Privacy Policy — BetCircle

Section 1 — Data Controller

The controller within the meaning of the GDPR is:

BetCircle GbR, represented by its partners Engin Diyar Aydin and Emre Kandemir Gundelsheimerstrasse 51, 70437 Stuttgart, Germany Email: info@bet-circle.com

Section 2 — Data Protection Officer

We are not required to appoint a data protection officer under Art. 37 GDPR or § 38 BDSG. You can reach us with data protection enquiries at the address in section 1.

Section 3 — Scope

3.1 This privacy policy explains the nature, scope and purposes of the processing of personal data when using the "BetCircle" mobile application and its backend services. It does not cover the website bet-circle.com, which has its own privacy information.

3.2 Personal data means any information relating to an identified or identifiable natural person. The Service is directed at users who are of full age (at least 18 years).

3.3 We do not knowingly process personal data of persons under 18 years of age; use is permitted only to persons of full age. Accounts of minors are deleted as soon as we become aware of the minority.

Section 4 — Categories of Data

Depending on use, we process in particular:

• Account and master data (email address, user ID, password hash held by our authentication provider)
• Profile data (username, display name, biography, profile and banner image)
• Content data (posts, comments, reactions, GIFs selected, uploaded images)
• Bet tracking and performance data (entered or imported bets, stakes, odds, results, derived statistics)
• Communication and support data (email correspondence, system emails, service communication)
• Moderation data (reports submitted and received, moderation status of an account, warnings, suspensions, and a flag indicating a suspicion that a user may be a minor)
• Usage and technical data (device information, logs, timestamps, IP address, login times, security monitoring, push notification token)
• Transaction and subscription data (subscription status, purchase and renewal events reported by the app store)
• Advertising data (advertising identifier, consent status for personalised advertising)
• Consent and preference data (age confirmation, acceptance of the T&C, notification and privacy settings)

Section 5 — Legal Bases and Whether You Must Provide Data

Processing takes place in particular on the basis of Art. 6 (1) (a) GDPR (consent), (b) (performance of a contract), (c) (legal obligation) and (f) (legitimate interests). The specific basis is stated with each processing activity below.

Where we rely on legitimate interests under Art. 6 (1) (f) GDPR, those interests are: operating the Service securely and free of abuse, detecting and preventing fraud and spam, protecting our users from unlawful content, defending against legal claims, and improving the product.

Is providing data required?

Providing personal data is neither required by statute nor by contract in the sense that you are obliged to use the Service. However, some data is necessary for the contract to be performed at all:

• Email address and age confirmation are required to create an account. Without them no account can be created and the Service cannot be used.
• Bet data is required only for the tracking and analysis functions. Without it those functions produce no result, but the account remains usable.
• Images are required only for the profile picture, banner, image posts and the bet slip import. Providing them is entirely optional.
• The push notification token is required only for notifications, which are optional.
• Consent to personalised advertising is voluntary. If you decline, you continue to see advertising, but it is not personalised.

Section 6 — Registration, Login and Account Management

We process the account data necessary for authentication, account security and the provision of the user account (Art. 6 (1) (b) GDPR). Registration is possible by email address and password or via Apple or Google sign-in. Where you use a sign-in service, we receive the identifiers released by that service; we do not receive your password there.

When registering we also record that you confirmed being at least 18 years old and accepted the T&C, together with the time of that confirmation. This documentation rests on Art. 6 (1) (c) and (f) GDPR — we must be able to demonstrate that the age restriction and the inclusion of our terms were observed.

Section 7 — Profile Functions and Social Interactions

When you use social functions (posts, comments, reactions, follows) we process the content and interaction data required for them (Art. 6 (1) (b) GDPR; moderation additionally (f)).

The following may in particular be publicly visible: profile information such as username, display name, biography and profile or banner image, published posts, comments and reactions, and statistics or performance metrics where released by you or shown in the app.

Section 8 — Bet Tracking and Performance

We process bet data entered or imported by you in order to provide the tracking and analysis functions (Art. 6 (1) (b) GDPR).

Section 9 — Image Upload, OCR and AI Processing

When you import a bet slip from an image, the image and the text recognised in it are processed in order to extract the bet data. For this we use an external AI service provider that acts as a processor on our behalf. The legal basis is Art. 6 (1) (b) GDPR, as the processing serves the function you requested.

The provider currently used for this is OpenAI. Images transmitted for this purpose are not used to train the provider's models.

Uploaded images are stored on our behalf by our storage provider (see section 15) for as long as the associated content exists.

Section 10 — Moderation, Reports and Account Restrictions

Automated image check

Images you upload — in particular profile and banner pictures and images in posts and comments — are automatically scanned by an external content moderation service provider located in the European Union in order to detect and prevent unlawful or prohibited content, in particular sexual or pornographic imagery. For this purpose the image is transmitted to and analysed by that provider, which acts as a processor on our behalf. An image classified as prohibited is rejected and deleted from our storage. The legal basis is our legitimate interest in a safe service and in the protection of our users (Art. 6 (1) (f) GDPR). Section 21 explains how this relates to Art. 22 GDPR.

Reports

If you report a user or a piece of content, we process your report together with your user ID and the reported content in order to assess it. If you are reported, we process the report concerning you for the same purpose. The legal basis is Art. 6 (1) (c) and (f) GDPR — we are required to act on notices under Art. 16 of Regulation (EU) 2022/2065 and have a legitimate interest in a safe platform.

Warnings, suspensions and bans

Where content breaches our Terms and Conditions or the law, we may remove it, warn the user, restrict individual functions, suspend the account temporarily or close it permanently. For this purpose we store the moderation status of the account, the measure taken and the reason for it. The legal basis is Art. 6 (1) (b) and (f) GDPR.

Where there are concrete indications that a user has not reached the minimum age of 18, we record that suspicion as a flag on the account so that it can be reviewed and the account restricted or deleted. The legal basis is Art. 6 (1) (c) and (f) GDPR — the protection of minors and our obligation to keep the Service restricted to adults.

You receive a statement of reasons for any such measure and can object to it; clause 6.7 of the Terms and Conditions describes the procedure.

Section 11 — Push Notifications

If you enable notifications, your device generates a push token which we store in order to deliver notifications to that device. Delivery runs through the push service of the Expo platform and from there through the notification services of Apple (APNs) and Google (FCM).

The legal basis is Art. 6 (1) (a) GDPR — you grant the permission at the operating system level and can withdraw it at any time in the device settings or in the app settings. When you withdraw it or delete your account, the token is deleted.

Section 12 — Subscriptions and Payments

For paid features we process subscription-related data such as the subscription status, the plan and the renewal and expiry events reported to us. Payment itself is processed by the app store operator; we do not receive your payment details. We use an external subscription management provider to reconcile purchase receipts with your account (Art. 6 (1) (b) GDPR).

Section 13 — Advertising and Advertising Identifiers

The app displays advertising supplied by Google (Google AdMob). Depending on your choices, advertising is either personalised or non-personalised.

Consent in the EU and the UK

Before the first advertisement is requested, we present a consent form provided through Google's User Messaging Platform. Personalised advertising and the use of your device's advertising identifier take place only if you consent there (Art. 6 (1) (a) GDPR, and § 25 (1) TDDDG for the access to information stored on your device). If you decline, only non-personalised advertising is shown.

App Tracking Transparency on iOS

On iOS we additionally request permission through Apple's App Tracking Transparency dialogue before the advertising identifier (IDFA) can be used. Without that permission, no tracking across apps takes place.

Android advertising ID

On Android the app declares the com.google.android.gms.permission.AD_ID permission, which allows the advertising ID to be read for the purposes described above.

Withdrawing consent

You can change your advertising consent at any time in the app under Settings → Privacy, and separately switch off ad personalisation there. Withdrawal takes effect for the future.

Section 14 — Error Monitoring and Security

We use an error monitoring service to detect crashes and faults. In this context technical data, the IP address and an identifier of the affected account may be transmitted so that a fault can be traced to a specific session. Data is received on the provider's servers in Germany. The legal basis is our legitimate interest in a stable and secure service (Art. 6 (1) (f) GDPR).

For system security and abuse detection we also process IP addresses and access and login logs (Art. 6 (1) (f) GDPR).

Where we notify you of security-relevant events by SMS, your telephone number is transmitted to an external messaging provider for that purpose.

Section 15 — Recipients and Processors

We pass personal data to the following recipients, each of which processes it on our behalf under a data processing agreement unless stated otherwise:

– Authentication and account management: Clerk (USA)
– Application hosting and database: Render (Frankfurt, EU)
– Image and media storage, backups: Backblaze B2 (USA)
– Automated image moderation: Sightengine (France, EU)
– OCR and AI-assisted bet slip import: OpenAI (USA)
– Advertising: Google AdMob (Ireland / USA)
– Subscription management: RevenueCat (USA)
– Push notification delivery: Expo, Apple APNs, Google FCM (USA / Ireland)
– Error monitoring: Sentry (Germany, EU)
– GIF search and delivery: GIPHY (USA)
– Sports data: API-Sports and further sports data providers (France, EU)
– SMS security notifications: Twilio (USA)
– App distribution and payment: Apple, Google (Ireland / USA)

When you search for a GIF, your search term and your IP address are transmitted to GIPHY so that results can be delivered. GIPHY acts as an independent controller for that request.

