Privacy Policy
Effective date: 24 June 2026 · Last updated: 22 July 2026
This Privacy Policy explains how AiGoalBot (“we”, “us”, “our”), accessible at aigoalbot.com, collects, uses, stores, and protects your personal data. It applies to all users of the Service and complies with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws.
We take your privacy seriously. Our core principle: we collect the minimum data needed to run the Service, we run our own first-party analytics rather than third-party trackers, we do not sell your data, and we do not share it with advertisers.
1. Data Controller
The data controller responsible for your personal data is AiGoalBot, operated at aigoalbot.com. For all privacy-related enquiries, contact us at [email protected].
2. Data We Collect
We collect only the data necessary to provide and improve the Service:
Account Data (from Google OAuth)
When you sign in with Google, we receive from Google and store: your full name, email address, and profile picture URL. We do not receive or store your Google password. This data is provided by Google under their own Privacy Policy.
When you accept our Terms of Service during onboarding, we additionally record, as proof of consent: the time you accepted, the version of the Terms you accepted, and the IP address you accepted from. Unlike the analytics IPs described below, this one is stored in full, un-anonymised form — an anonymised address would not be usable as evidence. We use it only to evidence that you accepted the Terms and confirmed you are over 18; it is not used for analytics, profiling, or tracking.
Usage & Analytics Data
We run our own first-party analytics — we do not use Google Analytics or any third-party analytics service, and your data is stored on our own infrastructure. Each time you load a page, our server records:
- the page path you visited
- the referring URL (only for the first page of a visit)
- your IP address in anonymised form — we drop the last part before storing it (the last octet of an IPv4 address, or the last 80 bits of an IPv6 address), so no full IP is kept in our analytics records (the one exception is the consent record described above, where the full IP is retained as proof that you accepted the Terms)
- your browser's user-agent string (browser and device type)
- a timestamp
- your account ID, if you are signed in
- the campaign attribution parameters carried in the URL you arrive on, if any —
utm_source,utm_mediumandutm_campaign. These tell us which link or campaign brought you here; they are put there by us or by whoever shared the link, and say nothing about you personally - product events recording actions you take on the site — for example starting a sign-in or completing one. For each we store the name of the event and a small amount of associated context, alongside the same fields as above (anonymised IP, user-agent, timestamp, session identifier, and your account ID if you are signed in)
Page views loaded in the same tab are grouped into a single visit using an ephemeral, in-memory session identifier that is generated fresh each time you load the site. It is not stored in a cookie or in your browser's local storage, does not persist across page reloads, and cannot be used to recognise you on a later visit. We use this data to understand how the Service is used, to improve it, and for security and abuse prevention.
The campaign parameters and product events above are, like everything else in this card, first-party — recorded by our own server, stored on our own infrastructure, never shared with an advertising or analytics network — retained for the same 90 days as our other analytics (Section 6), and used only to understand how the Service is used and to prevent abuse. We do not use them to profile you or to target advertising.
Cookies & Local Storage
We use a small number of strictly necessary cookies for sign-in and security (listed in Section 7). Our first-party analytics store no identifier in your browser — no analytics cookie and nothing in local storage. The session identifier used to group your page views exists only in memory for the duration of the page load. We do not use advertising cookies or third-party tracking pixels.
We do not collect: payment information, government IDs, precise geolocation, or any sensitive personal data as defined under GDPR Article 9.
3. How We Use Your Data
We use your personal data exclusively for the following purposes:
- Authentication — to create and manage your account and keep you securely signed in
- Service delivery — to provide access to the live signal board and its per-match history, and other features restricted to registered users
- Analytics & improvement — to understand how the Service is used (which pages are visited, how often, and where visitors arrive from) so we can improve it
- Communication — we do not send you email of any kind. The Service has no newsletter, no digest and no marketing mail, and we do not use your email address to contact you. It is stored only to identify your account. Any change to this would require your explicit prior consent (GDPR Art. 6(1)(a))
- Security & abuse prevention — to detect and prevent fraud, abuse, or violations of our Terms of Service
- Legal compliance — to comply with applicable legal obligations
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you, and we do not build advertising profiles.
