Privacy policy

1. Controller and scope

This policy explains data processing relating to the FundMyBet website, customer area and support. The operator identified under ‘Operator and contact’ is responsible for this processing. The same contact details can be used to ask about your data or exercise your rights.

2. Data used

• Account: name, email address, country of residence, time zone, profile details you provide, confirmation of adult status and version of the accepted terms.
• Security: hashed password, sessions, login events, IP address and technical information needed to protect the service. Passwords are not stored in plain text.
• Activity: Demo accounts and challenges, associated rules, selections, accepted odds, tickets, results, balances, accounting movements, progression, certificates and notifications.
• Payments and withdrawals: transaction references, amounts, statuses, supporting information useful for processing and the IBAN provided for a withdrawal. Withdrawal bank details are encrypted; administrator access is controlled and logged. The platform does not request full card numbers through support.
• Identity: information and documents submitted during verification. Documents are held privately and available to authorised people according to the needs of the check.
• Assistance: messages, attachments, assistant conversations and support replies. Do not send passwords, one-time codes or identity documents in an ordinary support conversation.

Required data enables account creation and security, provision of the service or review of a withdrawal. Its absence may prevent the corresponding operation. A profile photo or optional information is not a condition of access to features that do not need it.

3. Why data is processed

Performance of the contract and measures requested before it is concluded form the basis for managing the account, challenge, tickets, payment, withdrawals and service-related assistance. Applicable legal obligations form the basis for retention and checks actually required of the operator.

The legitimate interest in protecting the platform and its users forms the basis for security measures, fraud prevention, incident investigation and defence of rights in disputes, with access limited to what is necessary. Where consent is required for an optional use, it must be collected separately and may be withdrawn without retroactive effect.

Statistics on your bets and progress are calculated from account activity to provide your dashboard. They do not, by themselves, constitute advertising tracking of your browsing on other websites.

4. Recipients and service providers

Data is available to authorised team members according to their roles: support, checks, finance and technical administration. Hosting, email delivery and technical services may require providers acting within their assigned tasks. A payment or identity-verification provider receives only the data required for the process actually enabled; its identity and information must be presented during that process.

FundMyBet does not sell your personal data. It is not sent to bookmakers to execute your tickets. Disclosure to competent authorities or advisers may occur in response to a legal obligation or to defend rights, within applicable limits.

5. Support assistant

When you use the AI assistant and the service is enabled, your request text, part of the recent conversation and useful information about the selected account may be sent to the OpenAI API to generate a response. This context may include the account name, status, rules, balance, progress and deadlines. The user identifier sent for security is pseudonymised; however, what you write may contain personal data.

The integration requests that responses not be stored as persistent objects by the provider. This does not mean the provider performs no processing or technical retention. You may choose human ticket-based support instead of the assistant. The assistant does not approve withdrawals, identities or financial decisions, and does not decide complaints.

6. Cookies and browser storage

An essential session cookie, bf_session, keeps you logged in. It is valid for at most 7 days per session; logging out revokes the session used. Expired sessions are cleared by technical tasks. Security links have limited validity: for example, a password-reset link expires after one hour.

The browser may also retain interface preferences, theme selection, betslip or demo items, and cached data needed for smooth display. These can be removed through browser settings; doing so may reset your preferences or require a new login.

The version described here includes no advertising tracker or third-party browsing-session recording system. If non-essential trackers are added, information and, where necessary, prior consent choices must be updated before activation.

7. Emails and preferences

Messages essential for access, security or a requested operation may be sent to provide the service: address confirmation, password reset and necessary payment or withdrawal information. Optional ticket and result notifications can be managed in your email preferences, accessible from the relevant messages. Disabling them does not delete the account or transaction history. Commercial communications, if offered, remain subject to applicable consent and opt-out rules.

8. Retention

Account and activity data is retained while the service is used and associated tickets, payments, withdrawals or complaints are processed. After closure, only data still needed for an applicable obligation, unfinished operation or establishment and defence of rights should be retained, with restricted access. Identity documents must not be kept longer than necessary for verification and obligations that actually apply.

Duration depends on the data category, any ongoing operation or dispute, and legal time limits applicable to the operator. Account closure therefore does not mean immediate deletion of every accounting document. When requesting deletion, you may obtain the retained categories, reason and duration or criterion used. Backups follow their rotation cycle and must not be used to reuse deleted data for another purpose.

9. Security and transfers

Data access is limited by permissions and session checks. The platform uses measures including password hashing, encryption of withdrawal bank details, private document storage and logging of sensitive operations. No measure guarantees zero risk; protect your credentials and report incidents to support.

Some technical providers, particularly for AI assistance, may process data outside the European Economic Area. Where the GDPR applies, these transfers must rely on a valid mechanism, such as an adequacy decision or standard contractual clauses with the necessary safeguards. Information on the recipients and safeguards actually used can be requested from the operator. This policy does not assume that all processing is hosted in the European Union.

10. Your rights and how to exercise them

Depending on applicable regulations, you may request access, rectification, erasure or restriction of processing of your data, as well as portability where its conditions are met. You may object to processing based on legitimate interest for reasons relating to your situation, and withdraw consent given for an optional use.

Send your request to the operator’s contact or support from the relevant account, specifying the right you wish to exercise. Proportionate identity verification may be needed in case of doubt. Where the GDPR applies, a response is normally due within one month; a reasoned extension is possible under the regulation’s conditions. A full or partial refusal must be explained.

You may also contact the competent data-protection authority, including the CNIL in France. For processing under Swiss law, you may contact the Federal Data Protection and Information Commissioner. Exercising your rights does not require you to waive available remedies.

11. Automated checks and updates

Stake, odds availability, progression and loss rules are checked automatically to apply the account’s conditions. A check may block an operation or change a challenge’s status. You may ask support for an explanation and human review of a disputed decision. Documents and rights relating to a decision are not replaced by an AI assistant response.

This policy may evolve with the processing actually carried out. Its version identifies the update. A significant change is communicated appropriately; a new use requiring consent does not follow merely from continued browsing.