1. Controller and contact
The controller for account and service data is TennisDollar. Postal address: Swan Street, City Centre, Manchester, M4. Email: tennisdollar0@gmail.com. Signed-in users can make a rights request or complaint through Contact & rights requests. You can also email us directly without an account.
2. Data used by the service
- Account: email address, display name, authentication identifiers, account creation and sign-in timestamps.
- Billing: Stripe customer, subscription and price identifiers; subscription status, renewal/end date and cancellation state. TennisDollar does not receive full card details.
- Product records: saved model predictions, results, personal picks entered by you, settings, timezone and watched players stored on your device if permitted.
- Support and rights: request type, message, account ID and handling status.
- Optional push alerts: device push endpoint and encryption keys, account identifier, chosen odds threshold, opt-in timestamps and delivery records. These are used to deliver requested alerts through your browser’s push provider (such as Apple, Google or Mozilla). We do not send your email or account identifier in notification payloads; match details may appear on your lock screen.
- Security: request metadata needed to protect accounts, verify origin and investigate errors. Passwords and authentication tokens must not be logged.
3. Why data is used and lawful bases
- Contract: create and secure accounts, provide subscribed features, maintain prediction history, process billing and manage cancellation.
- Legal obligation: preserve records required for tax, accounting, consumer and dispute obligations, and answer valid legal requests.
- Legitimate interests: secure, troubleshoot and improve the service, prevent fraud and maintain accurate public model records, balanced against user rights.
- Consent: optional push alerts, optional device storage and any future analytics or marketing. Cookie consent and marketing choices are separate from accepting the Terms and may be withdrawn. Consented product measurement stores only aggregate event counts and coarse load-time buckets, without account identifiers, email addresses, search text or raw client errors. These aggregates expire after 90 days.
Push alerts are optional and may be disabled from My account or device settings. Subscription records are deleted when alerts are turned off, the push service reports an expired subscription, or your account is deleted. Successful delivery records are retained for up to 30 days to prevent repeat alerts. Your browser’s push provider may process data outside the UK under its own privacy terms. No marketing mailing list is implemented in the audited application.
4. Service providers and disclosures
Supabase provides authentication and database services. Stripe processes checkout, payments, subscriptions and the billing portal. OpenAI Sites hosts the application. API-Tennis supplies tennis fixtures, results and bookmaker odds, and Open-Meteo supplies venue weather forecasts through server-side requests. Odds requests use match dates and tour identifiers; TennisDollar does not send visitor account details, personal picks or browser identifiers to API-Tennis or bookmakers to display these odds. Displaying a bookmaker name does not itself share your information with that bookmaker. The operator must verify and document the contractual role, legal entity, processing location and transfer safeguards for each provider before launch.
Personal information may also be disclosed where required by law, to protect users and the service, or as part of a properly managed business transfer.
5. International transfers
Some providers may process information outside the UK. Before launch, the operator must confirm actual data locations and document the relevant UK adequacy regulation, International Data Transfer Agreement, UK Addendum or other lawful safeguard. This draft does not claim a safeguard that has not been verified.
6. Retention
Authentication sessions use the periods listed in the Cookie Policy. Account and prediction data are kept while the account is active. Deletion removes or anonymises account-linked information where possible, while billing, transaction, security or dispute records may be retained where legally required. Support requests are kept only as long as needed to resolve and evidence the request. The operator must approve and publish a specific retention schedule before launch; no unverified fixed period is claimed here.
7. Security
The implementation uses HttpOnly secure session cookies, same-origin checks, server-side access controls, row-level database policies, Stripe webhook signature verification and restricted service credentials. No online service can promise absolute security.
8. Your rights
Depending on the circumstances, UK data-protection law may give you rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent. You can export stored account data and request deletion from My account, or submit another request through Contact & rights requests. Identity may need to be verified.
9. Complaints
Please contact TennisDollar first through the rights-request route. You can also complain to the UK Information Commissioner’s Office. You can also email tennisdollar0@gmail.com without an account.
10. Children
TennisDollar paid plans and gambling-related use are intended only for adults aged 18 or over. The service is not designed to knowingly collect children’s data.