H2H LogicPrivacy Policy
Controller
Ana Rita Oliveira Rodrigues, sole trader (trade name Vibe Criativa), NIF 216905184 · [email protected]. Contact: [email protected] (subject "Privacy").
What data we process, why and on what basis
| Data | What for | Legal basis (GDPR art. 6) | How long |
|---|---|---|---|
| Email, name (if Google provides it), login identifier, sign-in dates, 18+ declaration | create and maintain the account | contract | while the account exists |
| Plan, entitlements, payments (amount, date, status, payment method: card or MB WAY — card details and the MB WAY phone number stay only with Stripe), Stripe customer identifier, name, NIF and country (if you give them at payment) | subscription and invoicing | contract; legal obligation (invoices) | invoices and payment records: 10 years (tax law), even after you delete the account |
| Bets you record (match, market, odd, stake, bookmaker, notes) | for the Bet tracker to work for you | contract | while the account exists or until you delete them |
| Use of your records to evaluate and improve the model, pseudonymised (no name or email) | improve the service | consent (Account → Consents; you can withdraw it) | until you withdraw |
| LogicBot questions and answers | to answer (without your consent we do not keep the text; we count the number of questions) | contract; consent to keep conversations | 12 months (if you accepted) |
| Usage counters (including pages viewed per minute, to stop automated extraction) and requests to the former "Analyse match" (feature withdrawn on 25/10/2026) | plan limits and abuse prevention | contract; legitimate interest | 90 days |
| Feedback and emails you send us | to reply | legitimate interest | 24 months |
| Invitation requests (email, optional name and message; form withdrawn on 01/11/2026) | reply and send the invitation | pre-contractual steps at your request | 12 months |
| Contact form messages (email, optional name, subject and message) | to reply to your message | legitimate interest | 12 months |
| Consents (what, when, version) | prove consents and withdrawals | legal obligation / legitimate interest | while the account exists |
| Trial usage mark (encrypted, irreversible digest of the email) | 1 trial per person | legitimate interest | kept after you delete the account |
| IP address and server technical logs | security and abuse prevention | legitimate interest | 30 days |
| Partner reference (cookie h2h_ref, 30 days) | attribute the referral to the partner who brought you and apply the partnership discount | legitimate interest / contract | until the 1st payment |
We do not make automated decisions with legal effects on you, we do not sell data and we do not use personalised advertising.
Processors and recipients
| Entity | Role | Where | Safeguard |
|---|---|---|---|
| OVH Hosting Inc. (OVHcloud Canada) | application server and database | Canada | EU–Canada adequacy decision |
| Okta / Auth0 | authentication (login) | EU | data processing agreement (DPA) |
| Google (if you sign in with Google) | identity | US/EU | EU-US Data Privacy Framework |
| Stripe Payments Europe Ltd (Ireland) and the Stripe group | payments; Stripe is also an independent controller for fraud prevention and legal obligations (stripe.com/privacy) | EU/US | DPA; Data Privacy Framework |
| Cloudflare, Inc. | site network and security; processing of LogicBot questions (does not use the data to train models) | global/US | DPA; Data Privacy Framework |
| OpenRouter, Inc. | routing of LogicBot questions when the free daily limit is used up (same model, processed at Cloudflare); does not keep the text of questions or answers | US | DPA with standard contractual clauses |
| Resend (Plus Five Five, Inc.) | sending emails | US | DPA; Data Privacy Framework |
| Cloudflare Email Routing and Google (Gmail) | receiving emails sent to [email protected] | US | Data Privacy Framework |
| Google Ireland Limited (YouTube) | video from our channel on the home page, only if you play it (independent controller) | EU/US | Data Privacy Framework |
| Portuguese Tax Authority (Autoridade Tributária) | reporting invoices | Portugal | legal obligation |
Your rights
Access, rectification, erasure, restriction, portability, objection (to processing based on legitimate interest) and withdrawing consent at any time. In the application: Account → Export my data (JSON file) and Account → Delete account; or by email to [email protected]. We reply within 1 month. You can complain to the Portuguese data protection authority, CNPD (www.cnpd.pt).
Security
Encrypted connections (HTTPS), database with per-user isolation, encrypted backups and administrative access by key only.
Cookies
We only use necessary cookies: login session, Cloudflare security, the partner reference cookie and the site language cookie (if you choose a language, 1 year); the light/dark theme is stored only in your browser. No analytics or advertising cookies.
The home page has a video from our YouTube channel in privacy-enhanced mode (youtube-nocookie.com). The video only loads when you press ▶; until then no data is sent to YouTube. When you watch it, Google Ireland Limited may store or read information on your device and collect usage data (for example, your IP address), under Google's privacy policy (policies.google.com/privacy). You can also watch the video directly on YouTube.
Minors
The service is only for people aged 18 or over; we delete accounts of minors that we become aware of.