Privacy Policy
Last updated
1. Controller
The data controller for the personal data described in this policy is Tipzy ("we", "us"). Operator legal name and registered address to be added here. For any privacy question or to exercise the rights in Section 8, use the contact form.
2. What we collect
- Account data — name, email address, a hashed password (we never store your password in plain text), and, if you set one, a chosen avatar.
- Tipster data — if you register as a tipster: display name, bio, sport, subscription price, and every pick you publish together with its outcome.
- Usage data — pages viewed and general interaction with the site, via Google Analytics and Google Tag Manager, once you have accepted analytics cookies (see Section 4).
- Technical data — your IP address and browser user agent, recorded in server logs for security and abuse prevention.
We do not currently collect payment card details: paid subscriptions are not yet processed through Tipzy (see Terms of Service, Section 6). When that launches, this section will be updated before any payment data is collected.
3. Why we process it, and on what basis
| Purpose | What it covers | Lawful basis |
|---|---|---|
| Running your account | Registration, login, password reset, email verification | Performance of a contract |
| Publishing and settling tipster picks | Storing picks, computing win rate/yield/profit, showing your public record | Performance of a contract |
| Bot and abuse prevention | Challenge checks on forms, rate limiting | Legitimate interest |
| Security and fraud prevention | Server logs, anomaly detection | Legitimate interest |
| Analytics and product improvement | Google Analytics / Tag Manager | Consent |
| Transactional email | Verification, password reset, settlement notifications | Performance of a contract |
| Meeting regulatory obligations | Responding to Hellenic Gaming Commission or data protection authority requests | Legal obligation |
4. Cookies and analytics
Tipzy uses a small number of cookies:
- Strictly necessary — keeps you signed in and remembers your theme preference. These cannot be switched off, as the site does not work without them.
- Analytics — Google Analytics and Google Tag Manager, used to understand which pages are used and how. These load only after you accept analytics cookies in the cookie banner.
You can withdraw analytics consent at any time by clearing your cookies or through the cookie banner, which you can reopen from the footer.
5. Sharing
We share personal data with the following categories of processor, each bound by a data processing agreement:
- Hosting and database — runs the application and stores account and pick data.
- Object storage — stores uploaded images such as avatars.
- Email delivery — sends verification, password-reset, and settlement emails on our behalf.
- Bot protection — verifies that form submissions are not automated.
- Analytics — Google, for the analytics described in Section 4.
- AI settlement assistant — an AI service used to propose pick outcomes from match data; it processes pick and match details, not your account credentials, and its output is always confirmed by settlement logic before a pick is marked won or lost.
We do not sell personal data, and we do not share it with bookmakers listed on the site — the affiliate relationship described in the Terms of Service (Section 7) is limited to link-based commission and involves no data transfer about you.
6. International transfers
Some of the processors in Section 5 are located outside the European Economic Area. Where that is the case, the transfer relies on the provider's Standard Contractual Clauses or an applicable adequacy decision. Contact us if you would like more detail on a specific transfer.
7. Retention
We keep account data for as long as your account is active. If you delete your account, we remove your personal data within 30 days, except:
- published pick records, which we retain in de-identified form (without your name or email) because they form part of the platform's public, auditable performance history and other users may have relied on them;
- data we are required to keep for a longer period by law (for example, records relevant to a regulatory inquiry).
Server logs are kept for 90 days and then deleted automatically.
8. Your rights
Under GDPR you have the right to:
- access the personal data we hold about you;
- rectify inaccurate data;
- erase your data, subject to the retention exceptions in Section 7;
- restrict or object to processing based on our legitimate interests;
- port your data to another service in a structured format;
- withdraw consent at any time, for processing that relies on it (Section 4), without affecting processing carried out before the withdrawal.
To exercise any of these, use the contact form. We will respond within one month, as required by GDPR.
You also have the right to lodge a complaint with the Hellenic Data Protection Authority (dpa.gr), or with the supervisory authority in your own EU country of residence.
9. Children
Tipzy is not directed at anyone under 21 (see Terms of Service, Section 2), and we do not knowingly collect data from anyone under that age. If you believe a minor has created an account, contact us and we will remove it.
10. Changes to this policy
We may update this policy as our processing changes. Material changes — a new category of data, a new purpose, or a new processor outside the EEA — will be notified to registered users by email or an in-app notice before they take effect. The date at the top of this page always reflects the current version.