Privacy policy

1. Data Controller

The data controller for this processing is Keystep Technologies LLC, 1309 Coffeen Avenue STE 1200, Sheridan, WY 82801, USA, which operates the BetSynq service.

Contact for data protection matters: info@betsynq.com

2. What Data We Process

• Account details: name, email address, password (stored as a cryptographic hash — we can never read it).
• Membership: chosen tier, start and end dates, trial period, payment status.
• Payment details: handled entirely by Stripe. We never store card numbers — only a Stripe customer ID and the payment status.
• Content you create: forum posts, support tickets, your own notes in Bet Tracker.
• Technical data: IP address, browser type, and timestamps in security and server logs.
• Age verification: timestamp confirming you've certified that you're 18 or older.
• Usage statistics: aggregated and anonymous visitor analytics without cookies.
• Marketing measurement: which ad or link led you here, along with your IP address and browser type at registration or purchase. The data is used to measure which ads work.

3. Purpose and Legal Basis

4. Data Processors

We never sell your data. To run the service, we use the following providers, all bound by data processing agreements:

• Supabase — database and login. Data is stored within the EU.
• Netlify — web hosting and server functions. USA.
• Stripe — payments. Stripe is an independent data controller for payment data. USA/Ireland.
• Resend — sending emails. USA.
• Plausible Analytics — visitor analytics without cookies. EU.
• Trustpilot — invitation to leave a review after purchase. EU.
• Rinkel — our business telephone. If you call us and we do not answer, a support ticket is created with your telephone number and the time, so that we can call you back. The number is removed when the ticket is closed. EU.
• Meta Platforms — measurement of which adverts lead to registration or purchase. Reporting takes place from our server, not from your browser, and we set no advertising cookies on your device. We send your email address in hashed form (SHA-256), never in plain text, together with your IP address, your browser’s user agent and a session-bound ID. The IP address is needed for Meta to determine whether the report belongs to the right advert impression. Meta is an independent controller for the data provided to it. USA.

If you don't want your purchase or registration reported to Meta — email info@betsynq.com, we exclude you from the measurement.

5. Transfers to Third Countries

Some of the providers above process data in the USA. Such transfers rely on the European Commission's Standard Contractual Clauses (SCCs) and, where the provider is certified, the EU–U.S. Data Privacy Framework. The providers also apply encryption both in transit and at rest.

If you'd like details of the safeguards that apply to a specific transfer, contact us and we'll send the documentation.

6. How Long We Retain Data

• Account and membership: as long as the account is active, then 12 months before deletion.
• Records of completed purchases: seven years, as required by the Swedish Bookkeeping Act. We cannot shorten this period, even on request.
• Support tickets: 24 months.
• Security logs: 90 days.
• Age verification: for as long as the account exists.
• Newsletter: until you unsubscribe.

7. Your Rights

Under the General Data Protection Regulation (GDPR), you have the right to:

• Access the data we process about you (a data extract).
• Have incorrect data corrected.
• Have your data deleted — ”the right to be forgotten”.
• Restrict the processing of your data.
• Object to processing based on legitimate interest.
• Receive your data in a machine-readable format (data portability).
• Withdraw consent you've given, without affecting processing that has already taken place.

You can also contact info@betsynq.com. We respond within 30 days.

8. Cookies and browser storage

We set no cookies. Not for login, visitor analytics or adverts.

However, we do store some information in your browser, in local storage and session storage. These are areas that only this website can read and which are not automatically sent with your requests. The rules on storing information on your device apply whether it is called a cookie or not, so we account for everything we store:

• Login session (sb-…-auth-token) — keeps you logged in. Without it, login does not work. Kept until you log out.
• Your tier (betsynq_tier) — so that the right content is shown immediately when the page loads. Until logout.
• Your display choices (betsynq_res_enhet) — whether you want to see results in kronor or units. Until you change them.
• Age confirmation (betsynq_age_confirmed_at) — that you have confirmed you are 18, so the box does not return on every visit. 12 months.
• Displayed boxes (bsq_onboarded, bsq_newsletter) — that you have seen the introduction and newsletter box respectively. Until you clear your browser.
• Purchase in progress (betsynq_pending_…) — plan, email and any referral code while a purchase is being completed. Removed when the purchase is complete.
• Campaign information (bsq_attr_forsta, bsq_attr_senaste, bsq_klient_id) — which advert or link brought you here, so that we can see which marketing brings in customers. Only during your visit — it disappears when you close the tab.

Campaign information was previously retained for 90 days. We have changed this: it is now tied to the visit and does not follow you between visits, devices or websites. If we want to reintroduce persistent measurement, we must ask you first.

Visitor measurement is carried out via Plausible, which counts visits without cookies and without individual visitors being identifiable or tracked across websites. Reporting to advertising platforms takes place from our server, not from your browser.

You can clear local storage whenever you want through your browser settings. This logs you out and resets your saved choices to their defaults. Payments are handled by Stripe on its own website, where its terms and cookie information apply.

9. Personal Data Breaches

In the event of an incident that poses a risk to your rights, we report it to the Swedish Authority for Privacy Protection within 72 hours and inform you directly whenever the requirements for that are met.

10. Complaints

If you're unhappy with how we process your data, we want to hear from you first. You always have the right to contact the supervisory authority: Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, imy.se.