Privacy Policy
Last updated: July 25, 2026
This Privacy Policy explains how À compléter — raison sociale ou nom de l'exploitant ("we", "us") collects and uses your personal data when you use OmniFoot (https://omnifoot.co). We are the data controller for that processing.
1. Data we collect
Account
When you create an account we collect your email address and a password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name, email address and profile picture from Google.
Subscription & billing
Your plan, its status and billing metadata are handled by our payment provider, Stripe. We never receive or store your full card number — Stripe processes the payment directly.
Usage
Your in-app activity: favourite teams and competitions, AI usage counts (used for daily quotas), saved predictions and history, and preferences such as language and theme.
Technical
Standard technical data such as IP address, device and browser information, and server logs, used for security, abuse prevention and reliability.
2. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Provide the Service and your account | Performance of our contract with you |
| Manage subscriptions and take payment | Contract, and legal obligation (accounting) |
| Security, fraud and abuse prevention | Our legitimate interest |
| Maintain, debug and improve the Service (incl. aggregate statistics) | Our legitimate interest |
| Service emails about your account | Performance of our contract |
| Marketing emails, if any | Your consent (which you can withdraw at any time) |
3. Who we share it with
We do not sell your personal data. We share it only with the service providers (subprocessors) that help us run OmniFoot, each acting on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase, Inc. | Authentication, database, sessions | USA / Singapore |
| Vercel Inc. | App & serverless hosting, logs | USA |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payment & subscription processing (we never store your card data) | Ireland / USA |
| Google LLC | “Sign in with Google” (OAuth), if you choose it | USA |
| Upstash, Inc. | Cache & rate limiting (Redis) | USA |
| API-Sports (API-Football) | Sports data (matches, statistics). No personal data is sent to it. | USA / EU |
| Anthropic PBC | AI analysis generation (Claude models). Receives match context only — no personal data. | USA |
| Moonshot AI (Kimi) | Translation of the AI analyses. Receives only the analysis text to translate — no personal data. | Chine / Singapour |
| Sendinblue SAS (Brevo) | Service e-mails (the daily digest, if you opt in). Receives your e-mail address. | France / UE |
| Cloudflare, Inc. | Inbound e-mail routing (contact@, support@). Receives the content of messages you send us. | USA / UE |
4. International transfers
Some of these providers are located outside the European Economic Area (notably in the United States). Where that is the case, the transfer is protected by appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework.
5. How long we keep it
- Account and usage data: for as long as your account is active, then deleted or anonymised within a reasonable period after you close it.
- Billing and accounting records: kept for the period required by applicable tax and commercial law (which can be up to 10 years).
- Technical logs: kept for a limited period (typically a few months) for security and debugging.
6. Your rights
Under the GDPR you can request: access to your data; rectification of inaccurate data; erasure; restriction of processing; portability; and you may object to processing based on our legitimate interest and withdraw any consent at any time.
To exercise these rights, email privacy@omnifoot.co. You may also lodge a complaint with your data-protection authority — in France, the CNIL (cnil.fr).
7. Cookies and local storage
We use strictly-necessary cookies and browser local storage to keep you signed in and to remember your preferences. We do not use advertising cookies. If we add analytics in the future, we will update this policy and ask for your consent where required.
8. Security
We protect your data with measures such as encryption in transit (HTTPS), hashed passwords and access controls. No method of transmission or storage is completely secure, but we work to protect your information and to notify you and the authorities of a data breach where the law requires it.
9. Children
OmniFoot is intended for adults (18+) and is not directed to children. We do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy from time to time. The date at the top reflects the latest version; significant changes will be communicated through the Service.
11. Contact
Questions about your data? Contact us at privacy@omnifoot.co.