Privacy policy
Last updated: 21 October 2026 · Deutsche Fassung
Contents
- Who is responsible
- Summary
- Data we collect
- Why and on what basis
- Fraud and trial abuse
- Automated decisions
- Emails and push
- Affiliate programme
- What partners see about you
- Who receives data
- Transfers outside the EU
- How long we keep it
- Cookies and storage
- Your rights
- Complaints
- Do you have to give us data?
- Security
- Age
- Changes
1. Who is responsible for your data
The controller under the General Data Protection Regulation (GDPR) is Enkova s. r. o., Lehotská 370/22, 972 71 Nováky, Slovak Republic, company ID (IČO) 57610657, VAT ID (IČ DPH) SK2122847859, registered in the Commercial Register of the District Court Trenčín, Section Sro, Insert No. 57998/R ("we", "us"). For anything about your data, email support@arbvantage.net or write to the address above.
We are established in the EU, so we don't need a representative under Article 27 GDPR. We have not appointed a data protection officer, because our processing doesn't meet the conditions in Article 37 GDPR that make one mandatory; the contact above handles all privacy questions.
2. The short version
- We collect what we need to run your account, bill you, send you service emails and stop people abusing the free trial.
- We don't sell your data, we don't show ads and we don't use analytics or advertising trackers, on our website or in the dashboard.
- Card details go straight to Stripe. We never see or store your full card number.
- To enforce one free trial per person and keep accounts safe, we use device and network signals at sign-up, login and checkout, based on our legitimate interest in preventing fraud (not on consent). Section 5 explains exactly what we use and how you can object.
- We never suspend an account automatically. A possible duplicate or shared account is only flagged, and a person reviews it and decides (section 6).
- You can download your data as a file in Settings, export your bets and transactions, and delete your account yourself at any time.
3. Data we collect
| Category | What it includes |
|---|---|
| Website visits | When you open any page, our hosting provider Cloudflare processes your IP address, the page requested, time, browser user agent and the language your browser prefers, to deliver the page, choose your language (country derived from the IP, not stored) and protect the service from attacks. Our server logs keep this technical data for up to 7 days. |
| Account data | Email address, name (optional), password (stored only as a salted hash), email verification status, your confirmation that you are 18+ and accept the terms, account settings (the bookmakers you hold accounts with, sports, filters, stake and rounding preferences, alerts) and onboarding progress. |
| Betting records you enter | Bets you log in the tracker (events, markets, odds, stakes, results), bookmaker balances, deposits, withdrawals and free bets you enter, and notes. We never connect to your bookmaker accounts; this is only what you type in or log. |
| Billing data | Plan, subscription status and dates, invoices, billing country, your Stripe customer ID, and if you cancel, the cancellation reason and optional comment you give us. Stripe also gives us a card fingerprint: a code that recognises the same card across accounts without revealing its number. We don't receive full card numbers or security codes. |
| Usage data | Events in the dashboard, such as sign-ins, which opportunities you open, alerts sent to you, reports you send us about an opportunity, and settings changes. To detect account sharing and scraping, we also count your account's requests per hour and note the networks used in that hour (see section 5). We record these ourselves; we don't use third-party analytics. |
| Device and network data | For each login session: a shortened IP address (for example 203.0.x.x), the country, your browser's user agent and the device identifier. At sign-up, login and checkout: your IP address as a keyed hash (see section 5), the country and network provider derived from it, a browser fingerprint hash, the time zone, languages and screen size your browser reports, whether the browser appears to be automated or in private mode, and device identifiers stored on your device (see section 12). |
| Push notifications | If you switch them on: the push address (endpoint) and keys your browser gives us, and which alerts you chose. |
| Affiliate data | Whether you signed up through an affiliate link or with a partner code, and whose, and whether you asked to be hidden from that partner's list. If you are an affiliate: your code, the clicks and sign-ups attributed to you, your commissions and payouts, and your statement details (see section 8). Discounts and rewards from the earlier referral programme. |
| Communications | Emails you send us, records of the emails we send you (for example, delivery status), your email opt-outs, and whether your address is on our email suppression list (see section 7). |
We collect this from you and your browser. Billing data and the card fingerprint come from Stripe; country and network provider are derived from your IP address by our hosting provider, Cloudflare. We don't buy data about you.
