Privacy policy
Last updated: 19 October 2026
Contents
1. Who is responsible for your data
The controller of your personal data is [COMPANY NAME], registered in [JURISDICTION] under company number [COMPANY NUMBER], at [REGISTERED ADDRESS] ("we", "us"). For anything privacy-related, email support@arbvantage.net.
2. The short version
- We collect what we need to run your account, bill you, send you service emails and stop people abusing the free trial.
- We don't sell your data, and we don't use advertising or third-party tracking cookies.
- Card details go straight to Stripe. We never see or store your full card number.
- You can ask for a copy of your data, and you can delete your account yourself at any time.
3. Data we collect
| Category | What it includes |
|---|---|
| Account data | Email address, name (optional), password hash, email verification status, account settings (your bookmakers, sports, filters, stake and rounding preferences) and onboarding progress. |
| Billing data | Subscription plan and status, invoices, billing country and a Stripe customer ID. Stripe also gives us a card fingerprint: a code that identifies the same card across accounts without revealing its number, which we use to prevent repeat trials. We do not receive or store full card numbers or security codes. |
| Usage data | Events in the dashboard, such as sign-ins, which opportunities you open, bets you log in the tracker, and settings changes. |
| Device and network data | IP address and browser user agent recorded with each login session; a hashed (one-way encoded) copy of your IP address; approximate country and network provider derived from your IP; a browser fingerprint hash built from technical characteristics of your browser and device; and a random device identifier stored on your device (see cookies and storage). |
| Communications | Emails you send us and records of service emails we send you (for example, delivery status). |
We collect most of this directly from you or your browser. Billing data comes from Stripe. We don't buy data about you from anyone.
4. Why we use it, and our legal basis
| Purpose | Legal basis (GDPR / UK GDPR) |
|---|---|
| Creating and running your account, showing your feed and tracker, customer support | Performance of our contract with you |
| Billing, subscriptions and invoices | Contract; legal obligation (tax and accounting records) |
| Service emails: verification, trial and billing notices, weekly summary | Contract; legitimate interest for the weekly summary (you can turn it off in settings) |
| Preventing fraud, multiple accounts and repeat free trials; protecting the service from bots and attacks | Legitimate interest |
| Understanding how the product is used so we can improve it | Legitimate interest, using our own first-party records only |
| Complying with law and responding to lawful requests | Legal obligation |
Where we rely on legitimate interest, we have weighed our interest against your rights and kept the data to what is necessary. You can object at any time (see your rights).
5. Fraud and trial-abuse prevention
The free trial is offered once per person, household, device and payment method. To enforce that, and to keep out bots and automated sign-ups, we use the following signals on the basis of our legitimate interest in preventing fraud:
- a browser fingerprint hash, calculated from technical properties of your browser and device (such as screen, timezone, language and rendering characteristics) and stored only as a hash;
- a random device identifier stored in your browser's localStorage, IndexedDB and a first-party cookie;
- your IP address, kept for linking as a hashed IP address, together with approximate country and network type (for example, whether it belongs to a VPN or hosting provider);
- the card fingerprint provided by Stripe;
- a normalised form of your email address (for example, ignoring dots and "+" tags) and checks against lists of disposable email providers.
These signals are compared with other accounts only to decide whether a trial or account looks like a duplicate. The result may be that a trial is not offered, but a person reviews any decision to close an account. We never use these signals for advertising or share them with anyone except our processors.
Cloudflare Turnstile checks sign-up and login forms for bots. It processes technical information about your browser on Cloudflare's behalf and our own; see Cloudflare's privacy policy.
6. Who we share it with
We use a small number of service providers who process data on our behalf under data-processing agreements:
- Cloudflare: hosting, database, content delivery, security and Turnstile bot protection.
- Stripe: payments, subscriptions and invoicing. Stripe is also an independent controller for some data it needs to meet its own legal obligations, for example anti-money-laundering checks.
- Resend: sending account and service emails.
We may also disclose data where required by law, to protect our rights or users, or to a buyer or successor if our business is sold or reorganised (in which case this policy continues to apply). We do not sell or rent personal data.
7. International transfers
Our providers may process data outside the European Economic Area and the UK, including in the United States. Where they do, we rely on adequacy decisions (such as the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses and the UK addendum, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
8. How long we keep it
| Data | Retention |
|---|---|
| Account, settings and bet tracker data | While your account is open; deleted within 30 days after you delete your account |
| Usage events | Up to 24 months, then deleted or anonymised |
| Login sessions (including IP address and user agent) | Until the session expires (at most 30 days), then deleted |
| Fraud-prevention signals (fingerprint hash, device identifier, hashed IP, card fingerprint, normalised email) | Up to 24 months after your account is closed, so that one-trial-per-person can be enforced |
| Billing records and invoices | As long as tax and accounting law requires, usually 6 to 10 years |
| Support emails | Up to 24 months after the conversation ends |
9. Cookies and local storage
We use only strictly necessary cookies and storage. We don't use advertising, analytics or social-media tracking cookies, so we don't show a cookie banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
av_session | Cookie (first-party, HttpOnly) | Keeps you signed in across arbvantage.net and dash.arbvantage.net | 30 days |
av_did | Cookie, localStorage and IndexedDB (first-party) | Random device identifier used for fraud and trial-abuse prevention | 2 years |
| Cloudflare security cookies | Cookie (set by Cloudflare) | Bot protection and security on forms (Turnstile) | Session or short-lived |
You can clear cookies and site data in your browser at any time. If you do, you will be signed out.
10. Your rights
Depending on where you live, and in all cases if the GDPR or UK GDPR applies, you have the right to:
- access the personal data we hold about you and get a copy;
- correct inaccurate data;
- delete your data. You can delete your account yourself in the dashboard under Settings; we will delete or anonymise your data except what we must keep by law or for fraud prevention as described above;
- restrict how we use your data in certain cases;
- data portability: receive the data you gave us in a machine-readable format;
- object to processing based on legitimate interest, including fraud-prevention processing. If you object to fraud checks, we may not be able to offer you a free trial;
- not be subject to a decision based solely on automated processing that significantly affects you;
- complain to a data protection authority, such as the authority where you live or work.
To exercise any of these rights, email support@arbvantage.net from the address on your account. We will reply within one month. We may need to verify your identity first.
11. Security
We encrypt data in transit with TLS, store passwords only as salted hashes, hash session tokens and IP addresses used for linking, restrict internal access, and rely on providers with strong security programmes. No system is perfectly secure; if a breach affects you, we will tell you and the relevant authority as the law requires.
12. Age
ArbVantage is only for adults aged 18 or over. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
13. Changes to this policy
We will update this page when our practices change and change the date at the top. If a change is significant, we will tell you by email or in the dashboard before it takes effect.
14. Contact
Email support@arbvantage.net, or write to [COMPANY NAME], [REGISTERED ADDRESS].