Privacy

Last updated · September 29, 2026

How betspread handles customer account data, API usage records, billing metadata, waitlist entries, and support requests.

Controller

Efekan Bircan Gräfstraße 74, 60486 Frankfurt am Main, Germany Email: hey@betspread.io

Data we collect

For account access we store email, name, password hash, OAuth account links, session metadata, organization name, and API key metadata. API key plaintext is never stored server-side; betspread stores the API key hash, prefix, and last four characters so keys can be verified and shown safely in the dashboard. If you sign in with Google, Google tells us your name, email address and Google account ID; Google processes the sign-in under its own privacy policy. Legal basis: Art. 6(1)(b) GDPR, because we need this data to provide the service you signed up for.

Usage, logs, and retention

REST and WebSocket usage is recorded in aggregated daily usage rows for billing and support. Request-level support logs are retained for 90 days by default and capped at 180 days; IP and user agent values in api_request_logs are stored as hashed IP and hashed user agent values, not raw browser identifiers. Odds data and raw market history are operational product data and do not contain customer account PII. Legal basis: Art. 6(1)(b) GDPR for billing, and Art. 6(1)(f) GDPR for our legitimate interest in running the service securely and answering support requests.

Cookies

We only use cookies that the site needs to work (§ 25(2) TDDDG). When you sign in on app.betspread.io, session cookies keep you signed in until you sign out or the session expires. If you switch the language on betspread.io, a betspread_locale cookie remembers your choice for one year. We do not use analytics, advertising or tracking cookies. If we add analytics later, we will ask for your consent first.

Processors and hosting

Netcup hosts the application, the API and the database in Germany. Vercel hosts the marketing website betspread.io and processes the technical request data of each visit, including your IP address, to deliver the pages. Stripe processes billing identity, invoices, subscriptions, and customer-portal access. Resend delivers our emails: transactional emails such as password reset or verification, the onboarding and quota emails described below, and the launch notice to the waitlist; for this Resend processes recipients, subjects, bodies, and tokenized action links. Raw API keys, Stripe secrets, and long-lived secrets must not be sent to Resend, support tickets, or smoke evidence.

Transfers outside the EU

Vercel, Stripe and Resend are based in the United States, so data may be processed there. We rely on the EU-U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

Onboarding and account emails

After you verify your email address we send a welcome email with getting-started links, and at most once per calendar month a notice when your organization has used 80 % of its monthly REST request quota. When betspread opens to the public, we send existing accounts one email about the launch. Legal basis: Art. 6(1)(b) GDPR, because these emails belong to the service you signed up for. For this we store your email language, the verification time, an opt-out time if you unsubscribe, and a record of each email sent (type and time) until your account is deleted. Every such email contains an unsubscribe link; you can also object by replying to the email or through the contact page. Resend delivers these emails as our processor.

Waitlist

Until the public launch on 1 January 2027, the registration page collects waitlist entries instead of accounts. We store the email address and, if you provide them, name, company, intended use and the plan you picked, together with the page language and the page you signed up from. We use these details to tell you when betspread opens (legal basis: your request, Art. 6(1)(b) GDPR) and, in aggregated form, to plan the bookmakers our users need (legal basis: our legitimate interest in building the right coverage, Art. 6(1)(f) GDPR). The entry is stored in our database at Netcup; Resend delivers the launch notice. You can ask us through the contact page to delete it at any time; otherwise we delete entries no later than six months after the launch.

Deletion and export

You can request account deletion or Data export through the contact page. We confirm account ownership before acting. Deletion and export requests are handled within 30 days of the confirmed request; operational acknowledgement is targeted within 5 business days. Some records may remain for documented billing, security, fraud, or legal audit windows, and Stripe-side records follow Stripe's own retention policy.

Admin access

Customer data is scoped by authenticated session or API key organization. Internal administrative access is restricted to an explicit allowlist of authorized staff and is denied by default when no one is authorized. Operator actions that touch customer data go through audited application paths.

Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20) and to object to processing based on Art. 6(1)(f) GDPR (Art. 21). To exercise these rights, contact us through the contact page or the email address above. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work (Art. 77 GDPR).

Questions about these terms? Contact betspread.