Privacy policy
Version 2 · effective from 10 November 2026
1. Who is responsible for your data
The controller of your personal data under the General Data Protection Regulation (GDPR) is GuaniPick, based in Portugal. For any question about your data, write to guanipick@hotmail.com.
2. What data we process
- Account data: your email and your password. The password is stored encrypted by our authentication provider: nobody at GuaniPick can see it.
- Data you enter: bankroll, units, rules, bets (matches, markets, odds, stakes, results), notes, tags, bookmakers, bonuses, deposits and withdrawals, and your profile name.
- Account security: the date and version of the terms you accepted and, if you turn on two-step verification, the record of your authenticator app.
- Technical data: IP address, browser type and access logs, generated automatically by our hosting and database providers to keep the service running and secure.
- Browser storage: we only keep in your browser's local storage what is needed to keep you signed in and your display preferences (for example, the theme). We don't use advertising or analytics cookies, so we don't ask for cookie consent.
We don't ask for, and don't want, bank details, ID documents or health data. Please don't write them in your notes.
3. Why we use your data and on what legal basis
| Purpose | Legal basis (GDPR, Art. 6) |
|---|---|
| Creating your account, storing your bets and calculating your bankroll, stats and bettor card | Performance of a contract (the terms you accept when you sign up) |
| Security: preventing unauthorised access, abuse and attacks | Legitimate interest in keeping the service secure |
| Answering your requests and meeting legal obligations | Legal obligation |
The calculations (stats, "card", rule warnings) are only for you and have no legal effects and make no automated decisions about you. We don't use your data for advertising and we don't sell it to anyone.
4. Who processes data on our behalf
- Supabase: database and authentication. Your data is hosted in the European Union (Ireland).
- Netlify: website hosting, which may log technical data (such as the IP address) of requests.
These providers only process data on our instructions, under data processing agreements (GDPR Art. 28). As they are companies based outside the European Union, data may occasionally be accessed from outside the EU (for example, for technical support). In those cases the safeguards set out in the GDPR apply, such as the Standard Contractual Clauses approved by the European Commission.
5. How long we keep it
- For as long as you have an account. When you delete your account, your data is removed from the database immediately.
- We automatically keep up to 30 previous versions of your data to protect you from accidental loss. Only you can see them, and they are deleted when you delete your account.
- Provider backups, if any, are overwritten automatically within 30 days at most.
- Technical access logs are kept by the providers only as long as needed for the security of the service.
- Accounts with no sign-in for 24 months may be deleted, after a notice sent to the account's email.
6. Your rights
You have the right to access, correct, delete and take your data with you, and to restrict or object to its processing. Most of this is done on the site itself, under Banca e regras → Os teus dados (Bankroll and rules → Your data):
- Access and portability: the "Exportar os meus dados" (Export my data) button downloads a JSON file with everything we store.
- Rectification: you can edit or delete any bet or transaction.
- Erasure: the "Apagar a minha conta" (Delete my account) button removes the account and all its data.
For other requests, write to guanipick@hotmail.com. We reply within one month at most. You also have the right to lodge a complaint with the Portuguese data protection authority (CNPD) or with the data protection authority in your country.
7. If you live outside the European Union
We apply the same rules and the same rights to every user, whatever the country. In particular:
- Brazil (LGPD): GuaniPick is the controller of your data. The contact of the person in charge of data processing (encarregado) is guanipick@hotmail.com. You can exercise your rights under Art. 18 of the LGPD by email and complain to the ANPD.
- United Kingdom (UK GDPR): you have the same rights described above and can complain to the Information Commissioner's Office (ICO).
- United States (including California): we do not sell or share your personal information with third parties for advertising.
8. Security
All communication is encrypted (HTTPS). Each user can only read and change their own data, enforced by rules in the database itself. The site refuses code from unauthorised sources, and you can turn on two-step verification (a code from an authenticator app). If there is a data breach that puts you at risk, we notify the supervisory authority within 72 hours and, if the risk is high, we also notify you.
9. Minimum age
GuaniPick is only for people of legal gambling age in their country, and never for anyone under 18. If we learn that an account belongs to a minor, we delete it.
10. Changes
If we change this policy, we update the version and date at the top and, if the change is significant, we announce it on the site. This policy exists in Portuguese and English.