PRIVACY
POLICY

The data controller of the +90 service is +90 Futbol (TR-Istanbul). All notices and applications regarding data processing are made to 90futbol.info@gmail.com.

Personal data processed through the Service:

• Identity data: first/last name (optional), email address.

• Account activity: sign-in time, IP (anonymised), browser information (User-Agent).

• Usage data: matches analysed, markets opened, subscription status.

• Payment data: not processed by us. It is held at Stripe / iyzico; we only store the customer ID and subscription status. Card details never reach our systems.

• Providing the Service (producing analyses, managing accounts).

• Carrying out membership and payment processes.

• Detecting abuse (multiple accounts, brute-force, bots).

• Improving Service performance (anonymous aggregate statistics).

• Fulfilling legal obligations (tax, financial records, notification to authorities on request).

Your data is transferred to the following technology providers for processing:

• Supabase (authentication + data storage, Australia — Sydney region)

• Stripe (international payments, US-based, with an EU representative)

• iyzico (Türkiye-based, domestic payments, KVKK-compliant)

• Google Gemini API (LLM analysis — only match information is sent, no user personal data)

• football-data.org (match data is received, no user data is sent)

• Understat (xG/shot statistics are received, no user data is sent)

• Resend (transactional email delivery — email address only)

• Google LLC — Google Analytics (site usage statistics; only if analytics cookies are accepted; US)

• Vercel Inc. (website hosting and content delivery — access logs: IP address, browser information; US)

• Railway Corporation (application server hosting — access logs: IP address; US)

• Functional Software Inc. — Sentry (error tracking and server performance measurement; from the browser only the browser/device type, page address and error details when an error occurs; no screen recording; data is stored in the EU — Germany)

These transfers are necessary to provide the Service; data is not sold for commercial marketing.

• Active account: until the account is deleted.

• Inactive account (no sign-in for 12 months): deleted after a 30-day warning.

• Payment and invoice records: statutory retention period (10 years, Tax Procedure Law).

• Account deletion request: processed within 30 days; all data is deleted except what is financially required.

Under KVKK art. 11 and GDPR art. 15-22 you have the following rights:

• To learn whether your data is processed.

• To access your data + export a copy of it (in JSON format).

• To have incorrect data corrected.

• To request deletion of your data.

• To object to processing.

• To complain to the competent authority (KVKK / data protection authority).

Rights requests are made to 90futbol.info@gmail.com; they are answered within 30 days.

• All traffic is encrypted with HTTPS (TLS 1.3).

• No password is stored; magic-link based sign-in is used.

• JWT session tokens are short-lived (1 hour) + refresh.

• The database is hosted on Supabase's managed infrastructure; backups are made according to the provider's service plan.

Details of cookie use are on the Cookie Policy page. Consent is obtained with a cookie consent banner on first visit.