Privacy Policy

VAX ADVISORS SRL (registered in Romania, Nr. Reg. Com.: [J..] · CUI: [..], registered office at [registered address]) is the data controller for personal data collected through sharptips.co.uk. Because we're based in the EU and process data of people in the UK, we aim to comply with both the EU General Data Protection Regulation (GDPR) and the UK GDPR. Contact us about anything privacy-related at privacy@sharptips.co.uk (or support@sharptips.co.uk until that inbox is set up).

Account data: the name (optional) and email address you sign up with, and a securely hashed version of your password (we never store your actual password - see Security below).

Subscription & billing data: which plan you're on and its status. Card and payment details are collected and processed directly by Stripe, our payment processor - we never see or store your full card number.

Usage data: predictions you add to your picks history, so we can show you your own selection history and its results.

Communication preferences: whether you've opted in to our newsletter (only ever recorded when you actively tick an unticked-by-default consent box - see our Cookie Policy for how cookies fit into this) and whether you've enabled push notifications, in which case we store the browser-provided subscription details needed to send them.

Contact form messages: whatever you send us through our Contact page, plus your email address so we can reply.

Technical data: we log IP addresses briefly for security purposes - specifically, to rate-limit repeated failed login, sign-up and password-reset attempts and reduce the risk of automated attacks on accounts.

• Performance of a contract - creating and running your account, providing the plan you've subscribed to, processing payments.
• Consent - sending you the newsletter, sending push notifications, and any other marketing communication - always opt-in, never on by default, and withdrawable at any time.
• Legitimate interest - keeping the service secure (e.g. rate-limiting login attempts), improving the service, and responding to support requests.
• Legal obligation - keeping invoicing and tax records for the period required under Romanian and UK law.

We share personal data only with service providers who need it to run SharpTips, under their own data-processing terms - we never sell your data:

• Stripe - payment processing and subscription billing.
• Resend - sending transactional emails (verification codes, password resets) and, where you've opted in, the newsletter.
• Vercel - application hosting.
• Sports-data, news and AI providers (planned - not yet connected as of this version) - once live, these services process fixture and match-level data to help generate predictions; they do not receive your personal account data.

We may also disclose data where required by law, or to protect our rights, users, or the public.

Some of the providers above (for example Stripe, Resend, Vercel, and any AI provider we connect) may process data outside the EU/UK, including in the United States. Where that happens, we rely on the safeguards those providers offer - such as Standard Contractual Clauses or an applicable adequacy decision - to keep your data protected to a UK/EU standard.

We keep account data for as long as your account is active, plus a reasonable period afterwards in case you return or for our own records. Invoicing and payment records are kept for the minimum period required under Romanian and UK tax law (this can be several years). If you delete your account, we'll delete or anonymise personal data that we're not legally required to keep.

Under GDPR/UK GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate data;
• Ask us to delete your data (subject to what we're legally required to keep, e.g. for tax purposes);
• Restrict or object to certain processing;
• Receive your data in a portable format;
• Withdraw consent at any time for anything based on consent (e.g. the newsletter, push notifications) - this doesn't affect the lawfulness of processing before you withdrew it.

To exercise any of these, email privacy@sharptips.co.uk. You also have the right to complain to a supervisory authority - in Romania, ANSPDCP (dataprotection.ro); in the UK, the ICO (ico.org.uk).

We use a small number of cookies, described in full in our Cookie Policy.

Passwords are never stored in plain text - we store only a salted bcrypt hash, the same approach used for the temporary codes sent for email verification and password resets. All traffic to SharpTips is encrypted (HTTPS). No system is 100% secure, but we take reasonable technical and organisational measures to protect your data.

SharpTips is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18, and accounts require you to confirm you meet this age requirement when you sign up.

We may update this policy from time to time. We'll post the updated version here with a new "last updated" date, and notify active subscribers by email of any material change.