Privacy notice

1. Who we are

IASHARK (a sole trader established in Paris, France) is the controller of the personal data collected through iashark.com, including its UK version. Contact: contact@iashark.com.

This notice explains how we use personal data of people in the United Kingdom, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We have not appointed a data protection officer; please send any privacy question to the address above.

2. The data we collect

• Account data — email address, password (handled by our authentication provider and never stored in plain text), plan (free or paid), creation and update dates.
• Preferences (optional) — display name, favourite leagues, language, time zone, notification preferences, management settings (daily exposure, stop threshold) and any starting bankroll you choose to enter in the Tools area. This data stays private and is never shared.
• Decision journal (paid subscribers, optional) — entries you record: match, market, odds, estimated probability, stake, status and result.
• Subscription data — your customer identifier with our payment provider, subscription status and plan, billing period end date and payment events. Card details are processed only by Stripe; we never store them.
• Internal journey measurement — a random session identifier, the page viewed, language, the step reached (visit, sign-up, opening checkout…) and, if you are logged in, your account identifier.
• Analytics — pages visited, length and sequence of visits, technical information about your device and browser, and approximate location, through Google Analytics, which loads when you arrive on the site; you can turn it off at any time from our Cookie policy.
• Security data — your IP address, used to limit repeated login attempts, and technical logs kept by our hosting providers.
• Correspondence — the content of messages you send us.

3. Why we use your data and our lawful bases

Where we rely on legitimate interests, we have considered that the processing is necessary and proportionate and does not override your rights. You can object at any time (see section 7).

4. Who we share data with

• Supabase — database, authentication and server functions; data hosted in the European Union (Paris region).
• Stripe — payments and subscription management; Stripe also acts as an independent controller for some purposes of its own, such as fraud prevention and regulatory compliance.
• Netlify — website hosting and technical logs.
• Google — Google Analytics (analytics), unless you have turned it off.
• Technical resource providers — fonts (Google Fonts), a code library (jsDelivr) and team logo images (API-SPORTS): your IP address is sent to them when these resources load.
• Public authorities — where the law requires it.

5. International transfers

Your data is processed outside the UK. Our main database is in the European Union (France); UK adequacy regulations recognise countries in the European Economic Area as providing adequate protection. Some providers (including Netlify, Stripe, Google and Supabase) are headquartered in the United States and may process data there. Such transfers rely on the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") where the recipient is certified under it, or otherwise on safeguards approved under UK law, such as the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses.

6. How long we keep data

• Account data, preferences and journal — while your account is in use; if you subscribed, up to one year after your subscription ends, unless you delete your account earlier. Deleting your account erases it and the data linked to it.
• Subscription and payment data — kept by Stripe under its own rules; accounting records are kept for as long as the law requires.
• Internal journey measurement — as long as needed for statistical analysis of the service; the link to your account is removed when you delete your account.
• Google Analytics — according to the retention setting in Google Analytics (2 or 14 months for user-level and event-level data).
• Correspondence — as long as needed to deal with your request.

7. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your data (this notice);
• access your data and receive a copy;
• rectification of inaccurate data;
• erasure of your data;
• restrict processing;
• data portability;
• object to processing based on legitimate interests;
• withdraw consent at any time, where we rely on consent;
• not be subject to decisions based solely on automated processing that have legal or similarly significant effects — we do not make such decisions.

You can export your data (JSON file) and delete your account at any time from the "My account" page. For any other request, email contact@iashark.com. Exercising your rights is free, and we will respond within one month (this can be extended by up to two further months for complex requests, in which case we will tell you).

8. Complaints

If you are unhappy with how we have used your data, please contact us first so we can try to put it right. You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO):

9. Security

Data is stored with Supabase on encrypted infrastructure, with access controls that restrict each user to their own data. Payments are processed by Stripe, a certified PCI DSS Level 1 service provider. We never have access to your full card details.

10. Children

IASHARK is only for people aged 18 or over. If we learn that an account belongs to someone under 18, we will delete it.

11. Cookies and changes

Details of the cookies and similar technologies we use are in our Cookie policy. We may update this notice; the date at the top shows when it last changed.