Privacy Policy
How OddsRelay handles personal data: account, billing, support and API usage records, enquiries and outreach contacts, who processes them and how long we keep them. The odds feed itself contains no personal data.
Contents
Who we are
This policy explains how OddsRelay ("we", "us", "our") handles personal data. We are the data controller for the personal data described here.
- Contact for privacy matters, requests and complaints: hello@oddsrelay.io
Important: the OddsRelay data feed itself contains no personal data; it is odds and market data. The personal data we handle is about the people who use OddsRelay, contact us, or whom we contact about OddsRelay: account, billing, support and API usage records, enquiries, and outreach contacts. We keep personal data to a minimum.
The personal data we collect, and why
| What | When we collect it | Why (lawful basis) |
|---|---|---|
| Signup details: email address, what you will use the data for and whether it is for business or personal use, your region, your product-news choice, the page or campaign that brought you, and a record that you accepted our terms (terms version, time, browser, and, for 90 days, a keyed hash of your IP address) | You sign up | To create your account and keep a record of your acceptance (performance of a contract; legitimate interest in keeping proof that you accepted our terms) |
| Bot-check signals: the signals Cloudflare Turnstile uses to tell a person from an automated script | You sign up or ask for a sign-in code | To protect signup and sign-in from abuse (legitimate interest) |
| Account and team details: email address, display name, account name, your role (owner or member), invitations, sign-in and security events | You use an account or are invited to one | To run your account and keep it secure (performance of a contract; legitimate interest) |
| Billing details: billing name and address, country, a business name if you give one, card country, the country you connected from, payment and invoice records | You buy a paid plan | To take payment, apply consumer rights, and meet our accounting and tax obligations (performance of a contract; legal obligation) |
| Partner referrals: if you arrive through a partner's affiliate link, a referral id that records which partner sent you. It is kept in a cookie (see "Cookies and tracking" below) and goes with your purchase if you buy a paid plan | You arrive through a partner's link | To pay our partners commission on the plans bought by the customers they introduce (legitimate interest) |
| API usage records: API key identifier, IP address, browser or app name, product and region requested, time, status, response size, and tokens charged | Automatically, when a key calls the API, including the dashboard's own key when you use its request tool | To run, secure, and monitor the Service, prevent abuse, count tokens, and show your team its usage (legitimate interest; performance of a contract) |
| Enquiry details: name, email, what you're building, your message, an indicative monthly budget and region, your product-news choice, your browser or app name, and a keyed hash of your IP address (deleted after 90 days) | You use our contact, request-access or Enterprise enquiry form | To respond to and manage your enquiry (legitimate interest) |
| Outreach contacts: a contact's name and job title, business email address, and the public profiles or handles a business or seller uses (for example on Instagram, Telegram, Discord or Whop); the business's name and type (a company, a sole trader or an individual seller); where we found the details; our notes on what the business or seller offers, from its public pages and posts; the messages we exchange with it on those platforms, and when; the invitations we sent; and the logo or public profile image we show on a trial account we set up for them. We find these details in public and professional sources, including those profiles, and through Clay and Lusha (see "Who we share data with") | Before we contact a business or seller about OddsRelay | To offer OddsRelay to businesses and sellers who could use it (legitimate interest) |
| Support and communications: your emails and help-form messages (the help form adds your account number, the key's name and last 4 characters, your region, and recent error codes), and our log of the emails we send you | When you contact us or we email you | To help you, keep records, and show that a notice was sent (legitimate interest; legal obligation) |
| Website analytics: pages viewed, aggregate usage | When you visit our website or use your dashboard | To understand and improve our website and dashboard (legitimate interest). We use privacy-friendly, cookieless analytics and do not build personal profiles |
We do not collect special-category data, and we do not carry out automated decision-making that produces legal or similarly significant effects. The Service is for people aged 18 or over.
Your team sees its callers. Everyone in a customer account (its owner and members) can see, for that account's API keys, the IP addresses and browser or app names that called the API in the last 7 days, with the details of each request. That includes the address of a team member who used the dashboard's request tool.
Payment data
Payments are processed by Stripe. We do not see or store your full card details; Stripe handles card data as a payment processor under its own terms. We keep only the information needed to manage your account and meet our accounting and tax obligations.
Product news and business outreach
- Product news. We send product news at most once a month, and only when there is real news, to people who signed up or enquired and did not tick "Don't send me product news" (legitimate interest; for individuals, the soft opt-in under PECR). Every message has a one-click unsubscribe that needs no sign-in, and we do not track opens or clicks. We may also send one "Need help with your first call?" email if your own code makes no successful call in your first 24 hours, on the same terms.
- Outreach. We may contact businesses and sellers who could use OddsRelay about it, including companies, sole traders and individuals who sell betting tools or tips, at the business addresses and public profiles they publish, or that professional sources and our research tools list for them (legitimate interest). Every message names OddsRelay and has a working opt-out, and we check every outreach list against the people who have opted out.
- Service emails (sign-in codes, key and token notices, trial and billing notices, changes to our terms) are not marketing. They go to an account's owner and members whatever their product-news choice.
- To opt out of marketing at any time, reply "no" to any outreach email or message from us, use the unsubscribe link, or email hello@oddsrelay.io. We keep the email address or profile handle of anyone who opts out, when they did, and for outreach the business it belongs to, and nothing else, so that we don't contact them again.