Your betting records say something about your finances and betting habits. We treat them as confidential, use them only to provide your tracker, statistics and weekly summary, and never share them with bookmakers or anyone else for their own purposes.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Delivering our website and app securely: serving pages, choosing your language, protecting against attacks, short-lived server logs (section 3) | Legitimate interest in delivering the service securely (Art. 6(1)(f)) |
| Creating and running your account; showing your feed, tracker, balances and statistics; customer support | Performance of our contract with you (Art. 6(1)(b)) |
| Affiliate programme: affiliate link clicks, attribution, commissions, payouts and statements (section 8) | Contract with the affiliate (Art. 6(1)(b)); legal obligation to keep accounting and tax records (Art. 6(1)(c)); legitimate interest in correct attribution, preventing commission fraud and evidencing commissions to the affiliate with pseudonymised customer details (Art. 6(1)(f)) |
| Subscriptions, payments, invoices, and discounts and rewards from the earlier referral programme | Contract (Art. 6(1)(b)); legal obligation to keep accounting and tax records (Art. 6(1)(c)) |
| Service emails: verification codes, password resets, trial reminders, billing and cancellation confirmations | Contract (Art. 6(1)(b)) |
| Set-up reminders and product news by email to people who haven't bought a subscription (section 7) | Your consent, given with a separate, unticked box (Art. 6(1)(a)); you can withdraw it at any time with the link in each email or in Settings |
| Weekly summary email | Legitimate interest in giving you an overview of your results (Art. 6(1)(f)); you can switch it off in Settings at any time |
| Push notifications | Your consent, given in your browser (Art. 6(1)(a)); you can withdraw it at any time in Settings or in your browser |
| Keeping you signed in securely; protecting accounts against attacks and bots (session cookie, rate limits, Cloudflare Turnstile) | Contract (Art. 6(1)(b)) and legitimate interest in the security of the service (Art. 6(1)(f)) |
| Preventing fraud, multiple accounts and repeat free trials; protecting accounts against takeover (section 5) | Legitimate interest in preventing fraud and abuse of the free trial (Art. 6(1)(f); see recital 47 GDPR), assessed in our written legitimate interest assessment. Not consent. |
| Detecting account sharing, scraping and data being passed on, including account-specific markers in the data we show you (section 5) | Legitimate interest in protecting the service and enforcing our terms (Art. 6(1)(f)); performance of the contract, which covers personal use only (Art. 6(1)(b)) |
| Email suppression list: not emailing addresses that bounced, complained or unsubscribed (section 7) | Legitimate interest in reliable email delivery and in respecting your choice (Art. 6(1)(f)); legal obligation to honour an objection to direct marketing (Art. 6(1)(c) with Art. 21(3) GDPR) |
| Improving the product from our own aggregated records | Legitimate interest (Art. 6(1)(f)) |
| Complying with the law, answering lawful requests, and establishing or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) |
Where we rely on legitimate interest, we have weighed our interest against your rights and limited the data to what is needed. You can object at any time (see section 13). We don't use your data for advertising, and we don't make it available to bookmakers.
5. Fraud and trial-abuse prevention
The free trial is offered once per person. To enforce that, to keep out bots and automated sign-ups, and to protect accounts against takeover, we use these signals when you submit the sign-up or login form or start a checkout. We don't collect them when you simply browse our website (section 3 explains the technical data that any page view involves).
- a browser fingerprint hash, calculated in your browser from technical properties (browser and system version, languages, time zone, screen, number of processor cores and memory, touch support, installed fonts, and how your browser draws graphics and processes audio) and sent to us only as a one-way hash. With it we receive the time zone, languages and screen size, and whether the browser appears to be automated or in a private window;
- device identifiers: a random identifier (
av_did) stored in your browser's localStorage when you submit sign-up, log in or start a checkout. If you delete it, it is not restored. In addition, our server sets a signed, HttpOnly cookie (av_did_s) at sign-up and login; - your IP address, stored for comparison only as a keyed hash (HMAC-SHA-256 with a secret key that only we hold), together with the approximate country and network type (for example, whether it belongs to a VPN, hosting provider or the Tor network). Without the key, the hash can't be turned back into your address, but we can still recognise the same address again, so the hash is pseudonymous, not anonymous, personal data;
- the card fingerprint provided by Stripe;
- a normalised form of your email address (for example ignoring "+" tags) and checks against lists of disposable email providers and the email domain's mail records. If you delete your account, we keep only a hash of the normalised address (section 11).
