Privacy Policy - Ensitics

SECTION 01

Information We Collect

1.1 Personal Information

We collect information you provide directly to us, including:

→
Email address for account registration.
→
Profile information from social sign-in providers — Google on the website; Google and Apple in the iOS app; Google in the Android app, and Apple as well where Sign in with Apple is offered there. Section 10.4 lists what each provider passes to us.
→
Payment information. On the website, payments are processed by Stripe. In the mobile app, subscriptions are sold and processed by the app store you bought them from: Apple through In-App Purchase on iOS, Google through Google Play Billing on Android. In every case your card details go straight to the payment provider and are never stored on our servers. See Section 10.1.
→
Payout details, if you take part in our referral programme and request a payout: the PayPal address, bank account or crypto-wallet address you choose. Unlike card details, these are stored on our servers — see Sections 03, 04 and 07.
→
Answers to the optional onboarding questionnaire on the website and in the app: your name, favourite team, the esports disciplines you follow, how often you bet, your betting style and which bookmakers you use, if any — including a bookmaker name you type in yourself. You can skip any question. We use the answers to personalise the service (Section 02), keep them while your account exists and delete them when you delete it.
→
Communication preferences and settings.

1.2 Usage Information

We automatically collect information about your use of our platform:

→
Pages visited and features used.
→
Time spent on the platform.
→
Device and browser information.
→
IP address and general location data.

SECTION 02

How We Use Your Information

We use the information we collect to:

→
Provide and maintain our esports analytics services.
→
Personalise the service with your onboarding answers (Section 01): which matches and predictions we show you first, which kind of prediction we put forward, the pick we show you at the end of the questionnaire, how often we send you free picks by email or Telegram, and which bookmakers' odds and links appear in our emails and Telegram messages.
→
Process subscription payments and manage your account.
→
Send important updates about our services.
→
Improve our platform and develop new features.
→
Ensure platform security and prevent fraud.
→
Comply with legal obligations.

2.1 Legal Bases for Processing

Under the GDPR we rely on the following legal bases:

→
Performance of a contract — creating and running your account, delivering predictions and tailoring them to the onboarding answers you choose to give, selling and managing your subscription, and paying out referral commissions.
→
Legitimate interests — platform security, fraud and abuse prevention, the measurement we need to keep the service working, the in-app usage analytics described in Section 10.3, and the measurement of our advertising by the SDKs in the mobile app described in the same section, in every country (on iOS, the SDK reads the advertising identifier only if you allow tracking in Apple's prompt). Outside the countries where we ask for prior consent, this basis also covers the server-side campaign measurement described in Section 03. We weigh these against your rights, and you can object at any time (Section 08).
→
Consent — product analytics on the website, marketing messages and any non-essential cookies. You give it explicitly and can withdraw it at any time; withdrawal does not affect processing already carried out.
→
Legal obligation — keeping accounting and payment records for the periods tax law requires.

2.2 Automated Decision-Making

Our predictions are generated by automated models, but they are informational content. They do not produce legal effects concerning you and do not similarly significantly affect you, so we do not carry out automated decision-making within the meaning of Article 22 GDPR.

SECTION 03

Information Sharing

We never sell your personal information and we never trade it. We share it with third parties in the following cases:

→
To trusted service providers who help us operate the platform: Stripe (payments on the website), Apple (in-app purchases and subscription billing in the iOS app), Google (in-app purchases, push notifications, sign-in and app integrity checks in the Android app), Abios (esports data).
→
To analytics and marketing platforms — Google Analytics, Meta, TikTok, X, Reddit and Brevo — to measure how the website and our campaigns perform. In the iOS app, only Meta receives data, through its SDK, as described in Section 10.3. In the Android app, Meta and Google Analytics for Firebase receive data through their SDKs (Section 10.3). Everything these platforms set or read in your browser happens only with your consent. Server-side conversion events (such as "signed up" or "purchased") are sent only with your consent if you are in the EU/EEA, the United Kingdom, Switzerland or Brazil; elsewhere we send them under our legitimate interest in measuring our advertising (Section 02.1) — unless you have declined, because declining stops these events wherever you are.
→
If you joined Ensitics through an invite link or an invite code, the person who invited you earns a commission on our revenue from your payments. In their referral dashboard they see your email address only in masked form (like m•••@example.com), plus the commission amount, status and date — never your card details, your invoices or what exactly you bought. If you delete your account, even the masked reference is removed and their dashboard shows a dash.
→
If you are a referral partner and request a payout, we pass the payout details you gave us — a PayPal address, bank account or crypto-wallet address — to the provider that executes the transfer, and to no one else.
→
When required by law or to protect our rights.
→
With your explicit consent.

Some of our service providers are located outside the European Economic Area. Where that is the case, the transfer relies either on an adequacy decision of the European Commission or on the European Commission's Standard Contractual Clauses, with additional safeguards where they are required. Write to privacy@ensitics.io for a copy of the safeguards that apply.

SECTION 04

Data Security

We implement appropriate security measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. Payment information is never stored on our servers: on the website it is processed by Stripe, and in the mobile app by Apple or Google, depending on the store you bought through. The one exception is referral payouts: the payout details partners give us (Section 01) are stored on our servers so we can execute the transfer and account for it.

SECTION 05

Cookies and Tracking

We use cookies and similar technologies in three categories:

→
Strictly necessary — sign-in, session and security. The site cannot work without them, and they are set without consent.
→
Analytics — how the site is used, so we can fix and improve it. Set only with your consent.
→
Marketing and measurement — measuring how our campaigns perform. Set only with your consent.
→
Referral attribution — if you open an invite link, one first-party cookie (ensitics_ref) remembers the invite code for 60 days so the invitation can be credited when you register. We set it only when you follow such a link — that click is the request it serves. It is not used for anything else and is never shared.

We ask before setting anything that is not strictly necessary, and declining is as easy as accepting. You can change or withdraw your choice at any time through the consent banner; withdrawal takes effect going forward. The mobile app does not use cookies: your session and settings are stored locally on your device.

SECTION 06

Third-Party Services

Our platform integrates with third-party services:

→
Social sign-in providers — Google on the website; Google and Apple in the iOS app; Google in the Android app, and Apple as well where Sign in with Apple is offered there.
→
Stripe — payment processing on the website.
→
Apple In-App Purchase and Google Play Billing — subscription purchases and billing in the mobile app, Apple on iOS and Google on Android.
→
Abios API — esports data.
→
Analytics and marketing platforms — Google Analytics, Meta, TikTok, X, Reddit, Brevo. On the website; in the iOS app only Meta, through its SDK; in the Android app Meta and Google Analytics for Firebase, through their SDKs (Section 10.3). Section 03 describes exactly when they receive data and on which legal basis.
→
The iOS app includes the Meta (Facebook) SDK to measure our advertising (Section 10.3). The Android app includes the Meta (Facebook) SDK and Google Analytics for Firebase for the same purpose (Section 10.3). Apart from them, the mobile app contains no third-party advertising, attribution or analytics SDKs.

Each service has its own privacy policy governing the use of your information.

SECTION 07

Data Retention

We keep personal data only as long as we need it. In practice:

→
Account data — as long as your account exists. When you delete it, the account and the data linked to it go, except what we must keep by law.
→
Analytics events — 180 days, then deleted automatically.
→
Payment and subscription records — for the period accounting and tax law requires; the raw payloads from the payment provider are stripped after 30 days and only the ledger entry remains.
→
Referral commission and payout records — for the same period as other payment and accounting records; when a referred account is deleted, the commission line keeps only an unlinked dash in place of that person.
→
Push notification records — 30 days after they expire.
→
Web sessions — 7 days of inactivity.
→
Internal audit records of actions taken on an account — 5 years, because we need them to show what happened to an account and when.
→
On your device — the analytics queue holds events for at most 7 days; the app's own diagnostics are kept at most 30 days and never leave the device (Section 10.3).
→
The optional reason you may give when deleting your account — kept for 24 months, then deleted. When we delete an account we overwrite your name, email address and identifiers, but the internal account record and its identifier stay, so this reason is pseudonymised rather than fully anonymous. We read it in aggregate to understand why people leave; we never use it to contact you.