Who we share data with
We use these service providers ("processors") to run OddsRelay. They process personal data only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Vercel | Hosting our website and dashboard, including forms and our email jobs | US |
| Supabase | Accounts, sign-in, team members, signup answers, and enquiries | UK (London). Enquiries sent before our launch are held in an earlier project in the EU (Ireland) until it is closed |
| OVH | Servers for the API: API keys, usage records, and request logs | EU (France) |
| Stripe | Payments, invoices, receipts, and subscriptions | US |
| Resend | Sending our emails | US |
| IONOS | Our email inbox | EU (Germany) |
| Reading and answering that inbox (Gmail) | US | |
| Cloudflare | The bot check on signup and sign-in (Turnstile) | US |
| Umami | Cookieless website analytics | US and EU |
| PromoteKit | Running our partner programme: the referral cookie, and, for a customer who came through a partner's link, the email address and payments Stripe holds for them, to work out that partner's commission | US |
| Pushover and Discord | Alerts to us about account events. They name the account, never your email address | US |
| Clay | Finding and checking business contact details for outreach | US |
| Lusha | Finding business contact details for outreach | US and Israel |
| ZeroBounce | Checking that an email address is valid before we send to it | EU and US |
| Instantly | Sending outreach emails | US |
| Encrypted backup storage | Off-site copies of our databases, encrypted before they leave our servers | UK or EU |
Clay and Lusha also supply business contact details from databases they hold or license. For that data they act under their own privacy notices, not only on our instructions.
We do not sell your personal data. We may disclose data where required by law, to enforce our agreements, or in connection with a business reorganisation or sale (under confidentiality).
International transfers
Some of our providers are based outside the UK (for example, in the US). Where personal data is transferred outside the UK, we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum, or UK-recognised adequacy, so your data stays protected.
How long we keep it
| Record | How long we keep it |
|---|---|
| API request log: time, key, product, status, size, tokens charged, IP address, browser or app name | 90 days, plus up to 35 days in backups |
| Access logs at the API's front door (they never store your key) | 90 days at most |
| Keyed hash of the IP address you signed up from, or sent our contact or request-access form from (used to limit abuse) | 90 days |
| Free plan history: the company domain or normalised email address that started the free plan or a trial we offered, and its date | 12 months from that start |
| Hourly and token usage (no IP address or browser name) | The life of the account. When it closes, the account's name and details are removed and the figures stay against its account number only |
| API key records, their history, and our audit trail of account changes | 6 years after the account closes |
| People, team memberships, and signup answers | The life of the account, then 30 days |
| Records of your acceptance of our terms | 6 years after the account closes |
| Marketing opt-outs (the email address or profile handle, when, and for outreach the business it belongs to) | For as long as we send any marketing |
| Outreach contacts we found but never contacted | 30 days from when we found them |
| Outreach contacts we contacted who did not reply | 12 months from our last message |
| Outreach trial invitations and the trial account we set up (the address an invitation went to, when we sent it, and the account's name and logo) | Until that trial account is closed. We close a trial account that was never claimed 12 months after our last message |
| Enquiries and leads (including outreach contacts who replied) that never became customers | 3 years from last contact |
| Our log of emails sent to you | 6 years for notices with legal weight (terms changes, trials, cancellations); 12 months for the rest |
| Support conversations | 3 years from last contact |
| Invoices and payment records | 6 years |
| Backups of our account database | The latest 30 copies |
Our internal alerts never contain your email address. We delete or anonymise personal data when it is no longer needed for these purposes.
Your rights
Under UK data-protection law you have the right to: access a copy of your personal data; have inaccurate data corrected; have data erased; restrict processing; and receive certain data in a portable format. To exercise any of these, email hello@oddsrelay.io. We will respond within one month.
Your right to object. Where we rely on legitimate interests, you can object at any time by emailing hello@oddsrelay.io. We will then stop, unless we have compelling legitimate grounds that override your interests or we need the data for legal claims. You can always stop product news and other marketing, with no reason needed.
Complaints. Send any complaint about how we handle your data to hello@oddsrelay.io. We will acknowledge it within 30 days. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk (opens in a new tab), though we'd appreciate the chance to put things right first.
Cookies and tracking
We keep cookies to a minimum. Our dashboard sets only the cookies it needs to keep you signed in, keep your account secure and remember choices you make there, such as light or dark mode. Our analytics are cookieless.
Our website uses one cookie, and only if you arrive through a partner's affiliate link: promotekit_referral, set by PromoteKit, which runs our partner programme. It records which partner sent you, so that if you buy a paid plan we can pay that partner their commission. It lasts 60 days. It covers oddsrelay.io and its subdomains, so our dashboard at app.oddsrelay.io can add it to your checkout. If you arrive any other way, our website sets no cookie. You can delete or block it in your browser at any time. The only effect is that the partner isn't credited.
Customers outside the UK
Where we serve customers outside the UK, we also aim to meet local data-protection expectations in respect of the limited business-contact and account data involved.
Changes to this policy
We may update this policy from time to time. We'll post the updated version here and change the "effective date" above. For material changes, we'll take reasonable steps to let affected customers know.
Contact
Any questions about your privacy or this policy: hello@oddsrelay.io.