Privacy Policy

§1Controller

ML Devworks Michał Lipka, Rynek Główny 34 lok. 15, 31-010 Kraków, Poland. VAT ID 6762707876. Data enquiries: office@ml-devworks.com. No data protection officer has been appointed; the scope of processing does not require one.

§2What data and on what basis

• Account: username, e-mail, hashed password, registration date and terms acceptance — Art. 6(1)(b) GDPR (contract).
• Google sign-in, if used: account identifier, e-mail and name — Art. 6(1)(a) GDPR (consent).
• Visit statistics in Google Analytics, only with your consent: pages visited, time spent, approximate location derived from the IP address, device and browser type. Google truncates the IP address before storage and the data is not linked to your account — Art. 6(1)(a) GDPR (consent).
• Content: chat and private messages, picks with comments, favourite matches and conversations with the AI assistant — Art. 6(1)(b) GDPR.
• The morning email, if you switch it on: the account e-mail address, the chosen email language, the dates it was switched on and last sent, and a random token that lets you switch it off in one click without signing in. The email is built from the model’s picks and from your picks, favourite matches and round standing — Art. 6(1)(a) GDPR (consent, which you withdraw by switching the email off in your account panel or via the link in the email).
• Plan usage and the cost of generated content — Art. 6(1)(b) and (f) GDPR (limits, abuse prevention).
• IP address and browser data in server logs — Art. 6(1)(f) GDPR (security).
• Payments: customer identifier and status held by the provider, accounting records — Art. 6(1)(b) and (c) GDPR. We never see card numbers.

Providing data is voluntary, but without it you cannot create an account or use features that require signing in.

§3What reaches language model providers

Generating an analysis, report or coupon sends only sports data about the matches — no personal data.

The assistant is different. A question asked under an analysis, in the Assistant tab or — in a match chat — with an @AI mention sends the question to the model provider together with the latest messages of the same conversation, and for a match chat a fragment of that room’s history including the authors’ usernames. When a question calls for it, the assistant in the Assistant tab also passes on data from your account needed for the answer — e.g. favourite matches, your own picks and their accuracy, recent reports, your plan and remaining limits. We never pass on your e-mail address or sign-in details. Do not put anything in a question you would not want leaving the service.

Web news search (paid plans) is carried out by the model provider with its own search tool. It receives only a query the assistant composes from your question — e.g. a team name and a topic — with no account data.

Assistant conversations are saved to your account so you can return to them; only you can see them. In the Assistant tab we keep at most 50 conversations — when you start another, the least recently used are deleted automatically — and you can delete any of them yourself at any time. A conversation under a match analysis is deleted automatically 30 days after the last question. The exception is @AI in a match chat: the question and answer are part of the public room conversation, like any other message.

The providers are Anthropic PBC and OpenAI, L.L.C. (USA) — one handles requests day to day, the other takes over when the first is unavailable. We use their business terms, under which they undertake not to train models on submitted content.

§4Who processes data for us

• MongoDB, Inc. — database,
• the provider hosting the application and the Redis cache,
• Anthropic PBC and OpenAI, L.L.C. — AI content generation, assistant replies and web news search,
• Google Ireland Ltd. — Google sign-in and Google Analytics, both with consent only,
• the outgoing mail provider — address confirmation, password resets, the welcome email after sign-up and the morning email,
• Stripe Payments Europe Ltd. — payments,
• our accounting office — accounting records.

The sports data provider receives no user data from us; we only fetch match data. Some recipients are established outside the EEA; transfers rely on standard contractual clauses approved by the European Commission.

§5Retention

• Account data and content — until the account is deleted; in-play analyses are removed automatically after several minutes.
• Assistant conversations in the Assistant tab — until you delete them or the account, at most 50 conversations; conversations under a match analysis — 30 days from the last question.
• Morning email settings, including the unsubscribe token — until the account is deleted; once the email is switched off we no longer send it.
• Usage counters — until the end of the billing period concerned.
• Server logs — up to 30 days.
• Credit ledger and accounting records — 5 years, as required by tax law.

§6Your rights

You may access, rectify, erase, restrict and port your data, and object to processing based on legitimate interest. Consents can be withdrawn at any time without affecting the lawfulness of earlier processing.

Send requests to office@ml-devworks.com. You may also lodge a complaint with the Polish data protection authority (Prezes UODO).

§7Cookies and local storage

We measure site traffic with Google Analytics — only after your consent in the banner; without it the script is not loaded at all. There is no advertising and we do not profile users for marketing. The list below is complete. Optional consents can be changed from the link in the footer.

§8Automated decisions

We make no decisions based solely on automated processing that would produce legal effects for you. Model output concerns sporting events, not any assessment of you.