Privacy Policy

This Policy explains how Predz processes personal data under the GDPR and Portuguese Law No. 58/2019.

Controller: the Predz operator. Contact: suporte@predz.app.

1. Data we collect

• Account: email, display name, avatar (if you use Google OAuth or upload one), user ID.
• Usage: tournaments you join, predictions, special bets, roles (member/admin), preferences (e.g. theme, language).
• Technical: session and auth data (via Supabase Auth), security logs, and, if you accept, aggregated usage metrics (Vercel Analytics / Speed Insights).
• Communications: transactional emails (account confirmation, password reset) and messages you send to suporte@.

We do not collect payment data. Predz does not process money.

2. Purposes and legal bases

• Service delivery (contract): account, tournaments, scoring and rankings.
• Legitimate interest: security, abuse prevention, product improvement, aggregated stats needed to run the service.
• Consent: non-essential analytics (Vercel), when you accept via the cookie banner.
• Legal obligation: responding to authorities when required by law.

3. Minors

Predz is entertainment with no platform-managed payments or prizes. Minimum account age is 13. If you are 13 to 16, parental guidance is recommended. We do not target children under 13.

4. Cookies

• Essential: session, authentication, theme, language and technical preferences required for the service.
• Optional: if you choose «Accept all» in the banner, we enable Vercel Analytics and Speed Insights (aggregated usage and performance metrics) to improve the product. You can choose «Essential only» and still use Predz without those analytics.

5. Processors

We use providers that process data on our behalf, including:

• Supabase: auth and database (EU / EEA preferred);
• Vercel: frontend hosting and, with consent, analytics;
• Resend: sending and receiving email (Auth SMTP and support);
• Google: if you choose Google sign-in (OAuth).

We also use API-Football / API-Sports (and, where applicable, other sports data sources) for fixtures, results, squads and stats. Those providers typically do not receive your account personal data. Sync jobs (e.g. GitHub Actions) run on our side with API keys and do not send your email or profile to those data services.

6. Retention

We keep data while your account is active and as needed to run the service. You may request account deletion. Some records may be retained for a limited time for legal or security reasons (e.g. abuse logs).

7. Your GDPR rights

You may request access, rectification, erasure, restriction, objection, portability and withdrawal of consent where applicable. Contact: suporte@predz.app. You may also complain to the CNPD (www.cnpd.pt).

8. Security

We apply reasonable technical and organisational measures (access control, RLS, HTTPS). Report vulnerabilities to the contact above.

9. International transfers

We prefer processing in the EEA. If a processor handles data outside the EEA, we require appropriate safeguards (e.g. standard contractual clauses).