Who is responsible
The controller of your personal data is ArbStrike ("ArbStrike", "we"). For anything about your data, write to [email protected] with "Privacy" in the subject.
This policy covers arbstrike.com, the scanner, your account, the emails we send and the alerts delivered through Telegram. It follows the EU General Data Protection Regulation (GDPR) and, for visitors in the United Kingdom, the UK GDPR.
What we collect
You can use the free scanner without telling us who you are. We hold personal data only in the cases below.
When you create an account
- Your email address.
- Your password, stored only as a salted hash (scrypt). We cannot read it.
- The date the account was made and the IP address it was made from.
- Your plan and the dates it runs to.
- What you set in the scanner: filters, bookmakers, stake, rounding, the arbs you hid.
- Error reports you send about an arb: the reason and your note.
When you sign in with Telegram
- Your Telegram user ID, your username and first name as Telegram sends them, and the time Telegram confirmed the sign-in. We check Telegram's signature and keep only the ID and the username. Telegram does not give us your phone number.
- The account then has no email address and no password until you add one.
- Telegram asks whether ArbStrike may message you. If you allow it, that is where your alerts go.
When you sign in with Google
- Your Google account ID and your email address, and only once Google confirms that the address is verified. Google also sends your name; we do not store it.
- If an account with that email already exists, Google is added to it as a way to log in. If that address had never been confirmed with us, the account's password is removed and every device is logged out, so that nobody who set up an account with your address before you can keep using it. You can set a new password with "Forgot password".
When you log in
- A session record: a hash of the random token in your login cookie, when it was created and when it was last used.
When you pay
- By card: Whop takes the payment. Whop tells us the subscription and payment numbers, the plan, the amount, the status (paid, refunded, disputed, cancelled) and the date the period ends. We do not receive your card number, its expiry date or its security code.
- With crypto (where offered): NOWPayments tells us the payment number, the amount, the currency and the status.
When you connect Telegram
- Your Telegram user ID, so that alerts reach the right chat. We do not get your phone number from Telegram.
When you arrive through a partner's link
- The click ID and the partner code in that link. If you accept the partner cookie they are kept in it for 60 days; when you create an account they are saved with the account.
- When an account that came through a partner buys a plan, we pass the sale to the platform that runs our partner programme so that the commission can be worked out: the order number, the plan, the net amount, the click ID and partner code, and the buyer's email address and IP address. The last two are used to spot fraud, such as a partner buying through their own link. If your account has no email address, we send the email you gave at checkout, or none at all.
When you write to us
- Your email address and whatever you put in the message.
Technical data
- Your IP address and browser details reach our server and our network provider with every request, as they do on any website. We use the IP address to limit repeated requests and login attempts, and for security.
- Site statistics: Cloudflare Web Analytics counts page views and visits, the site you came from, your country and how fast the pages load. It sets no cookies, stores nothing on your device, does not follow you to other sites and does not build a profile of you; we see only totals.
What we do not collect
- No tracking cookies, no advertising or social-media trackers, no fingerprinting.
- Nothing about your bets. We do not know whether you bet, where, or how much; the stake you type into the calculator is used on the page to work out the figures. If you are logged in it is saved with your settings.
- No identity documents and no data in the special categories of the GDPR.
Why we use it, and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Running your account and the plan you bought | Email, password hash, plan, settings, session | Contract, 6(1)(b) |
| Taking payment, renewing, cancelling, refunding | Payment and subscription records | Contract, 6(1)(b) |
| Logging in with Telegram or Google | Telegram ID and username; Google account ID and email | Contract, 6(1)(b); you choose to use it |
| Sending alerts to Telegram | Telegram user ID | Contract, 6(1)(b); you connect and disconnect it yourself |
| Service emails: password reset, messages about your plan or about these documents | Contract, 6(1)(b) | |
| Keeping the service safe: rate limits, stopping abuse and fraud | IP address, session records, sign-up IP | Legitimate interest, 6(1)(f): a secure service |
| Site statistics (Cloudflare Web Analytics, cookieless) | Page views, visits, referring site, country, page load times, in totals | Legitimate interest, 6(1)(f): knowing how the site is used and keeping it fast |
| Fixing wrong arbs | Your error reports | Legitimate interest, 6(1)(f): accurate data for every user |
| Remembering a partner link in a cookie | Click ID, partner code | Consent, 6(1)(a). You can withdraw it at any time |
| Paying partners their commission and spotting commission fraud | Partner code, click ID, sale, buyer's email and IP | Legitimate interest, 6(1)(f): paying partners correctly |
| Book-keeping and tax | Payment records | Legal obligation, 6(1)(c) |
| Answering you | Your messages | Contract, 6(1)(b), or legitimate interest, 6(1)(f) |
We do not send marketing email. If that changes, we will ask first, and every such email will have a way out.
