Privacy Policy

0. Data controller

Data processing is carried out by Bankroll Lab team, a project currently being set up as a sole proprietorship (EI), whose identified responsible person is Damyan Kardashev. No Data Protection Officer (DPO) has been appointed at this stage — this is not a legal requirement at the project's current scale. For any question about your data: support@bankroll-lab.com.

1. Data collected

Email address and password (via our authentication provider, Supabase); the data you enter yourself into the tool (tournament results, bankroll, staking/action-sale history); billing data needed for your subscription (name, email, country — never card details, which are processed exclusively by Stripe and never reach our servers).

2. Purposes and legal bases

Providing the Service and managing your account (performance of a contract, GDPR art. 6.1.b); billing your subscription (performance of a contract / legal accounting obligation, art. 6.1.b and c); keeping the Service secure and preventing fraud (legitimate interest, art. 6.1.f). We do not profile users, do not make automated decisions with legal effect on you, and never use your data for advertising purposes.

3. Recipients of data (processors)

Your data is shared only with the technical providers necessary to run the Service: Stripe (payments), Supabase (database, authentication, cloud backups), Railway (application server hosting), and Cloudflare (site hosting and content delivery). We do not sell any data and do not share it with third parties for commercial or advertising purposes.

4. Data location and transfers outside the EU

Your account database, authentication and cloud backups are hosted by Supabase in the European Union (region eu-central-2). The application server that runs the calculations is hosted by Railway in the United States, and Stripe and Cloudflare also operate globally. Where data is processed outside the European Economic Area, that transfer is governed by the European Commission's Standard Contractual Clauses (or an equivalent adequacy mechanism) under those providers' data processing agreements.

5. Retention period

Cloud backups are limited to a short rolling window of about 7 days and are not kept long-term. Your account data is kept for as long as your account is active. You can ask us to delete your account and all associated data at any time (your right to erasure) and we will do so within 30 days of your request. Billing records are kept longer to meet Belgian accounting and tax obligations (typically up to 7 years).

6. Cookies

The site uses a single, strictly functional cookie to remember your chosen language (30-day duration). No advertising, analytics or behavioural-tracking cookie is used — since this cookie is strictly necessary for the site to work, no consent banner is required for it.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to withdraw consent at any time where processing relies on it. To exercise these rights: support@bankroll-lab.com. You may also lodge a complaint with the Belgian data protection authority (APD/GBA — autoriteprotectiondonnees.be).

8. Security

Communications with the Service are encrypted (HTTPS). Authentication and data storage are handled by specialised providers (Supabase); payment data never reaches our servers (Stripe).

9. Minors

The Service is aimed at adult poker players; it is not intended for minors and we do not knowingly collect data about them.

10. Changes

This policy may be updated; any material change will be notified by email or on the site before it takes effect.