Preliminary version under legal review. Details in brackets will be completed before the commercial launch. The Spanish version prevails.
EdgeFinder Sports Privacy Policy
Version: 1.0 (draft) · Effective from: [PUBLICATION DATE] · Last updated: [DATE]
This policy explains what personal data we process when you use EdgeFinder Sports (app.edgefindersports.app, in Spanish and English), why, on what legal basis, who we share it with, how long we keep it and how to exercise your rights. It complies with Ecuador's Organic Personal Data Protection Law (LOPDP), its Regulation and the rules of the Superintendency of Personal Data Protection (SPDP).
1. Data controller
| Controller | [COMPANY NAME] ("EdgeFinder", "we") |
| Taxpayer ID (RUC) | [RUC] |
| Registered address | [REGISTERED ADDRESS], Ecuador |
| Phone | [PHONE] |
| Privacy email | hola@edgefindersports.app |
| Data protection officer (DPO) | [DPO NAME], [ADDRESS], [PHONE], [DPO EMAIL] |
2. Summary
- We collect only what we need to provide the Service: your email and password for the account, your billing data if you pay, and some technical data for security.
- We do not sell your data or share it with sportsbooks.
- Today we use no analytics or advertising cookies, our own or third-party.
- Some providers that help us run the Service (hosting, database, AI, payments, email) are in the United States or other countries. We tell you which ones and what safeguards apply.
- You can download your data, correct it or delete your account under "My account > Privacy", and write to us to exercise any other right. We reply within 15 days at most.
3. What data we process, why, and on what legal basis
| Purpose | Data | Legal basis (art. 7 LOPDP) | Is providing it mandatory? |
|---|---|---|---|
| Create and manage your account, sign you in and provide the plan you chose (including saved searches, alerts and preferences) | Email address, password (stored only as an encrypted hash), date of birth (to check you are 18+), country, language, plan, sign-up date | Performance of contract (7.5) | Yes. Without it we cannot create the account |
| Age verification and exclusion of minors | Date of birth and declaration of legal age | Performance of contract (7.5) and legitimate interest in protecting minors (7.8) | Yes |
| Charge the subscription and issue electronic invoices | ID type and number (cédula, RUC or passport), full name or company name, address, invoicing email, phone (optional), plan, amount, dates, payment status, payment-method ID or token (full card data is handled by the payment provider, not by us) | Legal tax obligation (7.2) and performance of contract (7.5) | Yes, to pay. Purchases under USD 50 may be invoiced to "final consumer" |
| Contract notices: confirmations, renewal reminders 15 days in advance, changes to terms, security | Email, plan, dates | Performance of contract (7.5) and legal obligation (7.2) | Yes |
| Security and abuse prevention: CAPTCHA, rate limits, fraud detection, technical logs | IP address, user agent (browser and OS), access date and time, CAPTCHA technical signals, sign-in attempts | Legitimate interest in protecting the Service and users (7.8) | Yes, they are technical and necessary |
| Preventing free-trial abuse (one trial per person) | Verified email, CAPTCHA result, IP and a technical device identifier (device fingerprint) stored in pseudonymised form (hash) | Legitimate interest in preventing fraud (7.8) | Only if you request the free trial |
| AI assistant (EdgeFinder AI) | The text of your questions, the language, the page you ask from and your plan's credit usage. We do not send your email or name | Performance of contract: it is a service you request (7.5) | No: the assistant is optional |
| WhatsApp expiry reminders for prepaid passes | Phone number | Consent (7.1) | No. Without it we remind you by email only |
| Bet tracking (if you use it) | Match, market, selection, odds, stake, sportsbook, result, notes | Performance of contract (7.5) | No: it is optional and you can delete each record |
| Responsible gambling: self-exclusion from site sections | Self-exclusion status and dates | Performance of contract (7.5) and legitimate interest (7.8) | No |
| Handling enquiries, complaints and rights requests | Data you send us and the correspondence | Performance of contract (7.5) and legal obligation (7.2) | Needed to help you |
| Marketing communications: news, analysis and offers by email (and, if you accept, WhatsApp) | Email, phone (if given), preferences, email opens (if enabled) | Consent (7.1), given separately and without pre-ticked boxes | No. You can withdraw it at any time without affecting the Service |
| Improving the Service using aggregated usage statistics | Aggregated or pseudonymised usage data | Legitimate interest (7.8) | — |
| Legal compliance and defence of claims | Data needed in each case | Legal obligation (7.2) and court or authority order (7.3) | — |
Data sources: we collect all data directly from you or from your use of the Service. Payment providers confirm the result of each charge. We do not buy data from third parties.