Legal basis. We use these signals on the basis of our legitimate interest in preventing fraud, multiple accounts and repeated free trials, and in keeping accounts secure (Art. 6(1)(f) GDPR; recital 47 GDPR recognises fraud prevention as a legitimate interest). We don't rely on your consent for this, and accepting our terms is not consent to it. We have weighed our interest against your interests and rights in a written legitimate interest assessment, which is available on request.
Access to your device. Reading and storing this information on your device is relied on as strictly necessary for the service you asked for: the account you create or sign in to, its protection against fraud and takeover, and the trial you request (§ 165(3) of the Austrian Telecommunications Act 2021, § 25(2) no. 2 of the German TDDDG, § 109(8) of the Slovak Electronic Communications Act No. 452/2021 Coll., Art. 22(2) of the Spanish LSSI). That is why we don't ask for separate consent for it.
Safeguards.
- We use these signals only to check sign-ups, logins, trial starts and checkouts for duplicate accounts, fraud and bots, and to check affiliate referrals (section 8). We never use them for advertising, never to track you across websites or build a profile of your browsing, and never sell them; only our processors receive them.
- They are collected only when you submit sign-up or login and when you start a checkout, not while you browse our website or use the dashboard.
- We store them only as hashes or random identifiers and delete them automatically 24 months after they were last seen (section 11).
- There are no automatic bans. A possible duplicate account is only flagged for review; a person looks at it and decides, and you can explain your side (section 6).
- You can object at any time (Art. 21 GDPR) by emailing support@arbvantage.net. We review your objection. If we stop using these signals for your account, we can't check whether you are eligible for a free trial, so you can still subscribe, but without a free trial. If fraud prevention still requires the processing in your case (for example, because your account is linked to an earlier account that already had a trial), we tell you why. You can also complain to a supervisory authority (section 14).
Detecting shared accounts, scraping and leaked data
Our terms (section 12) allow the service for your personal use only. To detect account sharing, automated scraping and our data being passed on:
- we count your account's requests per hour (feed loads, opportunity details, CSV exports, requests refused as too many, and signs of automation, such as requests from a hidden tab, from outside our app or from a headless browser or HTTP library), and note the networks used in each hour: the first three blocks of the IP address (for example 203.0.113), the country and the network operator (ASN). Hourly counters are kept for 90 days, network records for 30 days;
- we limit how many devices can be signed in at the same time (two by default); signing in on another device signs out the one used longest ago;
- our system checks these records for patterns that suggest sharing or scraping (for example, many networks or countries in the same hour, or request rates no person produces). A match creates a flag for a person to review. Open flags are kept until they are resolved, closed flags for 1 year. For a strong pattern, the system also lowers your account's request limits for 24 hours; this lifts automatically and doesn't block your access. Only a person can suspend an account, after looking at the evidence (section 6);
- we add account-specific markers to the data we show you: codes in the data sent to your dashboard, a marker line in your CSV exports and, if you have switched stake rounding off, cent-level differences in how a stake is split. They never change the odds, and the profit shown is never lower because of them. The markers are calculated from your account ID with a secret key whenever they are needed; nothing extra is stored about you. We use them only to trace data that turns up elsewhere, and a match is evidence for a person's decision, never an automatic ban.
Legal basis: our legitimate interest in protecting the service and our data from misuse and in enforcing our terms (Art. 6(1)(f)), and performance of the contract, which covers personal use only (Art. 6(1)(b)). If a flag leads to action against an account, we keep the relevant records for as long as needed to establish or defend legal claims. You can object as described in section 13.
Cloudflare Turnstile checks the sign-up and login forms for bots. It runs a short challenge in your browser and processes technical information about your browser and connection for us; it is not used to track you across websites.
6. Automated checks and human review
Our system compares the signals in section 5 automatically. It never suspends an account on its own. What it does depends on how strong a match is:
- No or weak match (for example, only a shared IP address, which is common on mobile networks and in offices): nothing happens, or the account is put in a queue for a person to look at. You keep your trial.
- Stronger match (for example, the same browser fingerprint and IP address as another account, the same device identifier or payment card as an earlier account, or the email address of a deleted account that already had a trial): the free trial is not offered and the account is flagged for review. You can keep using your account and subscribe without a trial.
