Privacy Policy

This policy explains how [LEGAL ENTITY NAME](“LongShotters”, “we”, “us”) collects, uses, and protects your personal data. It applies to UK users (under the UK GDPR and the Data Protection Act 2018) and to Australian users (under the Privacy Act 1988 and the Australian Privacy Principles).

1. Who we are

• Data controller: [LEGAL ENTITY NAME], [registered address].
• Privacy contact: privacy@longshotters.co.
• If we are not established in the UK, our UK GDPR Article 27 representative is [UK representative name & address].

2. Data we collect

• Account data — email address, username, password (stored only as a secure hash), and an age-confirmation flag.
• Payment data — billing country, the last four digits of your card, and a Stripe customer reference. Your full card number is handled solely by Stripe; we never see or store it.
• Usage data — login times, picks viewed, subscription tier, feature interactions, device and browser type, and IP address.
• Communications — support messages and emails you send us.

3. Why we use your data

For UK / EU users, we rely on these lawful bases under Article 6 of the UK GDPR:

• Performance of a contract — to create your account, deliver the tips service, and process payments.
• Legitimate interests — to prevent fraud and abuse, and to improve the product through analytics. You can object to this.
• Consent — for marketing emails to new subscribers and for non-essential cookies. You can withdraw consent at any time.
• Legal obligation — to keep tax and accounting records and to comply with lawful requests.

For Australian users, we collect and use personal information for the purposes above in line with the Australian Privacy Principles (notably APP 3, APP 5, and APP 6), and we notify you of collection at the point it occurs.

4. Who we share data with

We use a small number of trusted service providers (processors), each bound by a data processing agreement:

• Stripe — payment processing (PCI-DSS Level 1).
• Supabase — database and authentication hosting, in the Sydney (ap-southeast-2) region.
• Vercel — application hosting and product analytics.
• Resend — transactional and account email delivery.

We do not sell your personal data, and we do not share it with bookmakers or sports governing bodies.

5. International transfers

Your account and usage data is primarily stored in Australia (Sydney). Some providers (including Stripe, Resend, and parts of Vercel) process data outside Australia and the UK. Where data leaves the UK we rely on an adequacy decision or the UK International Data Transfer Agreement / Addendum; for Australian users we take reasonable steps under APP 8 to ensure overseas recipients protect your information.

6. How long we keep data

• Account data — for as long as your account is open, then deleted within a reasonable period after closure.
• Payment & tax records — up to 7 years, as required by tax law in both jurisdictions.
• Usage / analytics — on a rolling basis (around 13 months), then purged or anonymised.
• Support records — around 3 years from your last contact.

Anonymised, aggregated data that cannot identify you may be kept indefinitely.

7. Your rights

UK / EU users

You have the right to access, rectify, erase, restrict, or port your data, to object to processing based on legitimate interests or direct marketing, and to withdraw consent. We do not make solely automated decisions that have a legal or similarly significant effect on you. We respond within one month. If you are unhappy with our response you can complain to the Information Commissioner’s Office (ICO) — ico.org.uk or 0303 123 1113.

Australian users

You may request access to, and correction of, the personal information we hold about you (APP 12 and APP 13). We respond within 30 days. If you are unhappy you can complain to the Office of the Australian Information Commissioner (OAIC) — oaic.gov.au or 1300 363 992.

To exercise any right, email privacy@longshotters.co. We may need to verify your identity first.

8. Cookies

We use cookies in line with the UK Privacy and Electronic Communications Regulations (PECR). Strictly necessary cookies (such as your login session) are always on. Analytics and marketing cookies are only set after you accept them in the consent banner, and you can change your choice at any time from the footer.

9. Children

LongShotters is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a minor has registered, contact privacy@longshotters.co.

10. How we protect your data

• Encryption in transit (TLS) and at rest.
• Passwords stored only as secure one-way hashes — never in plain text.
• Access limited to those with an operational need.
• Card data handled exclusively by Stripe; we never store full card numbers.

No system is perfectly secure, but we will notify you and the relevant regulator without undue delay of any breach likely to put your rights at high risk.

11. Changes to this policy

We may update this policy. Where changes are material we will notify you by email or in-app at least 14 days before they take effect. See also our Terms of Service and Responsible Gambling page.