Legal

Privacy Policy

Effective date: 8 June 2026.

This policy explains how SaltaBall ("we") collects and uses personal data when you use the Service, and your rights under the EU/UK GDPR and similar laws. The data controller is SaltaBall. You can reach us at support@saltaball.com.

1. Data we collect

Account — your email address, and (if you sign in with Google) your name and profile image as provided by Google. Preferences — your locale and theme. Consent — the time you accepted the Terms. Authentication — the identifiers and tokens needed to keep you signed in (for Google sign-in, the provider account ID and OAuth tokens). Billing — a Stripe customer ID plus your plan and subscription status; we never see or store your full card number. Usage — minimal counters such as your daily assistant-query count, used to enforce plan limits. Administration — limited records of administrative actions (for example a refund or an account erasure) kept for accountability. Technical — standard server logs (such as IP address and timestamps) kept short-term by our hosting for security and debugging. Approximate location — the country your visits come from (derived from your IP address at our hosting's edge; never a stored IP or precise location; for subscribers it may also come from your Stripe billing address), used to apply regional rules and to send region-relevant communications; it is included in your data export and deleted with your account.

2. Cookies & local storage

Aside from the optional analytics cookies described below, the cookies SaltaBall sets are strictly necessary: a session cookie and a CSRF/security token to sign you in and protect forms, a short-lived cookie that records your acceptance of the Terms at sign-in, and a cookie that remembers you have seen this notice. Beyond the optional analytics below, there are no advertising or cross-site tracking cookies. Because these are essential to deliver a service you have asked for, they do not require consent under EU/ePrivacy rules; you can block cookies in your browser, but sign-in will not work without them. For basic analytics we use Plausible — a privacy-friendly tool that counts aggregate page views WITHOUT setting any cookies, without collecting personal data, and without tracking you across sites or devices — so it requires no consent. To understand how the Service is used and improve it, we also use Microsoft Clarity, which records masked, pseudonymised on-site interactions (a "session replay" of clicks, scrolls and navigation) and sets its own cookies; we enable Clarity's masking and mask personal details such as your email address so they are not captured in recordings. Clarity is OPTIONAL and gated by region: in the EEA and the UK it loads ONLY after you opt in via the cookie banner (until then only essential cookies are set), and elsewhere it is on by default — disclosed in that banner, where you can opt out. Your analytics choice is remembered in your browser's local storage, and you can change or withdraw it at any time via "Cookie settings" in the page footer (or by clearing your site data).

If you arrive through a partner referral link, we keep that partner's referral code in your browser's local storage (first-party and same-site — only the referral code and a timestamp, retained up to 7 days, and cleared once you sign in) so that the partner can be credited if you create an account. This is a functional use (our and the partner's legitimate interest); it is not advertising, profiling, or cross-site tracking, and you can clear it any time via your browser's site-data controls.

3. How we use data & legal bases

We use your data to: provide and secure your account and the Service, and process sign-in (performance of our contract with you); process payments and prevent fraud (contract, legitimate interests, and legal obligation); enforce plan limits and protect the Service from abuse (legitimate interests); and comply with legal, tax, and accounting obligations (legal obligation). Any optional feature that needs more would rely on your consent. We do not sell your personal data and we do not make automated decisions that produce legal effects about you.

4. The AI assistant

When you use the assistant, your question and the engine's model-derived match context are sent to our language-model provider to generate a reply. On most plans nothing is stored and only your current question is sent. On the Edge plan, saved chat history is enabled: your conversation is stored to your account so it reloads across sessions, and recent turns are sent with each question for context. You can clear it at any time from the assistant; it is included in your data export and is permanently deleted when you delete your account. Authorised staff may access stored conversations for support, security and debugging; such access is restricted to administrators and is logged. Please do not enter sensitive personal information in chat.

5. Sharing & sub-processors

We share data only with service providers acting on our behalf: Stripe (payments and billing), our football-data provider (fixtures and results — no personal data), our language-model provider (assistant replies), Google (only if you choose Google sign-in), Plausible (privacy-friendly, cookieless analytics — aggregate page views only, no personal data), an error-monitoring/diagnostics provider (used only for security and debugging, when enabled — its reports may include technical identifiers such as your IP address), and our hosting, database, and email providers. Some may process data outside your country; where they do, appropriate safeguards (such as EU Standard Contractual Clauses) apply. We do not sell or rent your data to anyone. Separately, when analytics is enabled (after you opt in in the EEA/UK, or on by default elsewhere), Microsoft Clarity provides masked session-replay analytics and may also process that data as an independent controller for its own product-improvement purposes; recordings are masked and contain no payment data, and you can turn Clarity off at any time via "Cookie settings" in the footer.

6. Retention

We keep account data for as long as your account exists. Usage counters are short-lived. Billing records are kept for as long as tax and accounting law requires. Server logs are kept short-term. When you delete your account, your personal data is erased and any active subscription is cancelled; we may retain limited records where the law requires.

7. Your rights

Subject to law, you have the right to access, correct, delete, export (data portability), restrict, or object to the processing of your personal data, and to withdraw any consent. You can export all of your data, or permanently delete your account, at any time from your account page, or contact us at support@saltaball.com. You also have the right to complain to your local data-protection supervisory authority.

8. Children

SaltaBall is for adults (18+) and is not directed at children. We do not knowingly collect data from anyone under 18.

9. Security & changes

We use appropriate technical and organisational measures to protect your data, though no system is perfectly secure. We may update this policy; material changes will be notified by reasonable means and shown with a new effective date.

10. Contact

Data controller: SaltaBall. Privacy contact: support@saltaball.com.