Updated 1 November 2026.
AUSPEX ANALYTICS LTD operates BetAssist and is responsible for the personal information described in this notice (the data controller). Our company details and registered office are on the Contact page.
For privacy questions or requests, contact contact@betassist.app. This notice describes the website and account service.
The services we use
| Provider | Information handled | Purpose |
|---|---|---|
| OpenAI Sites and Cloudflare | Website requests and technical request information; account email, consent records, encrypted sign-in sessions, membership/payment and fraud-review references, declared billing country and US state, agreed checkout terms and immediate-access requests, essential-email recipient/content and delivery records, and saved selections in the application database. | Host and protect the website, check where paid membership is available, run its server and store application data. Passwords pass through the server to Supabase over encrypted connections; we do not store them in our application database or application logs. |
| Supabase | Email, password verification data, email confirmation/reset records, authenticator factors and authentication activity. The selected authentication project is in Ireland (eu-west-1). | Verify identities, manage passwords, confirm email addresses and provide two-factor authentication. Supabase is the authentication service; the website’s main application database is Cloudflare D1. |
| Stripe | Payment details entered on Stripe’s pages, billing information, payment and subscription activity, and an account reference linking membership to BetAssist. | Checkout, recurring payments, cancellation, invoices, refunds and fraud prevention when paid memberships are available. BetAssist receives payment references and status, not full card details. |
| Amazon Web Services (AWS) | Recipient email addresses and verification/reset message content through SES; membership contract, payment-confirmation and renewal-cancellation content when membership emails are enabled; delivery information; encrypted application backups in S3; service status/error categories for monitoring and operational alerts. | Send essential account emails, provide a copy of the agreed membership contract after payment, confirm stopped renewals, recover the application after failures and alert the team to service problems. These BetAssist AWS resources are in London (eu-west-2). Application backups exclude authentication sessions and provider access/refresh tokens. |
| Microsoft 365 | Support and privacy emails sent to the business, their attachments, and delivery metadata. | Receive and manage incoming business email in our Microsoft 365 mailbox. The subscription is provided through GoDaddy. |
| GoDaddy | Domain registration, DNS and technical service information, plus Microsoft 365 subscription and administration information. | Manage the betassist.app domain and administer our Microsoft 365 email subscription. It is not the website’s account database or payment processor. |
Information you provide
Accounts use an email address, password, adult-age declaration and agreement to the terms. Authenticator setup adds a second factor. Saved selections contain the list name, selected lines and their recorded assessments. Do not put sensitive personal information into list names. This website has no customer file-upload feature.
If you email support, your message and attachments also pass through your email provider. Our incoming business email is delivered to our Microsoft 365 mailbox, provided through GoDaddy.
Why we process it
Account, membership and saved-selection processing is needed to provide the service you request. Abuse prevention, essential monitoring and recovery support the legitimate interest of running a secure service. Financial records may be needed for accounting, disputes and applicable legal obligations. We do not currently use customer data for advertising, sell it, or provide it to a betting operator. Optional marketing would require a separate choice and an updated notice.
Cookies, local drafts and cached screens
An essential HttpOnly cookie holds a random session identifier. Provider tokens remain encrypted on the server and are not stored in browser local storage. Sessions expire after 30 days at most, or seven days without activity. Temporary recovery and authenticator setup sessions last ten minutes.
The browser can remember board filters in the current tab and store queued selection IDs, list names and assessment fingerprints on this device. Drafts expire after seven days and are cleared when the site next reads them. These drafts are tied to the signed-in account and are sent only after connection and access checks succeed. Signing out, resetting your password or deleting your account clears BetAssist’s local drafts. Other people using the same unlocked browser may be able to inspect device storage. Payment and account-security actions are not queued offline.
Previously displayed rows may remain on screen while an update loads or the connection is unavailable. Their original check times remain visible. The site does not present cached information as a new price check, and does not store a full paid board for offline browsing.
Cancellation and account deletion
Use Cancel renewal in My account to stop auto-renewal while retaining access through the paid period. No form or cancellation reason is needed. We record the confirmed cancellation and prepare a confirmation for your account email. Use Delete my account to end the subscription immediately, delete the Supabase sign-in, revoke website sessions, and remove the application profile and saved selections. Deletion requires password and authenticator confirmation. It does not automatically issue a refund or remove records we must keep for an existing dispute or legal obligation.
Some payment, agreed-contract and consent records, including the recipient email, may remain after account deletion where needed for accounting, disputes or legal obligations. Cancellation and email-delivery review records may also remain; a held or uncertain email can still contain its recipient and content. We retain a deletion receipt to prevent old processing or restored data from reopening the account. Successful email-submission confirmation clears the duplicate recipient and content from the sending queue; it does not erase the underlying agreed contract.
How long we keep records
Accounting and payment records, including the evidence needed to support those transactions, are kept for six years from the end of the company financial year to which they relate.
Routine support messages and their attachments are kept for 12 months after the case closes. We retain information longer only where there is a documented legal need, such as an ongoing dispute or applicable legal obligation.
Encrypted backups are for recovery and expire under the storage lifecycle; current archives expire after 35 days, with noncurrent versions retained for a further 35 days. Deleted account access must not be restored with a backup. Providers may separately retain records they need to meet their own legal obligations.
Security and international processing
Controls include verified email, required two-factor sign-in, access checks, request limits, encryption, secure cookies and payment-notification signature checks. Request logging is limited to operational identifiers and error categories rather than passwords, message bodies or authentication tokens.
The selected regions above do not mean every provider operation stays in those countries. Global delivery networks, support and subprocessors may handle information elsewhere.
The providers’ applicable data-processing terms govern this processing. International-transfer safeguards can include standard contractual clauses and UK addenda where required. Contact us for information about the safeguards relevant to your data.
Your choices and rights
You can ask for access, correction, erasure, restriction, portability, or object to processing where applicable. Contact us using the address above; we may need to verify your identity, and legal exceptions can affect a request. You can also raise a concern with your applicable data protection authority. A parent or guardian concerned about an under-18 account should contact support.
Provider information: OpenAI, Cloudflare, Supabase, Stripe, AWS, Microsoft, and GoDaddy.