4. Legal Basis for Processing (GDPR)
Under the GDPR, we rely on the following legal bases:
- Contract performance (Art. 6(1)(b)) — processing your account data is necessary to provide the Service you signed up for
- Legitimate interests (Art. 6(1)(f)) — processing usage and analytics data is necessary for security and Service improvement, balanced against and not overriding your rights
- Legitimate interests / legal obligation (Art. 6(1)(f) and Art. 6(1)(c)) — recording your Terms acceptance (timestamp, Terms version, and full IP address) is necessary to evidence that you accepted the Terms and confirmed you are over 18, which we must be able to demonstrate because the Service concerns gambling-related content
- Legal obligation (Art. 6(1)(c)) — where we must process data to comply with applicable law
- Consent (Art. 6(1)(a)) — for any optional communications (e.g., marketing emails), where we will always ask first
5. Data Sharing & Third Parties
We do not sell, rent, or trade your personal data. Our analytics are first-party and are not shared with any analytics vendor. We share data only in the following limited circumstances:
- Google (authentication) — sign-in is handled by Google OAuth. Google's collection and use of data during the sign-in flow is governed by Google's Privacy Policy.
- Infrastructure providers — our hosting and deployment providers process data on our behalf under data processing agreements. They are not permitted to use your data for their own purposes.
- Legal requirements — we may disclose data if required to do so by law, court order, or governmental authority, or where necessary to protect the rights, property, or safety of AiGoalBot, its users, or the public.
6. Data Retention
We retain your account data for as long as your account is active or as needed to provide the Service. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required by law to retain it for a longer period.
Your Terms-acceptance record (acceptance timestamp, Terms version, and the IP address you accepted from) is retained for the life of your account and for a limited period thereafter, so that we can still evidence your consent and age confirmation after the account is closed. It is deleted once it is no longer needed for that purpose or required by law, whichever is later.
Usage, analytics, and session logs (including anonymised IP addresses and user-agent strings) are retained for up to 90 days for analytics, security, and abuse-prevention purposes, after which they are deleted.
7. Cookies & Local Storage
We use only the following strictly necessary cookies:
| Cookie | Purpose | Expires |
|---|---|---|
next-auth.session-token | Keeps you signed in (essential) | 30 days |
next-auth.pkce.code_verifier | Security — OAuth PKCE flow (session) | Session |
next-auth.state | Security — OAuth CSRF protection (session) | Session |
Our first-party analytics store nothing in your browser's local storage and set no analytics cookie. The session identifier used to group your page views is generated fresh on each page load and kept only in memory for the lifetime of that page — it is never written to disk and does not persist across reloads.
We do not use advertising cookies, third-party analytics cookies, or tracking pixels. Our analytics are first-party only (see Section 2). If this changes, we will update this Policy and request your consent where required.
8. Your Rights
Under the GDPR and other applicable privacy laws, you have the following rights regarding your personal data:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — request correction of inaccurate or incomplete data
- Right to erasure (“right to be forgotten”) — request deletion of your personal data, subject to legal retention requirements
- Right to restriction — request that we restrict processing of your data in certain circumstances
- Right to data portability — receive your data in a structured, machine-readable format
- Right to object — object to processing based on legitimate interests, including our analytics
- Right to withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior processing
- Right to lodge a complaint — file a complaint with your national data protection authority (e.g., the Hellenic DPA at dpa.gr if you are in Greece, or your local EU supervisory authority)
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days. We may ask you to verify your identity before fulfilling a request.
9. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:
- All data transmitted between your browser and our servers is encrypted via HTTPS/TLS
- Session tokens are stored in HTTP-only, secure cookies inaccessible to JavaScript
- Authentication is delegated to Google OAuth — we never handle your Google password
- We do not store payment card data or banking information
No method of transmission over the internet is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected users without undue delay, as required by GDPR Article 33–34.
10. Children's Privacy
The Service is not directed at children under the age of 18. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us at [email protected] and we will delete it promptly.
11. International Data Transfers
Your data may be processed and stored on servers located outside your country of residence. When data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or we transfer only to countries deemed adequate by the European Commission.
12. Changes to This Policy
We may update this Privacy Policy from time to time. Because we send no email, changes are announced on this page rather than by message: the “Last updated” date at the top reflects the most recent revision, and we encourage you to check it periodically. Continued use of the Service after changes are posted constitutes acceptance of the revised Policy.
13. Contact & Data Protection
For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at: