Privacy policy

Data controller

The controller of your personal data is MB Silent Code, company code 307561551, registered office Europos pr. 34-47, LT-46370 Kaunas, Lithuania. For any question or request about your data, write to —.

What data we process

You can browse the odds without an account. In that case we process only technical data and analytics events that are not linked to an account. When you sign in, we also process the data below.

• Account data: your Firebase user ID, e-mail address, name, whether your e-mail address is verified, when the account was created and when you were last active.
• Data you create in kefas: tracked bets (event, market, bookmaker, odds, stake and result), your bankroll, the bookmakers you choose, saved filters and alert settings, bookmaker stake limits you record, reports of wrong odds you send us, and events on your watchlist.
• Leaderboard: users with enough settled bets appear on the public leaderboard with their number of bets, turnover, profit and ROI under a pseudonymous tag. Your display name is shown there only if you opt in, and opting out removes it.
• Billing data: your Stripe customer ID, subscription status, plan, trial dates and billing period dates. You enter your card, billing address and, optionally, a tax ID on Stripe's payment page, and Stripe processes them. We do not see or store your card number.
• Analytics data: product events (for example, sign-in started, checkout started, or a bet recorded with its sport, market and bookmaker), page views, language, and device and browser type. After you sign in, these events are linked to your user ID. Your e-mail address, name, stakes, odds, bankroll and any money amounts are never sent to analytics.
• Technical data: your IP address and request metadata (such as the browser and the time of the request), which our hosting providers process to deliver the site and protect it from abuse.

Why we process data and on what legal basis

We process personal data only for the purposes below, each with a legal basis under the General Data Protection Regulation (GDPR):

• providing your account and the service: performance of a contract, Article 6(1)(b) GDPR;
• payments, subscriptions and accounting: performance of a contract and compliance with a legal obligation, Article 6(1)(b) and (c) GDPR;
• product analytics, to understand which features are used and improve them: our legitimate interest, Article 6(1)(f) GDPR; you can object at any time;
• security and prevention of abuse: our legitimate interest, Article 6(1)(f) GDPR;
• showing your display name on the public leaderboard: your consent, Article 6(1)(a) GDPR, which you can withdraw at any time on your account page;
• sending account and billing e-mails (e-mail verification, password reset, payment receipts): performance of a contract.

Who receives your data

We share personal data only with these service providers, and only as far as each of them needs it to provide its service:

• Google (Firebase Authentication): sign-in and account e-mails;
• Stripe: payments, subscriptions and receipts;
• PostHog (EU cloud): product analytics. PostHog receives your IP address with the events and may derive an approximate location from it;
• Vercel: website hosting and cookieless Web Analytics;
• Railway: hosting of our API and database.

We do not sell personal data, and we do not use advertising networks.

Transfers outside the EEA

Some of these providers are US companies and may process data outside the European Economic Area. Such transfers are protected by a European Commission adequacy decision, including the EU–US Data Privacy Framework where the provider is certified under it, or by the Standard Contractual Clauses included in the provider's data processing terms.

How long we keep data

We keep your data for as long as your account exists. After you ask us to erase it, we delete or anonymise it within one month, except billing and invoice records that Lithuanian accounting law requires us to keep.

Analytics events are kept no longer than needed for product analysis.

Your rights

You have the right to:

• access your data and get a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict the processing of your data;
• receive your data in a structured, machine-readable format (data portability);
• object to processing based on our legitimate interest, including analytics;
• withdraw your consent at any time, without affecting processing carried out before the withdrawal.

To exercise any of these rights, write to —. There is no self-service delete button yet, so requests are handled by e-mail. We reply within one month.

If you believe your data is processed unlawfully, you can lodge a complaint with the Valstybinė duomenų apsaugos inspekcija (State Data Protection Inspectorate, VDAI) at vdai.lrv.lt.

Children

kefas is not intended for anyone under 18, and betting in Lithuania is allowed only from the age of 21. We do not knowingly collect data about minors, and if we find that we have, we delete it.

Security

All connections to kefas are encrypted with HTTPS. Your account data can be accessed only with your sign-in token. Payment card data is handled by Stripe, not by us.

Cookies and browser storage

kefas does not use cookies. What we keep in your browser's storage, and why, is described in the Cookie policy.

Changes to this policy

We may update this policy. Updates are published on this page with the date of the last update.