Sensitive data: we do not ask for sensitive data (health, ethnic origin, political opinions, biometrics, etc.). Please do not enter it in the assistant or in notes.
Consequences of not providing data, or providing wrong data: without the mandatory data we cannot create your account, charge or invoice you. If your billing data is wrong, the invoice may be issued incorrectly and you will need to request a correction. Giving a false date of birth to get around the minimum age breaches the Terms, and we may close your account.
4. Automated decisions, profiling and artificial intelligence
- Statistical models: our models calculate probabilities of sporting events; they do not evaluate people. We make no automated decisions about you that produce legal effects or significantly affect you.
- EdgeFinder AI: when you use the assistant, your message is sent to our AI provider, Anthropic, PBC (United States), which processes it to generate the answer using tools that query our statistical engine. Under its commercial API terms, the provider does not use that data to train its models and keeps it for a limited time for safety and abuse monitoring. EdgeFinder does not store conversation history on its servers. At the start of each conversation we tell you that you are talking to an AI.
- Profiling: we do not build advertising profiles. If we personalise recommendations based on your usage in the future, we will tell you and you will be able to object (art. 16 LOPDP).
5. Who we share your data with
We do not sell or rent your personal data, and we do not share it with sportsbooks or sports betting operators.
5.1 Processors (providers acting on our behalf)
They process data only on our instructions and under contract (art. 34 LOPDP), with confidentiality, security and incident-notification obligations.
| Provider | Service | Data | Location |
|---|---|---|---|
| Vercel Inc. | Web hosting, server functions, scheduled jobs, technical logs | All data passing through the site, technical logs with IP | United States and global network |
| Neon Inc. [or the chosen database provider] | PostgreSQL database | Account, subscription, billing, bet-tracking and consent data | [CHOSEN REGION, e.g., US / Brazil] |
| Anthropic, PBC | Language model for the AI assistant | Text of questions to the assistant and match statistics | United States |
| Kushki [confirm legal name] | Card payments and recurring subscriptions | Card token, amount, customer ID, email | Ecuador [confirm where data is hosted] |
| Payphone [confirm legal name] | One-off payments (prepaid passes and one-off annual plans) | Payment data, amount, email or phone | Ecuador [confirm] |
| Dátil [confirm legal name] | Issuing electronic invoices and credit notes and sending them to the SRI | Billing data | Ecuador [confirm] |
| [EMAIL PROVIDER] | Sending transactional and, if you accept, marketing emails | Email address, message content | [COUNTRY] |
| [WHATSAPP BUSINESS PROVIDER] (only if you accept WhatsApp reminders) | Sending reminders | Phone number, message content | [COUNTRY] |
5.2 Other recipients
- Servicio de Rentas Internas (SRI): receives your electronic tax documents as required by law.
- Authorities (administrative or judicial), where the law or an order requires it.
- Advisers (accountants, lawyers, auditors) bound by confidentiality.
- A buyer or successor of the business in a merger or sale, with prior notice and in line with this policy.
5.3 Third-party content on the site
Crest images load from ESPN's image server (a.espncdn.com, United States), which receives your IP address and browser type when showing them. We do not send it the page you are viewing. Details in the Cookie Policy.
6. International transfers
Some of the providers above are in the United States or other countries that, to date, the SPDP has not declared to offer an adequate level of protection. To protect your data:
- we sign with each provider a binding legal instrument (a data processing agreement with contractual protection clauses) that guarantees a standard equal to or higher than the LOPDP, with complaint and redress mechanisms (art. 57 LOPDP and Resolution SPDP-SPD-2026-0004-R);
- these transfers are necessary to perform the contract you enter into with us (hosting the site and your account, processing your payments, answering your questions to the assistant) (art. 60.4 LOPDP);
- we will record these transfers in the National Personal Data Protection Registry once the SPDP enables it.
A risk you should know about: authorities in those countries may have data-access powers that differ from Ecuador's. You can ask for a copy of the applicable safeguards by writing to hola@edgefindersports.app.
