Privacy Policy
Privacy Policy
Version 2.0 · Effective 17 October 2026
This policy explains what personal data ScorelyLab collects, why, who we share it with, how long we keep it, and the rights you have. It applies to the ScorelyLab website and app (the "Service").
1. Who is responsible
The data controller is:
Nyks Solutions Lavele Street 19 1000 Sofia, Bulgaria VAT number: BG206558722 Email: hello@scorelylab.com
Write to that address for any question or request about your data.
2. What we collect
When you create an account
- Email address and a password (stored only as a hash), or your Google account ID, name, and profile picture if you sign in with Google
- Date of birth, used to check that you are 18 or older
- Country, used to decide whether registration is available and which leagues to suggest
- Language
- A username and display name if you choose to set them
- The time you accepted the Terms and this policy, and which version
- Whether you agreed to marketing email, and when
While you use the Service
- Teams and leagues you follow
- Your reading preferences: risk style, text length, and which markets you care about
- Notification and email settings
- Which matches you opened and when, so we can apply the daily free limit, pick your free match of the day, and show how many members have read a match (shown only as a total, never by name)
- Days on which you were active, used for membership badges
- In-app notifications we sent you
- Your timezone, read from your device or browser if the app sends it
When you subscribe to Premium
- Your Stripe customer and subscription IDs, plan, status, and billing period
- A record of each payment and refund: amount, currency, date, and status
- We never see or store your full card number. Stripe holds your payment details.
For security
- The IP address and browser or device description at signup, at each sign-in, and for each active session
- A log of account events such as sign-in, failed sign-in, password change, email change, and Google linking, with IP address and time
- IP addresses we have blocked for abuse
Email delivery
- Which emails we sent you and whether they were delivered, opened, bounced, or reported as spam. We use this to stop sending to addresses that bounce and to honour unsubscribes.
We do not collect precise location, contacts, or any payment card details.
3. Cookies and measurement
We use cookies and similar storage. A cookie is a small piece of text stored on your device.
Strictly necessary
These are required for the Service to work and to keep it secure. The cookie bar cannot turn them off.
- Sign-in. A login token is stored on your device so you stay signed in. The cookie
sl_sessionis only a flag that you are signed in, so we can send you to the right page. It lasts up to 30 days and is cleared when you sign out. It does not contain the token. - Your cookie choice. The cookie
sl_google_consentstores whether you allowed statistics cookies (granted) or chose necessary cookies only (denied). It lasts up to 12 months. We store it so we can respect your choice and not ask on every page. - Security. The support form uses Cloudflare Turnstile, which may set a short-lived cookie to tell a person from a bot. Abuse protection also uses the server-side IP logs described in this policy. Those logs are not cookies.
Statistics cookies, only with your consent
The cookie bar says we use cookies to keep the site working and for anonymous traffic statistics.
- OK allows statistics cookies.
- Necessary only refuses them.
If you choose OK, Google Analytics 4 may store and read measurement cookies, such as _ga, using Google Consent Mode v2. We use that to see which pages are used and where visits come from. The same choice sets Google's consent signals for analytics storage and for ads storage (ad_storage, ad_user_data, ad_personalization, and analytics_storage). We do not load a separate Google Ads tag on ordinary page views. A purchase event is sent to Google Analytics only after a confirmed Premium payment.
Until you choose, and if you choose Necessary only, those signals stay denied and the statistics cookies are not set. Google may still receive a cookieless ping. That is how Consent Mode can measure traffic without statistics cookies.
Cookieless traffic measurement
Vercel Analytics counts page views without setting a cookie. It does not receive your name, email, or account id. It runs even when you choose Necessary only.
Changing your choice
Use Cookie settings in the footer, or the same control on this page, at any time. OK allows statistics cookies. Necessary only refuses them. Withdrawing the choice is one click, the same as allowing it. You can also delete sl_google_consent in your browser.
