Privacy notice

1. Responsible party and Information Officer

IASHARK (a sole trader established in Paris, France) is the responsible party for the personal information collected through iashark.com, including its South African version. This notice is given in terms of the Protection of Personal Information Act 4 of 2013 (POPIA).

2. Personal information we collect

• Account information — email address, password (handled by our authentication provider and never stored in plain text), plan (free or paid), creation and update dates.
• Preferences (optional) — display name, favourite leagues, language, time zone, notification preferences, management settings (daily exposure, stop threshold) and any starting bankroll you choose to enter in the Tools area. This information stays private and is never shared.
• Decision journal (paid subscribers, optional) — entries you record: match, market, odds, estimated probability, stake, status and result.
• Subscription information — your customer identifier with our payment provider, subscription status and plan, billing period end date and payment events. Card details are processed only by Stripe; we never store them.
• Internal journey measurement — a random session identifier, the page viewed, language, the step reached (visit, sign-up, opening checkout…) and, if you are logged in, your account identifier.
• Analytics — pages visited, length and sequence of visits, technical information about your device and browser, and approximate location, through Google Analytics, which loads when you arrive on the site; you can turn it off at any time from our Cookie policy.
• Security information — your IP address, used to limit repeated login attempts, and technical logs kept by our hosting providers.
• Correspondence — the content of messages you send us.

Source. We collect this information directly from you, from your device when you use the site, and from our payment provider for subscription status.

Voluntary or mandatory. Your email address and a password are required to create an account, and payment details are required to subscribe; without them we cannot provide the account or the subscription. Preferences and journal entries are voluntary.

3. Purposes and lawful processing

We process personal information only for specific purposes and on a ground permitted by section 11 of POPIA:

Where we rely on legitimate interests, you may object to the processing at any time (see section 7).

4. Operators and other recipients

We use the following service providers (operators) who process personal information on our behalf under contract, with appropriate security measures:

• Supabase — database, authentication and server functions; information hosted in the European Union (Paris region).
• Stripe — payments and subscription management; Stripe also processes some information for its own purposes, such as fraud prevention and regulatory compliance.
• Netlify — website hosting and technical logs.
• Google — Google Analytics (analytics), unless you have turned it off.
• Technical resource providers — fonts (Google Fonts), a code library (jsDelivr) and team logo images (API-SPORTS): your IP address is sent to them when these resources load.

We may also disclose personal information where the law requires it.

5. Transfers outside South Africa

IASHARK is operated from France, so your personal information is transferred outside South Africa. Our main database is in the European Union, where the General Data Protection Regulation applies. Some providers (including Netlify, Stripe, Google and Supabase) are headquartered in the United States and may process information there. We only make these transfers where section 72 of POPIA allows it — for example where the recipient is subject to a law, binding corporate rules or a binding agreement that provides an adequate level of protection, or where the transfer is necessary to perform our agreement with you.

6. Retention and security

• Account information, preferences and journal — while your account is in use; if you subscribed, up to one year after your subscription ends, unless you delete your account earlier. Deleting your account erases it and the information linked to it.
• Subscription and payment information — kept by Stripe under its own rules; accounting records are kept for as long as the law requires.
• Internal journey measurement — as long as needed for statistical analysis of the service; the link to your account is removed when you delete your account.
• Google Analytics — according to the retention setting in Google Analytics (2 or 14 months for user-level and event-level data).
• Correspondence — as long as needed to deal with your request.

We protect personal information with appropriate technical and organisational measures: encrypted hosting, access controls restricting each user to their own information, and payment processing by a certified PCI DSS Level 1 service provider. If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify you and the Information Regulator as required by POPIA.

7. Your rights

Under POPIA you have the right to:

• be notified that your personal information is being collected, and be told if it has been accessed or acquired by an unauthorised person;
• ask whether we hold personal information about you and request access to it;
• request the correction, destruction or deletion of your personal information;
• object, on reasonable grounds, to the processing of your personal information;
• object to the processing of your personal information for direct marketing, and not to receive unsolicited electronic direct marketing except as permitted by POPIA;
• not be subject to a decision based solely on automated processing that has legal consequences for you — we do not make such decisions;
• withdraw your consent at any time, where we rely on consent;
• lodge a complaint with the Information Regulator, and institute civil proceedings.

You can export your information (JSON file) and delete your account at any time from the "My account" page. For any other request, email the Information Officer at contact@iashark.com. We may ask you for adequate proof of identity before acting on a request.

8. Complaints to the Information Regulator

If you are unhappy with how we handle your personal information, please contact us first. You also have the right to lodge a complaint with the Information Regulator (South Africa):

9. Children

IASHARK is only for people aged 18 or over. We do not knowingly process personal information of children; if we learn that an account belongs to someone under 18, we will delete it.

10. Cookies and changes

Details of the cookies and similar technologies we use are in our Cookie policy. We may update this notice; the date at the top shows when it last changed.