- If the browser fingerprint can't be calculated (for example because scripts are blocked), the trial is not offered until it can be checked, for example at checkout.
A person on our team then reviews each flagged account and decides: for example, to clear it (and restore the trial where appropriate) or, if the evidence shows a duplicate account or misuse, to suspend it. Because a person makes that decision, a suspension is not a decision based solely on automated processing (Article 22 GDPR). The same applies to the usage flags in section 5.
Your right to be heard. If we suspend your account, we tell you the reason. Whether it is a suspension, a withheld free trial or a temporary request limit, you can explain your side and contest it: email support@arbvantage.net from the address on your account. A member of our team who can change the decision will look at the full picture, and we will reply with the outcome and our reasons, normally within 7 days. We never start charging you because of a fraud check.
The free-trial decision. Whether we offer you the free trial is decided automatically from these signals. We rely on Art. 22(2)(a) GDPR, because the check is necessary to decide whether to offer the trial when you enter the contract. You have the right to have a person review that decision, to give your view and to contest it: email support@arbvantage.net, and a member of our team will decide again, normally within 7 days.
7. Emails and push notifications
- Service emails (verification codes, password resets, trial reminders, payment and cancellation confirmations) are part of the service and can't be switched off while you have an account.
- Weekly summary: an overview of your own results. You can switch it off in Settings or with one click on the link in each email.
- Set-up reminders and product news go to people who haven't bought a subscription only if they ticked the separate, unticked box for them; you can withdraw that consent at any time. Customers may receive emails about similar services of ours; we tell you when we collect your address and in every such email that you can object at any time, free of charge, with the link in the email or in Settings. Every marketing email has an unsubscribe link.
- Suppression list. If an email to you bounces permanently, if you mark one of our emails as spam, or if you unsubscribe from all optional emails, we put your address on a suppression list (address, reason and date) so we don't email it again. After a permanent bounce we send nothing to that address; after a spam report or an unsubscribe we send only the emails needed for your account and contract (for example codes, receipts and legal confirmations). Our email provider tells us about bounces and spam reports. We keep an entry for as long as the address could otherwise receive emails from us; an unsubscribe entry is removed if you switch emails back on.
- Push notifications are only sent if you switch them on and allow them in your browser. Your browser's push service (for example Google, Apple, Mozilla or Microsoft, depending on your browser) delivers them; the content is encrypted end to end. You can turn them off at any time in Settings or your browser.
8. Affiliate programme
Anyone with an account can refer customers through our affiliate programme (referral terms). This involves the following data:
- Clicks on affiliate links. We don't store anything on your device for the affiliate programme. When you open an affiliate link (
arbvantage.net/r/CODE, or a page of our website with?ref=CODE), the partner code travels in the address of the page and of our sign-up links, and the sign-up form shows it in a visible, optional "Partner code" field that you can change or clear. Our server records the click: the code, the time, a keyed hash of your IP address (never the address itself), a rough device type (mobile, tablet, desktop) derived from your browser's user agent, and the path of the page you landed on. Clicks from bots and link previews aren't recorded. - Attribution. If you create an account with a partner code (from the link or typed in), your account is linked to that affiliate permanently. To pay commissions only for genuine new customers, we compare the sign-up with the affiliate's own account using the fraud-prevention signals in section 5. If the account shares a device or payment card with the affiliate's account, the referral doesn't count; if it only shares a network (IP address) or browser fingerprint, a person on our team checks it before deciding. Your subscription payments, refunds and chargebacks are then used to calculate the affiliate's commission.
- What affiliates see. Aggregated figures (clicks, sign-ups, paying customers, revenue and commissions) and, for each customer they referred, only the pseudonymised details described below. They never see your name, full email address, bets, settings or payment details.
- If you are an affiliate: your affiliate code, the version of the affiliate terms you accepted and when, the promotion channels and websites you declare and your target countries (to check that promotion follows the affiliate terms), the details for your self-billing statements (legal name, address, country, business type and VAT ID, if any), your commissions, reversals, withdrawals and statements, and the ID and payout status of your Stripe connected account.
- Payouts through Stripe Connect. You complete identity and bank checks, and manage payouts, in Stripe components embedded on your Invite friends page. Stripe collects that data directly, as an independent controller under its own privacy policy (stripe.com/privacy) and the Stripe Connected Account Agreement. We don't receive your ID documents or full bank details, only whether your details are submitted, whether payouts are enabled and the status of each transfer.
