Privacy policy

The short version

We collect the data needed to run and secure your account, provide the research you request, process purchases, and store the bets and preferences you choose to record. We use it to run BAI8 and to improve it. We do not sell your personal data, share it with bookmakers or advertisers, or use it for anything else.

The only other companies that process it are the infrastructure partners listed below, each for the one job BAI8 needs it to do.

Who is responsible

SAS CORP, 47 rue Vivienne, 75002 Paris, France, is the data controller for the personal data processed through BAI8. You can reach us about your data at [email protected].

What we collect

The data we process falls into these categories:

• Identity and security: your email address, name, profile picture, password hash where you use a password, sessions, security events, and two-factor authentication state. We never receive a password from an external identity provider.
• What you submit and record: bets, outcomes, saved searches, settings, notification choices, research requests, conversations, and slip images or text you deliberately upload.
• Billing and allowance: Stripe customer and subscription identifiers, plan, invoices, payment status, purchases, research credits and the records needed to apply them. We never receive your full card number.
• Technical: pages requested, approximate location derived from an IP address, browser type, device and session information, and error or security logs. We use this to operate and protect the service.

What we never collect

Payment card details are handled by Stripe and do not pass through BAI8. We do not receive bookmaker credentials or connect to your bookmaker account, balance or betting activity. We only know what you deliberately submit.

Why we process it, and on what basis

We process data to provide the service and bill you, which is performance of our contract with you. We process data to keep the service secure and improve it, which is our legitimate interest. We also process records needed to meet accounting, tax and other legal obligations.

We may use aggregated, de-identified information about product use to improve BAI8. We do not share it in a form intended to identify you.

Who else processes it

We use service providers for specific operational jobs:

• Google: optional identity-provider sign-in.
• Stripe: checkout, payments, invoices, tax and subscription state.
• OVHcloud and Cloudflare: application hosting, database, network and object-storage infrastructure.
• Resend: delivery of transactional and account email.
• Sports-data providers, including The Odds API: fixture, odds and result data. We send market or event queries, not your account identity.
• OpenRouter and the model providers it routes to: the fixture and research inputs needed for an assessment or conversation you start, and the slip images you upload to be read. We do not include your account identity unless it appears in what you submit.

How long we keep it

Your account data is kept while the account is active. A deletion request has a 14-day safety period and, if a cancelled paid subscription remains active for longer, completes after that paid period. When deletion completes, we remove account content from the active service except transaction, security, fraud-prevention or accounting records that law requires or permits us to retain. Those records are deleted when the applicable retention period ends.

Your rights

If the GDPR or UK GDPR applies to you, you can ask for a copy of your data, correct it, delete it, restrict or object to processing, or take it elsewhere in a portable format. The account page provides a full JSON export, separate bet-ledger CSV exports, and a deletion control.

You can also complain to your data protection authority. We would rather you told us first: [email protected]

Security and transfers

Data is encrypted in transit, between your browser and BAI8 and between BAI8 and its providers. Passwords are stored as one-way hashes, two-factor secrets are encrypted, and sessions use secure, http-only cookies. Sessions can be reviewed and revoked from the account page. Access to servers and data is restricted to the people who need it.

The application and our primary database are hosted in Canada by OVHcloud. Stripe, Resend, Cloudflare, Google and OpenRouter may process data in the United States or elsewhere, under standard contractual clauses or equivalent safeguards set out in their data-processing agreements.

Cookies and email

BAI8 uses only the cookies needed to keep you signed in and secure, and a stored choice of theme and language. It uses no advertising or analytics trackers.

If you subscribe to the newsletter, your email address is used only to send it, and every issue has an unsubscribe link.

Children

BAI8 is not for anyone under 18, and we do not knowingly collect data from anyone under that age. If you believe a minor has an account, tell us and we will remove it.