We make no decisions about you by automated means that have a legal or similarly significant effect, and we do not build profiles of users.
You do not have to give us any data. To make an account, though, we need an email address, or your Telegram or Google account, and without an account there is no paid plan.
Who else handles it
We do not sell personal data and do not share it for anyone's advertising. These companies process it for us, or receive it because the service cannot work without them:
| Who | What for | What they get | Where |
|---|---|---|---|
| Whop, Inc. | Card checkout, subscriptions, receipts | What you enter at checkout (name, email, card, billing country); our account number for you, and the partner code if you came through one | USA |
| Cloudflare, Inc. | Delivering the site, DNS, protection against attacks, and cookieless site statistics (Web Analytics) | IP address and request data of every visit; for the statistics, the page, the referring site, browser and loading times, without cookies | USA, with servers worldwide |
| Contabo GmbH | The server that runs the site and holds the database | Everything stored in your account, as hosting provider | Germany (company); server in France |
| Resend (Plus Five Five, Inc.) | Sending our emails | Your email address and the email's content | USA |
| Google LLC | Sign-in with Google, if you use it | Your request to log in; Google tells us your account ID and email | USA |
| Telegram | Delivering alerts, if you connect it; sign-in with Telegram, if you use it (its login button loads from telegram.org when you press it) | Your Telegram ID and the alerts we send you | Telegram's own network; it is responsible for its own service |
| Our partner-program platform | Working out partner commissions | For sales that came through a partner: order number, plan, amount, click ID, partner code, buyer's email and IP | Run by us, on our own servers |
Whop, Google and Telegram also act as controllers in their own right for the accounts you hold with them; their privacy policies tell you what they do. We may also disclose data when the law obliges us to, or to defend a legal claim.
The site's fonts and photographs are served from our own server, so opening a page sends nothing to a font or image provider.
When you follow a link to a bookmaker, you leave ArbStrike. We send the bookmaker nothing about you, and our pages are set not to pass on the address you came from.
Data outside the EU
Our server is in the European Union. Some of the companies above are based in the United States or operate worldwide. Where personal data goes to a country outside the EEA that the European Commission has not found adequate, the transfer rests on the Commission's standard contractual clauses, or on the provider's certification under the EU–US Data Privacy Framework. Ask us and we will tell you which applies to a given provider.
How long we keep it
| Data | Kept for |
|---|---|
| Account (email, password hash, settings, reports, Telegram ID and username, Google account ID) | Until you ask us to delete the account. Deleted within 30 days of the request. |
| Login sessions | Up to 30 days, or until you log out or change your password. |
| Password-reset and Telegram link codes | Until used or expired, a matter of minutes to hours. |
| Payment, subscription and commission records | For as long as book-keeping and tax law requires (up to 10 years) after the payment, even if the account is deleted. |
| Partner cookie | 60 days, or until you withdraw consent. |
| Server and security logs | 30 days. |
| Support emails | Up to 2 years after the last message. |
Your rights
Under the GDPR you can:
- ask what we hold about you and get a copy;
- have wrong data corrected;
- have your data deleted, where we have no legal duty to keep it;
- have its use restricted while a question is being settled;
- receive the data you gave us in a common, machine-readable format, or have it sent to another provider;
- object to uses that rest on our legitimate interest, including the use of your data for partner commissions;
- withdraw a consent you gave. For the partner cookie that is one press: "Cookie settings" at the foot of every page.
Write to [email protected] from the email address of your account. We answer within one month and it costs nothing. We may ask for something that shows the account is yours.
You can also complain to a data-protection authority: for example the one in the country where you live or work. We would rather hear from you first and put it right.
How we protect it
- The site is served only over HTTPS.
- Passwords are stored as salted scrypt hashes; login tokens are stored as hashes too, and the login cookie cannot be read by scripts.
- Login, sign-up and password reset are rate limited.
- Card data never touches our server.
- Access to the server and the database is limited to the people who run the service.
No system is perfectly safe. If a breach is likely to put your rights at risk, we will tell you and the authority as the law requires.
Cookies
We use one cookie that is needed for login, one that remembers your cookie choice, a short-lived one while you sign in with Google, and one optional partner cookie. Site statistics are counted without cookies. The Cookie Policy lists each of them.
Under 18
ArbStrike is for adults. We do not knowingly keep data about anyone under 18. If you believe a minor has made an account, tell us and we will delete it.
Changes
When we change this policy we change the date at the top. If the change affects how your data is used in a way that matters, account holders are told by email before it takes effect.
Contact
ArbStrike
[email protected]