YouInSports is responsible for personal information handled by SportsGPT. We follow Canada's PIPEDA and Quebec's Law 25, and provide the rights required by the EU/UK GDPR, California's CCPA/CPRA and India's Digital Personal Data Protection Act, 2023 (DPDP Act) where they apply.
Privacy Officer: [email protected] (person responsible for the protection of personal information under Law 25).
1. What we collect
- Account data: email or phone number, name (optional), sign-in provider identifiers (Google, Apple, YouInSports.AI), password hash.
- Profile and preferences: sports, role, language, favourite teams, date of birth and region (used for age-appropriate features and legal-age checks).
- Content: chat messages, scoresheets, clubs, match data, generated content and reports you submit.
- Sport requests: if you use “Want another sport?” on Decision-maker (/play), we store the sport, an optional club or team, an optional email (only so we can tell you if that sport goes live), the time, whether you sent it from the sport list or the end of a pack, and campaign tags already on the link you opened. No account is required. We do not publish these requests.
- Usage and device data: message counts, a pseudonymous browser cookie, hashed IP address for rate limiting and abuse prevention, basic logs.
- Approximate location: we derive your approximate country/region from your IP address to localise suggestions; the IP and location are not stored. IP geolocation by [DB-IP](https://db-ip.com), licensed under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/).
We do not sell personal information and we do not use it for cross-context behavioural advertising.
2. Why we use it (purposes and legal bases)
- Provide the Service and your account (contract).
- Keep the Service safe: rate limits, abuse and fraud prevention, safety filters (legitimate interests / legal obligation).
- Age-appropriate experiences and legal-age checks (legal obligation, legitimate interests).
- Improve quality, including evaluating AI accuracy using de-identified data (legitimate interests; you can object).
- Communicate service and security notices (contract).
Under the DPDP Act we process data on the basis of your consent or legitimate uses permitted by law, and you can withdraw consent at any time.
3. AI processing
Messages are sent to AI model providers (currently Google Cloud Vertex AI) only to generate responses. Providers act as our processors and may not use your data to train their general models under our agreements. Automated outputs do not make decisions with legal effects about you.
4. Sharing
We share data only with service providers that help run SportsGPT (cloud hosting in Canada with Google Cloud, AI providers, SMS and sign-in providers), when required by law, or with your direction (for example, publishing a public match page). Providers are bound by contracts requiring protection of your data.
5. Where data is stored
Our primary database is in Toronto, Canada (Google Cloud northamerica-northeast2). Some providers may process data in the United States or other countries. Where required (Law 25, GDPR) we assess and protect such transfers with appropriate safeguards.
6. Retention
Account data is kept while your account is active. Chat history can be deleted by you at any time. Rate-limit records are kept for up to 24 hours; safety logs contain no message text. We delete or anonymise data when no longer needed, generally within 30 days of account deletion, except where law requires longer.
7. Children and teens
Accounts are for ages 13+. Under-18 users get privacy-protective defaults: their uploads are private, youth player names are shown as initials, and betting content is never shown to them. The free, points-only prediction game (no money, no odds) is educational and available to them. Parents or guardians can contact us to review or delete a minor's data.
8. Your rights
Depending on where you live, you can access, correct, delete or port your data, withdraw consent, object to or restrict processing, and opt out of "sale/sharing" (we don't sell or share for advertising). Quebec residents can request information about automated processing and data portability. Contact [email protected]. We respond within 30 days. You can complain to the Office of the Privacy Commissioner of Canada, the Commission d'accès à l'information du Québec, your EU/UK supervisory authority, or India's Data Protection Board.
9. Security
Encryption in transit, encrypted storage, hashed passwords, least-privilege access, secrets management and monitoring. In the event of a breach creating a real risk of significant harm, we'll notify affected people and regulators as required.
10. Cookies
See the Cookie Notice.
11. Changes
We'll post updates here and notify you of material changes.