4. Why we use it, and the legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Create your account, sign you in, keep you signed in | Account data, sessions | Contract |
| Check you are 18 or older and in a supported country | Date of birth, country | Legal obligation and legitimate interest in running an adults-only service |
| Show you the Service and personalise it: your teams, your reading preferences, your free match of the day | Favourites, preferences, match reads | Contract |
| Apply Free and Premium limits | Match reads, tier | Contract |
| Take payment and manage your subscription | Subscription and payment records | Contract |
| Send emails you need: verification codes, receipts, password resets, security notices | Email address | Contract |
| Send a weekly digest about your teams | Email, favourites | Legitimate interest; you can turn it off in Settings |
| Send marketing email | Consent; off by default, withdraw any time | |
| Keep accounts safe, detect abuse, block attackers | IP addresses, device description, security log, IP bans | Legitimate interest in security |
| Keep accounting records | Payment records | Legal obligation |
| Answer your requests and complaints | Whatever you send us | Legal obligation and legitimate interest |
| Measure visits with Google Analytics when you allow statistics cookies | Cookie choice, measurement cookies, cookieless Consent Mode pings | Consent. No statistics cookies until you choose OK. |
| Count page views without cookies | Vercel Analytics | Legitimate interest in understanding how the Service is used |
Personalisation uses the choices you made during onboarding and the teams you follow. It changes which match is shown first and how the text is written. It has no legal or similarly significant effect on you.
5. Who we share it with
We do not sell personal data. We do not share it with bookmakers or data brokers.
- Google Analytics processes measurement data only as section 3 describes, and only to the extent your choice and Consent Mode allow.
- Vercel processes cookieless page-view data so we can see aggregate traffic.
- Stripe holds your payment details when you subscribe. We store Stripe IDs, amounts, and status, not your full card number.
- We disclose data to authorities only when the law requires it.
6. Transfers outside the EU and EEA
Google, Vercel, and Stripe may process personal data outside the EU and EEA. Where that happens we rely on the EU–US Data Privacy Framework for companies certified under it, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy of the safeguards that apply.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account exists |
| Favourites, preferences, notifications, match reads, activity days | While your account exists. Deleted with the account. |
| Sessions | Until they expire or you sign out, at most 7 days without use |
| Verification and reset codes | 15 minutes, then unusable; deleted with the account |
| Security log (sign-ins, password changes) | Kept after account deletion with your identity removed, so that failed attempts and abuse stay traceable |
| Payment and refund records | For as long as Bulgarian tax and accounting law requires, up to 10 years |
| Email delivery log | Up to 12 months |
| IP bans | Until the ban expires or is lifted |
Cookie sl_session | Up to 30 days, or until you sign out |
Cookie sl_google_consent | Up to 12 months |
| Google Analytics cookies | Only after you choose OK. You can refuse them, or clear them in your browser, at any time. |
| Database backups | Up to 14 days, then overwritten |
8. Deleting your account
You can delete your account at any time from Settings. We cancel any active Premium subscription, then delete your account, profile, favourites, preferences, notifications, badges, match reads, sessions, and codes. Payment records and the anonymised security log are kept as described above. Data in backups is overwritten within 14 days.
Before you delete, you can download a copy of your data from Settings.
9. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you. Settings has a "Download my data" export; for anything else, email us.
- Correct data that is wrong. Email, name, country, and preferences can be changed in Settings.
- Delete your data. Use "Delete account" in Settings, or email us.
- Port your data to another service, in the machine-readable export from Settings.
- Object to processing based on our legitimate interests, including the weekly digest.
- Restrict processing in certain cases.
- Withdraw consent to marketing email at any time, in Settings or via the unsubscribe link in any marketing email. This does not affect processing before you withdrew.
- Withdraw your statistics-cookie choice at any time with Cookie settings in the footer or on this page. Necessary only stops new statistics cookies. It does not affect measurement that already happened.
To use a right we cannot offer in Settings, email hello@scorelylab.com from your account email. We answer within one month. We may ask you to confirm your identity first.
If you are not satisfied, you can complain to a data protection authority. Ours is the Commission for Personal Data Protection in Bulgaria (cpdp.bg).
10. Children
The Service is for people aged 18 or older. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, email us and we will delete it.
11. Security
Passwords are stored as hashes. Sessions use short-lived tokens that rotate. Access to production data is limited to people who need it to run the Service, and admin actions are logged. We take regular database backups. No system is completely secure; if a breach affects your data we will tell you and the authority as the law requires.
12. Changes
We may update this policy. For a material change we will tell you by email or in the app before it takes effect and ask you to accept the new version the next time you sign in. The version and date are shown at the top of this page.
13. Contact
Nyks Solutions · Lavele Street 19, 1000 Sofia, Bulgaria · VAT BG206558722 · hello@scorelylab.com