Legal bases: running the programme, calculating commissions and paying them out are necessary for the affiliate agreement (Art. 6(1)(b)); keeping commission, payout and statement records is a legal obligation under accounting and tax law (Art. 6(1)(c)); the click records and the checks on attribution are based on our legitimate interest, shared with the affiliate, in attributing customers correctly and paying commissions only for genuine referrals (Art. 6(1)(f)). You can object to this as described in section 13.
What we share with the partner who referred you
If you sign up through a partner's (affiliate's) link, we share with that partner only:
- a masked identifier derived from your email address (for example
j•••••@gmail.com; if your address isn't at a public mail service, the domain is masked too, for examplej•••••@•••.at); - your subscription status (trial, paying or cancelled);
- the month you signed up;
- the commission the partner earned from your payments.
We never share your full email address, name, payment details or usage data. Legal basis: our legitimate interest in calculating commissions and evidencing them to the partner (Art. 6(1)(f) GDPR). Partners are bound to confidentiality by the affiliate programme terms and may not try to re-identify you or contact you using this data.
How to object (Art. 21 GDPR): switch on "Hide me from my referrer's list" in Settings, or email support@arbvantage.net and we do it for you within one month. From then on the partner no longer sees your masked details, status or sign-up month; they only see "1 hidden customer", without any identifier. The commission accounting itself continues, and the partner still sees the commission amount without any identifier, because it is needed to pay them what they are owed.
9. Who receives your data
We use a small number of service providers who process data on our behalf under data-processing agreements (Article 28 GDPR):
- Cloudflare, Inc. (USA) and its affiliates: hosting, database, content delivery, security, bot protection (Turnstile) and the IP-based country and network lookup.
- Stripe (Stripe Payments Europe, Ltd., Ireland, and its affiliates): payments, subscriptions, invoices and the card fingerprint. Stripe is also an independent controller for some data it needs for its own legal obligations, such as fraud and anti-money-laundering checks, and for the identity and bank details of affiliates it pays out through Stripe Connect (section 8); see stripe.com/privacy.
- Resend (Resend, Inc., USA): sending service emails.
- Browser push services (Google, Apple, Mozilla or Microsoft, depending on your browser), only if you switch on push notifications.
If you signed up through a partner's (affiliate's) link, that partner receives only the pseudonymised details described in section 8.
Our odds and media providers (such as The Odds API and TheSportsDB, and a logo lookup service) receive no personal data about you: our servers fetch odds, team crests and bookmaker logos from them and serve them to you from our own domain.
We may also disclose data where the law requires it, to authorities or courts; to our professional advisers (for example accountants and lawyers, who are bound to confidentiality); to protect our rights or users; or to a buyer of our business, in which case this policy continues to apply. We don't sell or rent personal data.
10. Transfers outside the EU
Cloudflare, Stripe, Resend and the push services may process data in the United States or other countries outside the European Economic Area. Where they do, the transfer is covered by the EU adequacy decision for the EU-US Data Privacy Framework (where the provider is certified, as Cloudflare, Stripe and Resend are) or by the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
11. How long we keep it
| Data | How long |
|---|---|
| Server logs (website and app requests: IP address, page, time, user agent) | 7 days |
| Account, settings, bet tracker, balances and notes | While your account exists. When you delete your account, they are deleted straight away from the live database and from backups within 30 days. |
| Accounts whose email address was never confirmed (no subscription, no payment) | Deleted automatically 30 days after sign-up, together with their sessions, events and fraud-prevention signals (unless the account was suspended) |
| Login sessions (shortened IP address, country, user agent, device identifier) | A session ends after 14 days without activity and is deleted at the latest 30 days after your last activity. Sessions that you or we end are kept for 7 days, so we can tell you why you were signed out. |
| Security and login events (sign-ups, sign-ins, password, email and two-factor changes, sessions ended; hashed IP, country, network) | 12 months (365 days) |
| Usage events | 24 months (730 days), then deleted |
| Reports you send us about an opportunity | 24 months, then deleted |
| Hourly request counters per account (section 5) | 90 days |
| Network records for those counters (IP address prefix, country, network operator) | 30 days |
| Usage flags for review (section 5) | Open flags until they are resolved; closed flags 1 year after they were resolved |