7. How long we keep your data
| Data | Period |
|---|---|
| Account (email, preferences, saved searches, bet records) | While the account is active. If you delete it, data is erased within 30 days. Free accounts inactive for [24] months are deleted after 30 days' notice |
| Billing data and electronic tax documents | The period required by tax and accounting law ([7] years), even if you delete your account |
| Subscription and payment history | For the duration of the relationship and then the limitation period for consumer and tax claims |
| Records of consent and its withdrawal | For the duration of the processing plus [5] years, as evidence |
| Technical and security logs (IP, access) | [90] days, unless needed to investigate an incident |
| Device-fingerprint hash and record of the free trial used | [12] months from the trial |
| Rate-limit data for the assistant and the API | In memory, for minutes (1 to 10-minute windows) |
| Assistant conversations | Not stored on our servers. The AI provider keeps them according to its contract [verify] |
| Marketing emails | Until you withdraw consent |
| Rights requests and complaints | [5] years after closure |
When the period ends, we delete the data or irreversibly anonymise it.
8. Your rights
As a data subject you have the right to (arts. 12 to 20 LOPDP):
- Information: know how we process your data (this policy).
- Access: obtain, free of charge, a copy of your data and the information in this policy.
- Rectification and updating of inaccurate or incomplete data.
- Erasure of your data when it is no longer needed, you withdraw consent or the processing is unlawful, unless we must keep it by law (e.g., invoices).
- Objection to processing based on legitimate interest and, at any time, to direct marketing and profiling.
- Portability: receive your data in a structured, machine-readable format (JSON), or have it sent to another controller where technically feasible.
- Restriction of processing while a challenge is verified, among other cases.
- Not to be subject to decisions based solely on automated assessments that legally affect you (we do not make such decisions).
- Withdraw your consent at any time, without retroactive effect and as easily as you gave it.
How to exercise them:
- In your account: "My account > Privacy" lets you download your data, edit your information, withdraw marketing consent and delete your account.
- By email: write to hola@edgefindersports.app (or to the DPO at [DPO EMAIL]) from your account email, stating the right you want to exercise. If you write from another address or through a representative, we may ask you to prove your identity or the representation.
- Deadline: we reply within 15 days at most. It is free.
- Complaint to the authority: if you are not satisfied with our reply, you can file a complaint with the Superintendencia de Protección de Datos Personales (https://spdp.gob.ec).
9. Security
We apply technical and organisational measures proportionate to the risk (art. 37 LOPDP), including: encrypted connections (HTTPS with HSTS), strict security headers, passwords stored with strong hashing algorithms, HttpOnly and Secure session cookies, our own proof-of-work CAPTCHA, with no cookies or third parties, and sign-in attempt limits, restricted and logged database access, encryption at rest at our infrastructure providers, backups, periodic review of measures and confidentiality agreements with anyone who accesses the data.
Incidents: if a security breach affects your data, we will notify the SPDP (and any other authority the law requires) within a term of 5 days at most and, if it poses a risk to your rights, inform you within a term of 3 days of becoming aware of it, explaining what happened, its likely consequences, the measures taken and recommendations (arts. 43 and 46 LOPDP; Resolution SPDP-SPD-2026-0040-R).
10. Minors
EdgeFinder is only for people aged 18 or over because it concerns information related to sports betting. We do not knowingly collect data from minors. If someone signing up gives a date of birth showing they are under 18, we do not create the account. If we discover that a minor has given us data, we delete the account and the data. If you are a parent or guardian and believe a minor has given us data, write to hola@edgefindersports.app.
11. Cookies and local storage
Today we only use cookies and storage that are necessary, or preferences you choose: account session and security, language (ef-lang), light or dark theme and saved scanner searches (the last two in your browser's local storage). We use no analytics or advertising cookies. You can review this under "Cookie preferences" in every page footer; details are in the Cookie Policy. If we ever add optional cookies, we will ask you first.
12. Changes to this policy
If we change this policy, we will publish the new version with its date. If the change is material (new purposes, recipients or transfers), we will notify you by email or on the site before it applies and, where the law requires, ask for fresh consent. We keep previous versions, which you can request.
13. Contact
[COMPANY NAME] · [REGISTERED ADDRESS] · [PHONE] · hola@edgefindersports.app