1. Scope
This notice explains how BetGames handles personal data for UK players, in the language of the UK GDPR and the Data Protection Act 2018. It is a working draft. [COUNSEL: confirm final wording with a qualified data protection adviser before launch]
2. Data we collect
- Account data: email address, username and password hash.
- Gameplay event logs: the timestamped inputs of a competitive run, including tap coordinates and timings. This is not incidental telemetry — it is the evidence a result is verified against, and the basis of anti-cheat review.
- Device and session metadata: device type, browser, operating system and app version.
- IP-derived region: used to confirm you are playing from a supported location. We do not store precise geolocation.
3. Why we collect it
- To create and secure your account, and to authenticate you.
- To verify competitive results and detect cheating or abuse.
- To run leaderboards, matchmaking and dispute review.
- To confirm you are eligible to play from a supported location.
- To meet legal and regulatory obligations.
4. Lawful basis
We rely on contract (to provide the service you sign up for), legitimate interests (fair play verification, anti-cheat and platform security) and legal obligation, as applicable to each processing activity. [COUNSEL: confirm and document the lawful basis for each processing purpose in a full Article 30 record]
5. Retention
Account data is kept for as long as your account is active. Gameplay event logs are kept for a defined verification and dispute window after a competition settles, then deleted or aggregated, unless a longer period is needed to resolve an open dispute or investigation. [COUNSEL: set exact retention periods per data category and record them in a retention schedule]
6. Who processes your data
We use Supabase to host our database, authentication and backend infrastructure. Supabase processes data on our behalf under its own data processing terms. [COUNSEL: list all processors and sub-processors, with locations and transfer mechanisms, before launch]
7. Your rights
You can ask to access, export or delete your personal data. We will honour deletion requests for account data promptly. Where an event log is still needed to resolve a live dispute or investigation, we may retain the minimum necessary record until that need ends, and will explain why. [COUNSEL: confirm the identity-verification steps for rights requests]
8. No sale of data, no unsolicited marketing
We do not sell personal data. We do not send marketing communications unless you have opted in, and you can withdraw that consent at any time.
9. Cookies
See our cookie notice for the small number of strictly necessary cookies we use.
10. Contact
Questions about this notice, or requests about your data, can be sent to [COUNSEL: DPO / privacy contact name and email address]. You also have the right to complain to the Information Commissioner's Office (ICO).