Effective date: [Effective date]
Who is responsible for your information
[Legal name], [Business address], Iceland, is the controller of the personal information described here. Contact [Privacy email] with any privacy question or request.
What we collect and why
| Information | Why we use it | Legal basis |
|---|---|---|
| Account details: email address, name and profile picture if you sign in with Google or Apple, login and session records | Create your account, log you in and keep it secure | Contract with you |
| Subscription details: plan, status, trial and renewal dates, PayPal subscription reference | Give you the plan you paid for and manage renewals and cancellations | Contract; legal obligation for accounting records |
| Correspondence you send us | Answer questions, handle complaints and privacy requests | Contract; legitimate interest in answering you; legal obligation for statutory requests |
| Technical request data kept by our host and login provider: IP address, time, browser type, errors | Run, secure and troubleshoot the service and prevent abuse | Legitimate interests in a reliable, secure service |
| Your Demo/Live choice and your parlay slip, stored in your browser | Remember settings and picks you asked us to keep | Necessary to provide what you requested |
We don't receive or store your full card number or PayPal password — PayPal handles payment details and tells us only whether the subscription is active, its plan and dates. We don't use analytics or advertising trackers, don't sell your personal information and don't share it for targeted advertising. We don't use your information for profiling or automated decisions about you; RoyaleEdge's predictions are about sporting events, not people using the service.
Information needed for an account or a purchase is marked when we ask for it; without it we can't provide that feature.
Who receives it
| Recipient | What and why | Where |
|---|---|---|
| Clerk, Inc. (login provider) | Account, login and session data, to authenticate you | United States |
| PayPal (Europe) S.à r.l. et Cie, S.C.A. and its affiliates | Subscription and payment data, to take payments | Luxembourg / PayPal group |
| Vercel Inc. (hosting) | Request logs and hosted data, to run the website | United States and its edge network |
We may also share information with professional advisers when needed, with authorities when the law requires it, and with a buyer if the business is transferred, under appropriate safeguards. Our sports-data suppliers (for example BALLDONTLIE and The Odds API) receive requests from our servers only; they don't receive your personal information.
International transfers
Some providers process data outside the EEA, mainly in the United States. We rely on the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions) where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses and equivalent UK and Swiss safeguards. Contact [Privacy email] for details or a copy.
How long we keep it
| Records | How long |
|---|---|
| Account details | While your account exists; removed from our login provider within 30 days of deletion |
| Subscription and billing records | 7 years, as required by Icelandic bookkeeping law |
| Support and complaint correspondence | Up to 3 years after the matter is closed |
| Request and security logs | The short period set by our host and login provider, unless needed to investigate an incident |
| Browser storage (Demo/Live choice, parlay slip) | On your device until you clear it; the Demo/Live cookie expires after a year |
We may keep information longer where the law requires it or for an unresolved dispute, with access limited to that purpose.
Your rights
Depending on the law that applies, you can ask to access, correct, delete or receive a copy of your information, restrict or object to how we use it, and withdraw consent at any time. You can delete your account yourself from Account (open the account menu, then Security), or email [Privacy email]. Cancel any subscription first — deleting the account doesn't stop PayPal payments.
We may ask for reasonable information to confirm it's you, but won't ask for identity documents without good reason. We normally reply within one month (and tell you within that month if we need longer), free of charge. If we refuse a request we'll explain why and how you can complain.
You can complain to Persónuvernd, the Icelandic Data Protection Authority, or to the supervisory authority where you live or work. You don't need to contact us first.
European users
EU/EEA: we're established in Iceland, inside the EEA, so the GDPR applies as described above. You can complain to Persónuvernd or any competent EEA supervisory authority.
United Kingdom: where UK data-protection law applies, you have the equivalent rights and can contact the Information Commissioner's Office.
Switzerland: where the Swiss Federal Act on Data Protection applies, you can exercise your rights under it and contact the Federal Data Protection and Information Commissioner.
US residents
Where a US state privacy law applies, you may have rights to know, access, correct and delete your information, and to opt out of sale, sharing for targeted advertising and profiling. We don't sell or share personal information in those ways or profile you. We won't discriminate against you for using your rights. Send requests or appeals to [Privacy email]; authorised agents can use the same address. We don't respond to Do Not Track signals, but since we use no cross-site tracking there is nothing for them to switch off.
Children, security and changes
RoyaleEdge is for adults. If you think a child has given us personal information, contact [Privacy email] and we'll deal with it.
We protect information with encrypted connections (HTTPS), a specialist login provider, payments handled by PayPal and access limited to those who need it. No service can promise absolute security; we'll handle and report any personal-data breach as the law requires.
When this policy changes we'll update the effective date, and give more notice of significant changes where required.