You may request deletion of your account and associated data at any time.

SECTION 08

Your Rights

You have the right to:

→
Access your personal information.
→
Correct inaccurate information.
→
Request deletion of your data.
→
Withdraw consent for data processing.
→
Export your data in a portable format.
→
Object to processing based on our legitimate interests.
→
Ask us to restrict processing while we resolve a request you have made.
→
Lodge a complaint with the data protection authority of the country where you live or work, or where you believe the problem occurred.

How to ask, and when we answer. Send any request under this section to privacy@ensitics.io, from the email address on your account. If we cannot tell that the request is really yours, we will ask you for something that confirms it — we do that so we never hand your data to someone else. We answer within one month of receiving your request. If the request is complex, or if you have sent several, we may need up to two further months; in that case we will tell you inside the first month and say why. Answering is free. If we cannot do what you asked, we will tell you that and explain the reason.

SECTION 09

Age Restrictions

// 21+ Only

Our platform is intended for users 21 years of age and older. We do not knowingly collect personal information from individuals under 21.

SECTION 10

Mobile Application

This section covers the Ensitics mobile application. Sections 01–09 describe the platform as a whole; where the app works differently from the website, this section applies.

10.1 Purchases and Payments

Subscriptions bought inside the mobile app are sold and processed by the app store you bought them from: Apple through In-App Purchase on iOS, Google through Google Play Billing on Android.

→
Your payment details — card number, billing address and your Apple ID or Google account credentials — are handled entirely by that store. We never receive them, see them or store them.
→
The store sends us a purchase record: which product was bought, when, and whether the subscription is still active. We use it for nothing else.
→
Refunds, cancellations and billing disputes for in-app purchases are handled by that store under its own terms and privacy policy.
→
Stripe processes payments made on our website only. Stripe is not used in the mobile app and receives no data from it.
→
If you installed the app through an invite and later subscribe, the person who invited you earns a commission calculated on our proceeds from the store — Section 03 describes what they can and cannot see. Nothing extra is collected from you for this beyond the referral code mentioned in 10.5.

10.2 Device Identifiers and Purchase History

The app sends us a device identifier and an app installation identifier, together with your purchase and subscription history — which plan you bought, when it started, when it renews or expires, and whether it is currently active. The device identifier is a random value we generate and keep in your device's secure storage: the keychain on iOS and the Android Keystore on Android. It is not Apple's advertising identifier and not the vendor identifier, and on Android it is neither the Google Advertising ID nor the Android ID. The measurement SDKs described in 10.3 read your device's advertising identifier themselves — on iOS only if you allow tracking, on Android the Google Advertising ID — and we never receive it. This information is linked to your Ensitics account. We use it to:

→
confirm that your subscription is active and unlock paid features;
→
restore your subscription when you reinstall the app or sign in on another device;
→
detect duplicate or fraudulent purchases.

10.3 App Analytics

The app records a fixed, closed list of events — app opens, screen views, pricing views, taps on Pro calls to action, prediction views, prediction unlock attempts and referral link opens. We use them only to fix bugs, measure whether a feature does its job and decide what to build next. We collect them by default, on the basis of our legitimate interest in keeping the app working and improving it (Section 2.1), and you can switch this off at any time — see below.

