Vitalos Technologies Ltd (company number 16696895) is the controller of the personal data described here. This policy covers the UK GDPR and the Data Protection Act 2018 and, for users in Nigeria, the Nigeria Data Protection Act 2023 (NDPA). Contact for anything about your data: support@tipsignal.net.
What we collect, why, and our lawful basis
| Data | Why | Lawful basis |
|---|---|---|
| Email address | To create your account, send sign-in links, and send the alerts you switch on | Contract |
| Country | To show the right price and payment method, and to apply the rules of where you live | Contract |
| Time zone | To show kick-off times and send alerts at sensible times | Contract |
| 18+ confirmation and self-exclusion settings | To keep under-18s out and to honour self-exclusion | Legal obligation and legitimate interests (protecting users) |
| Watchlist and alert settings, alert delivery log, push subscription | To send only the alerts you asked for, once | Contract |
| Subscription and payment status, payment provider references (no card numbers) | To give Pro access and keep accounts | Contract; legal obligation (tax records) |
| Checkout confirmation (wording, date) | To show you asked Pro to start immediately (UK cancellation rules) | Legal obligation |
| Refund records (payment reference, amount, date) | To refund a first payment if you cancel within 14 days, once only | Contract; legal obligation (tax records) |
| Receipts (number, amount, date, payment method) | To give you a receipt for every payment and keep accounts | Contract; legal obligation (tax records) |
| Referral checks (a scrambled copy of your device id, your payment card's provider signature, your email domain) | To stop one person claiming referral rewards with several accounts; a flagged reward is reviewed by a person | Legitimate interests (preventing abuse of the referral programme) |
| Usage analytics (pages viewed, device type; anonymous ID) | To learn which pages help people | Consent: only if you accept analytics cookies |
| Error logs (page address, browser, time, error details; may include IP address) | To find and fix faults | Legitimate interests (keeping the service working) |
We do not sell your data, we do not send marketing emails without your consent, and we make no automated decisions about you that have legal or similar effects.
Who processes it for us
| Processor | Purpose | Location |
|---|---|---|
| Supabase | Database, sign-in and file storage | UK (London) |
| Cloudflare | Hosting of the website, DNS and network security | Global network; company in the US |
| Vercel | Development previews only; the live site does not run on Vercel | US |
| Stripe | Card payments outside Nigeria | UK, EU and US |
| Paystack | Payments in Nigeria | Nigeria |
| Resend | Sending email (sign-in links, alerts) | EU (Ireland); company in the US |
| Anthropic | Writing short explanations of predictions from match data. No personal data is sent | US |
| Sentry | Error reports | EU (Germany) |
| PostHog | Usage analytics, only after you accept | EU (Germany) |
| GitHub | Hosting our code and running scheduled jobs (including sending alerts, which uses your email address) | US |
| Oracle Cloud | Our build and maintenance server | UK (London) |
Where it is stored, and international transfers
Our database is in the UK (London), and analytics and error reports are stored in the EU. Some processors are based in, or reach your data from, the US or other countries. Where data leaves the UK we rely on UK adequacy regulations (including the UK extension to the EU-US Data Privacy Framework where the recipient is certified) or on the UK International Data Transfer Agreement or Addendum. For users in Nigeria, transfers out of Nigeria rely on the safeguards the NDPA requires, such as adequacy or contractual safeguards.
How long we keep it
| Data | Kept for |
|---|---|
| Account data (email, profile, watchlist, alerts, checkout confirmations) | While your account exists; deleted when you delete it. Backups roll over within 7 days |
| Payment records (provider references, amounts, dates) | 6 years after the end of the financial year they relate to, for UK tax law; Stripe and Paystack keep their own records |
| Usage analytics (PostHog) | 12 months |
| Error logs (Sentry) | 30 days |
| Refund records | 6 years, with the payment records |
| The public prediction record | Indefinitely; it contains no personal data |
Your rights, and how to use them
Under the UK GDPR and the NDPA you can ask to:
- Access your data and export it: "Download my data" on your account page gives a JSON file at once.
- Correct it: change your country on the account page; for anything else, including your email address, email us.
- Delete it: "Delete my account" on the account page (cancel any running subscription first).
- Object to processing or ask us to restrict it: email us.
- Withdraw consent to analytics at any time: "Cookie settings" at the bottom of every page.
Email support@tipsignal.net from the address on your account for any request. We answer within one month (UK) or 30 days (Nigeria), and tell you if we need longer for a complex request.
Complaints
Please contact us first. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or, in Nigeria, the Nigeria Data Protection Commission (ndpc.gov.ng).
Children
TipSignal is for adults. We do not knowingly collect data from anyone under 18, and we delete any account we learn belongs to a child.
Changes
We will email account holders before material changes to this policy take effect.