contact messages and our replies: as long as needed to deal with your question.
Your rights
You can ask for a copy of your personal data, ask us to correct or delete it, object to how we use it, or ask us to send it to you in a portable format. Use the contact form with the address on your account and we will answer within 30 days. If you think we have not handled your data properly, you can also complain to the data protection authority where you live.
Security
Traffic to the API and website is encrypted with HTTPS. API keys are stored only as hashes, and access to our servers is limited to the people who run the service. If you find a security problem, please report it through the contact page.
Changes
If we change how we handle personal data in a way that matters, we will email you before the change takes effect. The date at the top of this page shows the last change.