→
This activity is linked to your Ensitics account and is sent to Ensitics servers. On iOS it goes nowhere else. On Android a copy of these events also goes to Google Analytics for Firebase, without your account details — see below.
→
These events are used only by Ensitics and only to produce aggregate statistics. They are not passed to Meta or to any other advertising or analytics platform, and we do not use them to build an advertising profile of you. The one exception is the Android copy sent to Google Analytics for Firebase, described below; it is never passed to Meta.
→
You can switch usage analytics off at any time in the app: Profile → Edit profile → Usage analytics. From then on the app stops recording these events, the events still queued on your device are erased, and our servers stop accepting new ones from your account. If you decline analytics in the cookie banner on the website while signed in, that choice applies to the app as well. On Android, switching usage analytics off also stops both measurement SDKs described below, and the data Google Analytics holds on your device is erased.
→
The iOS app includes the Meta (Facebook) SDK, which tells Meta about app installs, app launches, sign-ups, the start of checkout and subscriptions so we can measure how our advertising performs. Meta can link these events to your device's advertising identifier only if you allow tracking in Apple's prompt; you can change that at any time in iOS Settings → Privacy & Security → Tracking.
→
After you sign in, the iOS app asks Apple for a one-time attribution token (Apple's AdServices framework) and sends it to our servers, which ask Apple whether your install came from an Apple Search Ads campaign. No advertising identifier is read for this; the answer is stored with your account.
→
The Android app includes two measurement SDKs: the Meta (Facebook) SDK and Google Analytics for Firebase. The Meta SDK tells Meta about app installs, app launches, sign-ups, the start of checkout and confirmed subscriptions. Google Analytics for Firebase receives installs and app sessions, sign-ups and sign-ins, the start of checkout, confirmed subscriptions, the Google Play purchases it records by itself, and the copy of in-app events mentioned above. We use this to measure how our advertising on Meta and Google performs. Both SDKs read your device's Google Advertising ID, which you can reset or delete at any time in your Android settings. Android has no system tracking prompt like Apple's, so these SDKs work from the first launch until you switch usage analytics off (see above). We do not give them your name, email address or Ensitics account ID.
→
The app's own crash, hang and performance diagnostics never leave your device. They are stored locally as bounded counters — no stack traces, no personal data — for at most 30 days, are excluded from device backups, and are erased when you log out or delete your account. We do not receive them. This covers our own diagnostics only. The Meta SDK, on iOS and on Android, can send Meta its own crash, hang and error reports when a problem involves the SDK, and on Android the Google components listed below exchange technical data about the app and your device with Google to do their job — for example, to deliver push notifications or to check that the app is genuine. Meta and Google receive this data directly; it is not linked to your Ensitics account.
→
On iOS, the third-party libraries in the app that handle your data are Google Sign-In and the Meta SDK described above. On Android the app additionally uses Google Play Billing (purchases), Firebase Cloud Messaging (push notifications), Google Analytics for Firebase (measurement, described above), Play Integrity (a check that the app and the device are genuine), Play Install Referrer (reading the invite code once, at install) and Google's Credential Manager (sign-in). All of them are Google components. Apart from Google Analytics for Firebase, none of them is an advertising, attribution or cross-app tracking SDK.

10.4 Signing In to the App

The app offers Google sign-in on both platforms, and Sign in with Apple on iOS. Where Sign in with Apple is also offered in the Android app, it opens Apple's sign-in page in your browser and then returns you to the app; Apple passes us the same data as on iOS.

→
Sign in with Google — Google passes us your name, email address and profile picture. Depending on your Google account settings it may also pass a phone number and an approximate, city-level location.
→
Sign in with Apple — Apple passes us your name and email address. Apple lets you hide your real address and share a private relay address instead. If you choose that, we never learn your real email; messages we send still reach you through Apple's relay.

10.5 What the App Collects — Summary

The categories below match both the App Store privacy questionnaire ("App Privacy") and the Google Play Data safety form for this app. All of them except crash data, diagnostics and the Android measurement data are linked to your account. None of them is used to track you across other companies' apps and websites — except that on iOS the Meta SDK can use your device's advertising identifier for this if you allow tracking in Apple's prompt (10.3). On Android, the Google Advertising ID and the measurement events are shared with Meta and Google to measure our advertising (10.3).

