Privacy Policy

This policy explains how SlipBets ("we", "us") uses personal data when you visit the website, create an account or subscribe. We are the controller of that data. Our legal name, address and registration details are on the Legal information page (/legal).

For any privacy question or request, email info@slipbets.com.

• Account: your name, email address, password (stored only as a salted hash), and the settings you choose.
• Betting records you enter: bankrolls, bets, stakes, odds, notes and results. They are private to your account and never sold or shared with sportsbooks.
• Subscription and payment: your plan, prices, invoices, payment status and the billing address and country you give at checkout. Card details go directly to our payment provider (Whop, or Stripe for older subscriptions); we never see or store full card numbers.
• Checkout agreement record: what you agreed to at checkout (the statements you ticked, the versions of the Terms, Refund Policy and Privacy Policy), when, the IP address and browser the request came from, and your billing country.
• Withdrawal and cancellation records: if you withdraw from or cancel a contract, your name, email, the statement you sent, when we received it, the contract it concerns, the reimbursement decision, who made it and why, and the refund reference.
• Cookie choices: a random id kept in your browser, the categories you allowed or refused, the policy version and the time. No IP address or account is stored with it.
• Technical data: IP address, browser and device type, pages requested and error logs, used to run and secure the service.
• Referral data (only with marketing consent): which referral link, campaign or ad brought you, and your country estimated from your IP address at signup.

For people in the EU/EEA and the UK, each use has its own legal basis. Consent is only the basis where we say so below.

• Providing your account, picks, tools and subscription; taking payments and sending receipts and service emails — performance of our contract with you (Art. 6(1)(b)).
• Keeping the checkout agreement record — to meet our legal duty to inform you before you subscribe and confirm the contract on a durable medium, and to show that we did (Art. 6(1)(c)); and our legitimate interest in being able to establish or defend legal claims (Art. 6(1)(f)).
• Handling withdrawals, cancellations and reimbursements, including the deadline reminders our team receives — legal obligation under consumer law (Art. 6(1)(c)).
• Keeping invoices and payment records — legal obligation under tax and accounting law (Art. 6(1)(c)).
• Recording your cookie choices — legal obligation to be able to show consent was given (Art. 6(1)(c) with Art. 7(1)).
• Security, fraud and abuse prevention, error logs and reminders about renewals and payment problems — legitimate interests in a safe, working service and in avoiding unexpected charges for you (Art. 6(1)(f)).
• Google Analytics and referral attribution cookies — your consent (Art. 6(1)(a) and the ePrivacy rules). You can withdraw it at any time in Cookie settings; that doesn't affect what happened before.

• Account and betting records: while your account exists. When you delete your account they are deleted, except the records below.
• Checkout agreement records: while the subscription runs and for 6 years after it ends (the usual limitation period for contract claims). A checkout that was never paid is deleted after 90 days.
• Withdrawal and cancellation records: 6 years after we received them, once they are closed. Open cases are kept until they are resolved.
• Invoices and payment records: for as long as tax and accounting law requires (typically 6 to 10 years, depending on the country).
• Cookie choice records: 2 years. Your consent cookie lasts 1 year, after which we ask again.
• Server and error logs: only as long as needed for troubleshooting and security.
• These periods are applied automatically: a daily job deletes records once their period has passed.

Inside SlipBets, only administrators protected by two-factor authentication can see subscription, checkout agreement and withdrawal records, and only to handle your subscription, a withdrawal or a request you made. Decisions on reimbursements record who made them.

We don't sell your personal data or share it for cross-context behavioural advertising. We use these service providers, under contracts that limit them to processing it for us:

• Whop (payments, memberships, invoices and refunds).
• Stripe (renewals and refunds for subscriptions started before we moved to Whop).
• Our hosting, database and content-delivery providers, including Cloudflare (security and delivery).
• Our email delivery provider (account, receipt, reminder and withdrawal emails).
• Google (Google Analytics, only if you allow analytics cookies; advertising features are switched off).
• Authorities or courts, where the law requires it.
• The current list of providers is available on request at info@slipbets.com.

Some providers process data outside the EU/EEA or the UK, for example in the United States. Where a country doesn't have an adequacy decision, we rely on safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-U.S. Data Privacy Framework where the provider is certified.

Nothing optional is set until you choose. You can accept, reject non-essential cookies, or choose by category, and change your choice at any time with "Cookie settings" in the footer. Turning analytics off stops Google Analytics and deletes its cookies.

• Strictly necessary (always on): sign-in session and security cookies (better-auth), your cookie choice (slipbets_cookie_consent, consent), Cloudflare security cookies, and short-lived browser storage that keeps a page working (for example after an error).
• Preferences you set (no consent needed, stored only when you change a setting): odds format, theme, sidebar state, the sports shown and tool history, in cookies or local storage.
• Analytics (with consent): Google Analytics (_ga, _ga_*), counting visits and page views. Up to 2 years.
• Marketing (with consent): first-party referral cookies sb_attr (first visit source, up to 90 days) and sb_tl (tracking link, up to 30 days), so the right partner is credited. Not shared for advertising.
• Payments: checkout happens on Whop's own page (whop.com) under Whop's cookie policy; we don't load payment scripts on our site.
• Outbound links to partners are counted on our server without cookies.

In the EU/EEA and the UK you can ask for access to your data, correction, deletion, restriction, a portable copy, and you can object to processing based on legitimate interests. Email info@slipbets.com; we reply within one month. We may need to keep some records despite a deletion request where the law requires it (see section 4); we will tell you which and why.

You can also complain to your data protection authority, for example your national authority in the EU/EEA or the Information Commissioner's Office in the UK.

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. The country used to decide which consumer rules apply is taken from your billing address and card country first; your IP address alone is never used to refuse you a right.

• In the last 12 months we collected the categories in section 2 for the purposes in section 3.
• We don't sell personal information or share it for cross-context behavioural advertising.
• Depending on your state or province, you can ask to know, access, correct or delete your personal information; we won't treat you differently for asking.
• If your browser sends a Global Privacy Control signal, marketing cookies stay off unless you turn them on yourself in Cookie settings.
• Quebec residents can ask for the information in this policy and for a copy of their data in French.

SlipBets is for adults (18+, or 21+ where that is the legal betting age). We don't knowingly collect data from children; if we learn we have, we delete it.

• All traffic is encrypted with HTTPS.
• Passwords are stored only as salted hashes.
• Administrator access requires two-factor authentication and is limited to the people who need it.

When this policy changes, we update the version and date above. If a change matters for how we use your data, we tell account holders by email or on the site before it applies. Where a change needs your consent, we ask again.