| Affiliate link clicks (code, click ID, keyed IP hash, device type, landing path) | 24 months (730 days) |
| Which affiliate referred an account | While the account exists, and afterwards as long as the commission records for it must be kept (below) |
| Affiliate commissions, payouts, statements and statement details | 10 years from the end of the year concerned, as Slovak accounting and VAT law requires |
| Fraud-prevention signals (fingerprint hash, device identifiers, keyed IP hash, card fingerprint, hashed normalised email) | 24 months after they were last seen (730 days), including after you delete your account, so that the one-trial rule can't be bypassed by deleting and re-registering |
| Records of actions our staff take on your account (for example reviews, suspensions, credits, and views of your account details) | 3 years, also after your account is deleted |
| Records of weekly summaries and other optional emails sent to you | 400 days |
| Your email opt-outs | While your account exists |
| Email delivery events from our email provider | 30 days |
| Email suppression list (section 7) | As long as the address could otherwise receive emails from us; an unsubscribe entry is removed if you switch emails back on |
| Push subscription | Until you switch push off, the browser revokes it, or you delete your account |
| Record of what you accepted (terms, age confirmation, order and immediate-start declarations, with the wording shown and a keyed IP hash) | Order and immediate-start declarations 10 years with the accounting records; other acceptances 3 years after your account ends (limitation period) |
| Your answer to why you cancelled (reason and optional comment) | Comment deleted after 24 months; the reason is kept without any link to you |
| Your customer record at Stripe | Deleted when you delete your account; invoices and payment records stay at Stripe for the accounting period (10 years) |
| Invoices, payment and accounting records, order, withdrawal and cancellation confirmations | 10 years from the end of the year concerned, as Slovak accounting and VAT law requires |
| Support emails and contact-form messages (name, email address, message) | 24 months after the conversation ends, or longer if needed for a legal claim |
12. Cookies and storage on your device
We use only cookies and storage that are strictly necessary for a service you have asked for, or that store a choice you made. We don't use advertising, analytics or social-media cookies, so you won't see a cookie banner on our website.
| Name | Type | Purpose | Duration |
|---|---|---|---|
av_session | Cookie (first-party, HttpOnly) | Keeps you signed in across arbvantage.net and dash.arbvantage.net | 30 days, renewed while you use it; the session ends after 14 days without activity |
av_did_s | Cookie (first-party, HttpOnly, signed) | Device identifier set at sign-up and login for fraud and trial-abuse prevention (section 5) | Up to 400 days |
av_did | localStorage (first-party) | Random device identifier, stored when you submit sign-up, log in or start a checkout, for fraud and trial-abuse prevention (section 5). If you delete it, it is not restored | Until you delete it |
av_aff | Cookie (first-party), no longer set since 21 October 2026 | Remembered an affiliate link you had opened. Affiliate links now carry the code in the address instead (section 8); a cookie set earlier is removed at sign-up or expires | At most 30 days from when it was set |
av_lang | Cookie (first-party), only if you pick a language or open a link with ?lang= | Remembers your website language | 1 year |
av_calc | localStorage, only after you move the calculator sliders | Remembers your calculator inputs | Until you clear it |
av_ref | Cookie (first-party), only from referral links opened before 20 October 2026; no longer set | Remembered the invite code of the earlier referral programme | 30 days, removed at sign-up |
av_theme | localStorage, only if you pick a theme | Remembers light or dark mode | Until you clear it |
| Dashboard preferences | localStorage and sessionStorage | Remember your sort order, layout, chosen plan and a bet you are in the middle of logging | Until you clear them, or the end of the browser session |
| Cloudflare Turnstile | Challenge run by Cloudflare on sign-up and login | Bot protection on our forms | Session |
| Stripe (Invite friends page only) | Cookies and storage set by Stripe in its embedded components | Identity checks, payouts and fraud prevention by Stripe as an independent controller (stripe.com/cookie-settings) | Set by Stripe |
If you install the dashboard as an app, your browser also keeps a copy of its files so it starts quickly. You can clear cookies and site data in your browser at any time; you will then be signed out.
Campaign measurement without cookies
To see which ads, links and codes bring visitors and customers, our server counts visits to arbvantage.net when a page is requested. Nothing is stored on or read from your device for this (no cookie, no local storage, no pixel). Our legal basis is our legitimate interest in measuring our marketing and spending it sensibly (Art. 6(1)(f) GDPR).
