Privacy Policy
Last updated 10 November 2026
We collect as little as we need to run your account and subscription. We don't sell your data, don't use advertising or analytics trackers, and don't send marketing email unless you ask for it.
1. Controller
[Company name] OÜ, registry code [registry code], [Street address], [postal code] Tallinn, Estonia, is the controller of your personal data. For anything about privacy, email privacy@usetho.com.
2. What we collect and why
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address and password (stored only as a one-way hash, never readable by us); if you use Google: name, profile picture and Google account ID | Create your account, sign you in, send account emails (confirmation, password reset) and service emails (receipts, renewals, changes to terms) | Contract, Art. 6(1)(b) |
| Subscription details: leagues, status, dates, Stripe customer and subscription IDs | Give you access to the leagues you pay for | Contract, Art. 6(1)(b) |
| Withdrawal records: subscription, start and withdrawal dates, amount paid and refunded, Stripe refund ID | Process your 14-day withdrawal and keep proof of the refund | Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
| Account deletion request: when you asked and the date the account will be deleted | Delete your account automatically when your paid time ends, and let you undo it until then | Contract, Art. 6(1)(b) |
| Billing records: invoices, amounts, country and billing address for tax | Accounting and tax law | Legal obligation, Art. 6(1)(c) |
| Technical data: IP address, browser, request logs, sign-in events | Keep the service secure, prevent abuse and fix errors | Legitimate interest, Art. 6(1)(f) |
| Messages you send us | Answer you and handle requests | Contract or legitimate interest |
Card details are entered directly with Stripe; we never receive or store your full card number. We don't collect special categories of data and don't make decisions about you by automated means that have legal or similarly significant effects. The predictions themselves are about games, not about you.
3. Who processes data for us
We use these service providers (processors) under data-processing agreements:
- Supabase: database and sign-in (stored in the EU region).
- Vercel: website hosting and delivery.
- Stripe: payments, invoices and tax calculation. Stripe is also an independent controller for some payment data, for example fraud prevention, under its own privacy policy.
- Google: only if you choose "Continue with Google", to confirm who you are.
- Zone Media OÜ (Estonia): server that runs the simulations. It holds no customer data.
- Our email delivery provider, for account and service emails.
We may also disclose data to authorities when the law requires it, or to a buyer if the business is transferred, under this policy.
4. Transfers outside the EU/EEA
Some providers, such as Vercel, Stripe and Google, are based in the United States or may access data from there. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses with additional safeguards. Ask us for a copy of the relevant safeguards.
5. How long we keep data
- Account and subscription data: while your account exists. When you delete your account in Account settings, it is removed when your last paid period ends (immediately if you have none), and disappears from backups within 30 days.
- Deletion request: until the account is deleted, or removed at once if you choose "Keep my account".
- Billing and accounting records, including invoices and withdrawal records: 7 years from the end of the financial year, as required by the Estonian Accounting Act. When your account is deleted, withdrawal records are no longer linked to an account.
- Server and security logs: normally up to 30 days, longer only when needed to investigate an incident.
- Support emails: up to 2 years after the matter is closed.
What happens when you delete your account
- Removed: your sign-in (email, and Google name, picture and ID if you used Google), your subscriptions and the link between you and your Stripe customer record.
- Kept, because accounting law requires it: invoices and payment records at Stripe, and our withdrawal records. The Stripe customer record is only marked with the date the account was deleted.
- Your access ends when the account is deleted. If you sign up again later, it is a new account.
6. Your rights
You can ask us to:
- give you a copy of your data (access) or send it to you in a portable format;
- correct inaccurate data;
- delete your data, except what we must keep by law;
- restrict processing, or stop processing based on legitimate interest (object).
You can delete your account yourself at any time in Account → Delete account. For the other requests, email privacy@usetho.com from your account email. We reply within one month. You also have the right to complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee) or to the authority in your own EU country.
7. Cookies
We only use cookies that are strictly necessary to keep you signed in. See the cookie notice.
8. Security
Data is encrypted in transit (HTTPS) and at rest with our providers. Database access is restricted by row-level security so each user can read only their own account data, and administrative keys are kept server-side.
9. Age
Usetho is for adults (18+). We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.
10. Changes
We will post changes here and email you about material ones before they apply.