Section 16 — Transfers to Third Countries

Some of the recipients named in section 15 are located in the United States. Where no adequacy decision of the European Commission applies to a recipient, the transfer takes place on the basis of the standard contractual clauses adopted by the Commission under Art. 46 (2) (c) GDPR, supplemented where necessary by additional safeguards.

You may request a copy of the safeguards at any time by email to info@bet-circle.com.

Section 17 — Retention Periods

We store personal data only for as long as it is necessary for the purposes described, or as long as we are required to retain it by law. Thereafter it is deleted or anonymised.

– Account, profile and content data: deleted immediately when the account is deleted
– Deactivated accounts: permanently deleted 30 days after deactivation unless reactivated
– Bet tracking data: until the account is deleted or the individual entry is removed
– Age and T&C confirmation: deleted with the account
– Moderation status, warnings, reports: deleted with the account
– Push notification token: until notifications are switched off or the account is deleted
– Server and security logs: 30 days
– Error monitoring events: 90 days
– Uploaded images: deleted when rejected by moderation, and when the associated content or account is deleted
– Records of moderation decisions: deleted with the account
– Subscription and transaction records: up to 10 years where retention obligations under § 147 AO and § 257 HGB apply
– Support correspondence: 3 years

What happens when you delete your account

Deletion is immediate and permanent. Your posts, comments, tracked bets, likes, bookmarks, follow relationships, profile and settings, notifications and the figures derived from them, such as performance statistics and leaderboard positions, are deleted from our database rather than anonymised or retained in hidden form. Your authentication record with our sign-in provider is deleted as well. Comments written by other users on your posts are removed together with those posts.

Export your data beforehand if you want to keep it — section 20 describes how.

Section 18 — Your Rights

Under the GDPR you have the right of access (Art. 15), the right to rectification (Art. 16), the right to erasure (Art. 17), the right to restriction of processing (Art. 18), the right to data portability (Art. 20) and the right to withdraw consent at any time with effect for the future (Art. 7 (3)).

To exercise these rights, contact us at info@bet-circle.com or use the corresponding functions in the app settings.

Section 19 — Right to Object

You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is carried out on the basis of Art. 6 (1) (f) GDPR. This applies in particular to processing for security monitoring, abuse prevention and product improvement.

Where personal data is processed for direct marketing purposes, you have the right to object at any time without giving reasons. Following such an objection, the data will no longer be processed for those purposes.

An objection can be sent informally to info@bet-circle.com.

Section 20 — Data Export and Portability

You can request a copy of the personal data we hold about you. In the app, Settings → Export data prepares an email request for this purpose. Alternatively, write to info@bet-circle.com.

We respond within one month of receiving the request in accordance with Art. 12 (3) GDPR. Where a request is particularly complex, that period may be extended by a further two months; we will inform you of any such extension and its reasons.

The export is provided in a structured, commonly used and machine-readable format and comprises the account, profile, content, bet tracking and subscription data associated with your account.

Section 21 — Automated Decision-Making

Images you upload are subject to the automated content moderation described in section 10, and an image classified as prohibited may be automatically rejected. This does not produce legal effects concerning you, nor does it similarly significantly affect you within the meaning of Art. 22 GDPR: you can upload different content or contact us, and the decision affects a single upload rather than your access to the Service.

Where a moderation decision leads to content being removed or an account being restricted, you receive a statement of reasons and can object in accordance with clause 6.7 of the T&C; that review is not carried out solely by automated means.

No other solely automated decision-making within the meaning of Art. 22 GDPR takes place.

Section 22 — Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

The authority competent for us is:

Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg Lautenschlagerstraße 20, 70173 Stuttgart baden-wuerttemberg.datenschutz.de

Section 23 — Changes to this Privacy Policy

We may update this privacy policy when legal, technical or organisational circumstances change. The current version is always available at bet-circle.com/datenschutzerklaerung.

Section 24 — Contact

For data protection enquiries:

BetCircle GbR Gundelsheimerstrasse 51, 70437 Stuttgart, Germany Email: info@bet-circle.com