Legal Policies

1. Information We Collect

• Account Data: When you sign up, we collect your email address and name.
• Usage Data: We store your saved pick combinations, custom model parameter weights, scanned ticket records, and preference configurations.
• Payment Data: Financial details are collected directly by our third-party payment processors (Stripe for web, Google Play for Android) and are never stored on our servers.
• Legal Acknowledgement Records: When you acknowledge our legal policies, we record the timestamp, IP address, browser user agent, policy version acknowledged, and a session identifier for legal compliance and audit purposes.
• Device & Analytics Data: We collect performance metrics and site usage statistics through Vercel Analytics and Google Analytics 4 (G-CVMXBMEN71). Google Analytics operates under Google Consent Mode v2 where Google Signals is disabled, advertising storage (ad_storage) is denied by default, and IP anonymization is enforced.

2. How We Store and Protect Your Data

We store user authentication details and active pick configurations securely within Supabase database clusters utilizing Row-Level Security (RLS) policies and encrypted connections (TLS 1.2+). This ensures that your private saved tickets, account preferences, and personal data cannot be accessed by other users. All user data is hosted on trusted infrastructure providers (Supabase, Vercel) that maintain SOC 2 Type II attestations.

3. Sharing of Information

We do not sell, rent, trade, or distribute your personal details to third parties for marketing purposes. We share data only with essential operational subprocessors required to deliver the Service, including: Supabase (data storage and authentication), Stripe (payment processing), Google Play / RevenueCat (mobile billing), Vercel (hosting and performance monitoring), and Google LLC (Google Analytics 4 for traffic analytics under Google Consent Mode v2).

4. Data Retention

We retain your account data and associated records for the duration of your active account. Legal acknowledgement records are retained for 7 years post-account-closure for compliance and audit purposes. If you request account deletion, your personal data (name, email, saved picks) will be permanently purged within 30 days. Anonymized statistical data may be retained for analytical purposes.

5. Your Rights (CCPA / GDPR)

Regardless of your location, you have the right to: (a) access all personal data we hold about you; (b) request correction of inaccurate data; (c) request deletion of your account and all associated personal data; (d) object to or restrict certain processing of your data; (e) receive a portable copy of your data. California residents may additionally exercise rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what personal information is collected, the right to request deletion of personal information, and the right to non-discrimination. For users in the European Economic Area (EEA) and the UK, our legal bases for processing your data under the GDPR include: (a) contract performance for delivering the core service, user authentication, and subscription management; (b) legitimate interests for system security, fraud prevention, and legal acknowledgement auditing; and (c) consent for optional Google Analytics 4 performance monitoring (which can be granted or withdrawn at any time via the Cookie Preferences footer link). We do not deploy third-party advertising cookies or sell/share personal data for advertising purposes. Data is processed in the United States subject to standard contractual clauses (SCCs) and the EU-U.S. Data Privacy Framework. You have the right to lodge a complaint with your local supervisory authority. To exercise any of these rights, contact us at support@ailottoanalyzer.com or use the account deletion feature in your Profile settings.

6. Children's Privacy

The Service is not directed to individuals under the age of 18 (or 21 in applicable jurisdictions). We do not knowingly collect personal information from minors. If we discover that we have inadvertently collected data from a minor, we will promptly delete such information.