Privacy

Who: the controller is Codename OÜ, Estonia.

What we hold:when you request an OddsIntel Data API key, your name, work email address, company, what you would use the data for and the plan you are interested in. For a paid plan we also hold your company’s legal name, its VAT or registration number and your confirmation that you are buying for business purposes: paid plans are sold to businesses only, and we need these to contract with and invoice the right company. They are kept as long as the rest of your key request data (see below); where they appear on an invoice, the invoice is kept as long as accounting law requires. If we issue a key, we also hold its plan, limits and status, a fingerprint (hash) and short prefix of the key (never the key itself), and when it was issued or revoked. Stored in our own database in Helsinki, Finland (EU).

Your IP address: we do not store your IP address itself. To stop one person taking many free keys, we keep a keyed hash of it (a one-way fingerprint that cannot be turned back into the address) with your request for 14 days, then delete it. Our network provider (Cloudflare) and our server see the address briefly, for security and to limit repeated requests, and Cloudflare may run a bot check (Turnstile) when you send the form.

Purpose and legal basis: to review your request, issue a key and contact you about it. The legal basis is taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)).

API request logs: when you use a key, we log the key id, the endpoint called, the time and the response status. We use the logs to apply rate limits, to spot abuse and, once paid plans exist, for billing. Logs are kept for 90 days.

Key usage and shared keys: for each key and day we count the requests and the rows of data returned, and keep a one-way fingerprint of each network the key was used from (the network part of the IP address: the first three numbers of an IPv4 address, or the first 48 bits of an IPv6 address, hashed with a secret value and the date). A fingerprint cannot be turned back into an address and cannot be matched across days. We use it only to see whether a key is used from more networks than one customer would, and we delete it after 14 days. We never store the IP address itself. The daily request and row counts are kept as usage records for as long as the key request data. The legal basis is our legitimate interest in preventing abuse of the service and in applying the plan limits (GDPR Art. 6(1)(f)).

Who processes it: the same providers as the waitlist (see “Waitlist” below): our network provider (Cloudflare), our web server and database host in Helsinki, Finland (EU), and Resend, which sends our emails (see “Email” below for the transfer basis).

How long we keep it: key request data is kept while the key is active and for 12 months after it ends. A request we decline, or never answer, is deleted after 90 days.

Your rights: if you are in the EU/EEA, you have the right to access your data, correct inaccurate data, request deletion, object to processing, and data portability. To exercise these rights, email us at [email protected]. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee).

Who: the controller is Codename OÜ, Estonia. The waitlist is for businesses that want to hear about the beta and launch of our odds-data service, OddsIntel Data.

What we hold: your email address, company, what you would use the data for, and, only if you give them, a line about who you are, your role, VAT number, budget band, timing and whether you ticked the launch-price intent box; the notice and consent sentences you saw; and when you signed up and confirmed. Stored in our own database in Helsinki, Finland (EU). We do not store your IP address in the waitlist. Our network provider (Cloudflare), our web server logs and our email provider (Resend) see it briefly for security and delivery, and Cloudflare may run a bot check (Turnstile) when you send the form.

Purpose and legal basis: to judge whether the service fits you and to email you about the OddsIntel Data beta and launch. The legal basis is our legitimate interest in answering a business enquiry (GDPR Art. 6(1)(f)); you can object at any time. Offers are emailed only if you ticked the separate, optional box (your consent, Art. 6(1)(a)), which you can withdraw at any time.

Double opt-in: we send one email asking you to confirm your address (Resend sends it as our processor, see “Email” below for the transfer basis). You are on the list only once you confirm.

How long we keep it: an unconfirmed sign-up is deleted once its confirm link expires (7 days); every sign-up is deleted at the latest 12 months after it was made. A nightly job does both.

Deletion on request: email [email protected] from the address you signed up with and we delete your entry within 30 days.