→
Email address — sign-in, account, service messages (10.4; Section 01).
→
Name — account profile, from your sign-in provider or the onboarding questionnaire (10.4; Section 01).
→
Phone number — only if your Google account passes one (10.4).
→
User ID — your Ensitics account identifier (Section 01).
→
Device ID — subscription checks, device sessions and restore (10.2).
→
Purchase history — subscription status and restore (10.1; 10.2).
→
Payout details — the PayPal address, bank account or crypto-wallet address you enter when you request a referral payout; passed only to the provider that executes the transfer (Sections 01 and 03).
→
Product interaction — the closed list of in-app events (10.3).
→
Onboarding answers — favourite team, disciplines, how often you bet, your betting style and the bookmakers you use; optional; used to personalise the service (Sections 01 and 02).
→
Advertising data — on iOS, whether an Apple Search Ads campaign led to your install (10.3).
→
Crash data — crash, hang and error reports the Meta SDK can send Meta about itself, on iOS and Android; not linked to your account (10.3).
→
Diagnostics — on Android, technical data about the app and the device that Google components exchange with Google to deliver notifications and check that the app is genuine; not linked to your account (10.3).
→
Advertising identifier — on Android, the Google Advertising ID, read by the Meta SDK and Google Analytics for Firebase and shared with Meta and Google; not linked to your account (10.2; 10.3).
→
App interactions shared with Meta and Google — on Android, installs, launches, sign-ups, sign-ins, checkout starts, confirmed subscriptions, Google Play purchases and the copy of in-app events; not linked to your account (10.3).
→
Other usage data — your referral code, if you installed the app from an invite link (10.3).
→
Other user content — the optional reason you give when deleting your account (10.6).
→
Coarse location — city level, only if passed by your sign-in provider (10.4; 1.2).
→
Other data types — additional data the Google Sign-In library declares when you sign in with Google (10.4).

10.6 Your Rights in the App

Everything in Section 08 applies to the app in full.

→
You can delete your account from inside the app or by writing to privacy@ensitics.io. Deleting your account removes your app activity, device identifiers, picks history, match reminders and onboarding answers from our systems. Data the measurement SDKs (10.3) have already sent to Meta or Google is held by them under their own policies; it is not linked to your Ensitics account, so deleting your account does not remove it from them.
→
If you give an optional reason when you delete your account, we keep it for 24 months to understand why people leave. It stays attached to a pseudonymised internal account record: your name, email address and identifiers are overwritten, but the internal record and its identifier remain. We never use the reason to contact you.
→
The store you bought through keeps its own record of your purchase and we cannot delete it — you manage it in your Apple ID settings or in your Google Play account. Deleting your Ensitics account does not cancel a store subscription: cancel it in Apple or Google Play as well, or it will keep renewing.
→
The app is for users aged 21 and over, the same as the website (Section 09).

SECTION 11

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date.

Languages. This policy is published in English, Russian, Portuguese, Spanish, Polish, German and French. English is the reference version: where a translation differs from it, the English wording is what we mean. This does not take away any right you have under the consumer or data protection law of your own country, and it does not stop you relying on the version in your own language where that law allows you to.

SECTION 12

Who We Are

ENSITICS.IO, société par actions simplifiée (SAS), registered in France under number 928 888 858 (RCS Paris), with its registered office at 1 rue de Stockholm, 75008 Paris, France, is the controller of the personal data described in this policy.

→
Write to us about anything in this policy — including any request under Section 08 — at privacy@ensitics.io, or by post to the address above.
→
We have not appointed a Data Protection Officer, because Article 37 GDPR does not require us to. Responsibility for data protection sits with the founder, reachable at the same address.
→
Our lead supervisory authority is the CNIL (Commission Nationale de l'Informatique et des Libertés), France. That does not limit the right described in Section 08 to complain to the authority in your own country.

Privacy &Rules.