- What we read from each page request: the campaign parameters in the address (utm_source, utm_medium, utm_campaign, utm_term, utm_content and ref; for ad clicks only which platform the click came from and a shortened keyed hash of the click ID, never the ID itself), the domain of the website that linked to us, the landing page, the country derived from the IP address and the device type (phone, tablet or desktop) derived from the browser's user agent. Search engines and other bots are not counted.
- Counting visitors once a day: we compute a daily visitor ID, a keyed hash of the IP address and user agent combined with a random value that changes every day. The IP address itself is not stored. Visitor IDs and the daily random values are deleted after 2 days, so visits on different days can't be linked.
- What we keep: totals per source and day (visitors, page views, landing pages, countries and device types), deleted after 13 months.
- If you create an account: the sign-up form passes on the campaign parameters of the link you came from, and we store the first and the last source of that visit with your account (for example "google / spring" or "direct"), so we can see which campaigns lead to sign-ups, trials and payments. It is kept while your account exists and deleted with it.
A daily cleanup job deletes these records when their time is up. You can object at any time (see your rights below): write to us and we will remove the source stored with your account.
13. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and get a copy (Art. 15). In Settings you can download a full copy of your account data as a JSON file at any time. Fraud-prevention signals and internal risk notes aren't in that file; ask us and we will give you a copy, unless we must withhold a part to protect other people or an open fraud investigation, in which case we tell you why;
- correct inaccurate data (Art. 16);
- erasure (Art. 17). You can delete your account yourself in Settings; we then delete or anonymise your data, except what we must keep by law or for fraud prevention as set out in section 11;
- restrict processing in certain cases (Art. 18);
- data portability: receive the data you gave us in a machine-readable format (Art. 20). Besides the JSON file in Settings, you can export your bets and your transactions as CSV files at any time;
- withdraw consent at any time, for example for push notifications, without affecting what happened before (Art. 7(3));
- be heard: to give your view on, and contest, any decision we take after a fraud or usage check, such as a suspension or a withheld free trial (see section 6). We don't suspend accounts automatically.
Right to object (Art. 21 GDPR). Where we process your data on the basis of legitimate interest (Art. 6(1)(f)), you have the right to object at any time, on grounds relating to your particular situation. We will then stop, unless we can show compelling legitimate grounds that override your interests, or the processing is needed for legal claims. If you object to the fraud checks in section 5, we review your objection: if we stop using those signals for your account, we can't check whether you are eligible for a free trial, so you can still subscribe, but without a free trial; if fraud prevention still requires the processing in your case, we explain why. You can object to the weekly summary at any time, without giving reasons, by switching it off.
To use any of these rights, email support@arbvantage.net from the address on your account. We reply within one month (extendable by two months for complex requests, in which case we tell you why). We may ask you to confirm your identity first. Using your rights is free.
14. Complaints to a supervisory authority
You can complain to a data protection authority, in particular in the country where you live or work, or where you think the problem happened. Our lead supervisory authority is:
- Slovakia: Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.
You can also complain to the authority where you live, for example:
- Austria: Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
- Spain: Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan, 6, 28001 Madrid, aepd.es.
- Germany: the data protection authority of your federal state; the Federal Commissioner (BfDI) lists them at bfdi.bund.de.
We would appreciate the chance to fix a problem first, so please contact us too.
15. Do you have to give us data?
You don't have to, but we need your email address and a password to create an account, and payment details to start a subscription or trial. Without the signals in section 5 we can't check whether you are eligible for a free trial; you can still subscribe without one. Your name, bets, balances and push notifications are optional.
16. Security
We encrypt data in transit with TLS, store passwords only as salted hashes, store session tokens only as hashes, keep only a shortened IP address with each session, store the IP addresses used for comparison only as keyed hashes (HMAC with a secret key; these are pseudonymous, not anonymous), restrict internal access, and use providers with strong security programmes. No system is perfectly secure; if a breach is likely to put you at risk, we will tell you and the supervisory authority as the law requires.
17. Age
ArbVantage is only for adults aged 18 or over. We don't knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
18. Changes to this policy
We update this policy when our processing changes and change the date at the top. If a change is significant, we tell you by email or in the dashboard before it takes effect. Where a change needs your consent, we will ask for it.