Privacy Policy
Updated 8/26/2026
What we collect, why, who processes it for us, and what you can do about it.
§1Controller
ML Devworks Michał Lipka, Rynek Główny 34 lok. 15, 31-010 Kraków, Poland. VAT ID 6762707876. Data enquiries: office@ml-devworks.com. No data protection officer has been appointed; the scope of processing does not require one.
§2What data and on what basis
- Account: username, e-mail, hashed password, registration date and terms acceptance — Art. 6(1)(b) GDPR (contract).
- Google sign-in, if used: account identifier, e-mail and name — Art. 6(1)(a) GDPR (consent).
- Content: chat and private messages, picks with comments, favourite matches — Art. 6(1)(b) GDPR.
- Plan usage and the cost of generated content — Art. 6(1)(b) and (f) GDPR (limits, abuse prevention).
- IP address and browser data in server logs — Art. 6(1)(f) GDPR (security).
- Payments: customer identifier and status held by the provider, accounting records — Art. 6(1)(b) and (c) GDPR. We never see card numbers.
Providing data is voluntary, but without it you cannot create an account or use features that require signing in.
§3What reaches language model providers
Generating an analysis or report sends only sports data about the match — no personal data.
The assistant is different. A question asked under an analysis, or an @AI mention in a match chat, sends the question — and for chat also a fragment of that room conversation history — to the model provider. Do not put anything there you would not want leaving the service.
The providers are Anthropic PBC and OpenAI, L.L.C. (USA). We use their business terms, under which they undertake not to train models on submitted content.
§4Who processes data for us
- MongoDB, Inc. — database,
- the provider hosting the application and the Redis cache,
- Anthropic PBC and OpenAI, L.L.C. — AI content generation,
- Google Ireland Ltd. — Google sign-in, with consent only,
- the outgoing mail provider — address confirmation and password resets,
- Stripe Payments Europe Ltd. — payments,
- our accounting office — accounting records.
The sports data provider receives no user data from us; we only fetch match data. Some recipients are established outside the EEA; transfers rely on standard contractual clauses approved by the European Commission.
§5Retention
- Account data and content — until the account is deleted; in-play analyses are removed automatically after several minutes.
- Usage counters — until the end of the billing period concerned.
- Server logs — up to 30 days.
- Credit ledger and accounting records — 5 years, as required by tax law.
§6Your rights
You may access, rectify, erase, restrict and port your data, and object to processing based on legitimate interest. Consents can be withdrawn at any time without affecting the lawfulness of earlier processing.
Send requests to office@ml-devworks.com. You may also lodge a complaint with the Polish data protection authority (Prezes UODO).
§7Cookies and local storage
We use no analytics and no advertising, and do not profile users for marketing. The list below is complete. Optional consents can be changed from the link in the footer.
| Name | Category | Purpose | Retention |
|---|---|---|---|
| accessToken | necessary | keeping the session signed in | 30 minutes |
| refreshToken | necessary | renewing the session | 30 days |
| NEXT_LOCALE | necessary | remembering the language | up to a year |
| czat-consent | necessary | remembering consent choices | until cleared |
| czat-age | necessary | remembering the age confirmation | until cleared |
| czat-theme | functional | light or dark theme | until cleared |
| czat-sound-enabled | functional | notification sound | until cleared |
| Google cookies | optional — with consent | Google sign-in | per Google policies |
§8Automated decisions
We make no decisions based solely on automated processing that would produce legal effects for you. Model output concerns sporting events, not any assessment of you.