Privacy Policy
Effective 22 October 2026
This policy explains what personal information PingOdds collects, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to pingodds.com, the PingOdds API, the PingOdds MCP server and our emails (together, the "Service").
1. Who we are
PingOdds is a sole proprietorship based in Ontario, Canada. We are responsible for the personal information described here (under the GDPR, we are its "controller"). Our privacy contact, who is accountable for how we handle personal information, can be reached at [email protected].
The odds and other sports data the Service provides are not personal information.
2. What we collect
Your account
- Your name and email address, which you give us when you sign up.
- Your password, stored only as a salted hash (scrypt). We can't read it.
- If you sign in with Google: the name, email address and profile picture from your Google account, and the sign-in tokens Google issues, which we store encrypted.
- The date your account was created, your plan, and which version of our Terms you accepted and when.
Sign-in sessions
- When you sign in, the IP address and browser (user agent) of that session. We use these for security and to stop abuse.
Billing (paid plans)
- Your Stripe customer and subscription identifiers, your subscription status and the end of your current billing period.
- Your card details go directly to Stripe through its payment form and never reach our servers. When we show your card in the portal, we fetch its brand, last four digits and expiry date from Stripe; we don't store them.
API, AI agents and webhooks
- For each API request or stream subscription: the time, which key made it, the endpoint (without your query parameters), the status and the response time.
- For each AI agent tool call: the time, which key made it, the tool, whether it succeeded and the response time.
- We don't record IP addresses or request parameters for API requests or AI agent calls.
- Your keys, stored only as one-way hashes plus their last four characters, so we can't show a key again after creating it.
- For webhooks: the URLs you register, their signing secrets and filters, and a record of each delivery (time, status code and attempts).
Support and logs
- What you send us when you contact support.
- Technical server logs. They record errors, not your ordinary requests, but an error about sending you an email can include your email address.
3. What we don't do
- We don't use analytics or advertising trackers, and we don't put third-party tracking pixels on our pages.
- We don't sell or rent personal information, or share it for targeted advertising.
- We don't send marketing email. We only email you about your account and the Service: verifying your address, getting started, security notices (new keys, password changes, account deletion), billing and price changes, usage alerts when you near your plan's limits, and important changes to our Terms or this policy. If we ever offer a newsletter, it will be opt-in.
4. How we use it, and our legal bases
| Purpose | Information | Legal basis (GDPR / UK GDPR) |
|---|---|---|
| Running your account and providing the API, stream, webhooks and AI agent access | Account, keys, webhooks | Performing our contract with you |
| Counting usage, enforcing plan limits and showing your usage in the portal | Usage records | Performing our contract with you |
| Billing, invoices and tax records | Billing information | Performing our contract; complying with legal obligations |
| Keeping the Service and accounts secure, and preventing fraud and abuse | Sign-in sessions, logs, usage records | Our legitimate interest in a secure, reliable Service |
| Account and Service emails, and support | Name, email, support messages | Performing our contract; our legitimate interest in helping you |
| Complying with the law and enforcing our Terms | As needed | Legal obligations; our legitimate interests |
Under Canada's privacy law (PIPEDA), we collect, use and disclose personal information with your consent, which you give by creating an account and using the Service, and only for purposes a reasonable person would consider appropriate.
To help with support, a PingOdds administrator can view your account details and usage and, when needed, sign in as you to see what you see. Every such action is logged.
5. Who we share it with
We share personal information only with service providers that process it on our behalf:
- Stripe handles payments and invoices (United States and other countries).
- Resend sends our account emails (United States).
- Google, only if you choose to sign in with Google.
- Our hosting provider runs our servers and storage in Canada.
We may also disclose information when the law or valid legal process requires it, to protect the rights and safety of our users, the public or the Service, or to a successor if the business is sold or reorganised, in which case this policy continues to apply.
6. Where it's stored, and international transfers
Our servers and database are in Canada. Stripe, Resend and Google may process information in the United States and other countries. The European Union and the United Kingdom recognise Canada as providing adequate protection for personal information handled by businesses. Transfers to our US service providers rely on their safeguards, such as the EU Standard Contractual Clauses or the EU–US Data Privacy Framework and its UK extension. Information processed outside Canada may be accessible to authorities there under local law.
7. How long we keep it
| Information | How long |
|---|---|
| Account, keys and webhooks | Until you delete your account |
| Sign-in sessions (IP address, browser) and password-reset links | While valid (a session lasts up to 7 days and renews while you use the portal), then deleted within about 30 days |
| API and AI agent usage records | 400 days, or until you delete your account |
| Webhook delivery records | 30 days |
| A record of which account emails we sent (the kind and when; no address or content) | 90 days |
| Server logs | Until newer logs replace them (log files are capped in size) |
| Billing records (invoices and payments, held at Stripe) | As long as tax law requires, generally six years in Canada |
| Records of administrator actions on your account | Kept for security and accountability |
| Support emails | As long as needed to deal with your request |
8. Cookies and similar technologies
better-auth.session_token(named__Secure-better-auth.session_tokenon secure connections) keeps you signed in. It expires after 7 days, renews while you use the portal, and is removed when you sign out.better-auth.admin_session(__Secure-better-auth.admin_sessionon secure connections) is set only while a PingOdds administrator is signed in as a customer for support.better-auth.state(with the same prefix on secure connections) is set for up to 5 minutes while you sign in with Google, to protect the sign-in from forgery.- Our billing page loads Stripe.js, which sets its own cookies to prevent fraud. See Stripe's privacy policy.
- The API reference at api.pingodds.com/docs loads fonts from Google Fonts and its viewer from Redocly's content network. Those providers receive your IP address and browser details when the page loads.
These cookies are strictly necessary for the Service to work, so we don't ask for cookie consent. We don't use analytics or advertising cookies.
9. Your rights
Depending on where you live, you have the right to:
- access the personal information we hold about you and get a copy of it, including in a machine-readable format;
- correct information that is wrong;
- delete your account and its data (see section 10);
- object to, or ask us to restrict, processing based on our legitimate interests;
- withdraw your consent, which may mean closing your account.
To make a request, email [email protected] from the address on your account. We may need to confirm your identity. We respond within 30 days, and will tell you if we need longer where the law allows it. We won't treat you differently for exercising your rights.
Please contact us first if you have a concern. You can also complain to the Office of the Privacy Commissioner of Canada, to your provincial privacy commissioner, or, in the EU or UK, to your local data protection authority (in the UK, the Information Commissioner's Office).
If you live in California or another US state with a privacy law: we don't sell personal information, share it for cross-context behavioural advertising, or use sensitive personal information to infer characteristics about you.
10. Deleting your account
- You can delete your account at any time on the Account page of the portal. This immediately deletes your account, sign-in records and sessions, keys, webhooks and their delivery records, and your API and AI agent usage records. Any subscription is cancelled at once, without a refund (see our Terms).
- We keep billing records at Stripe as tax law requires, and records of administrator actions on your account, which identify your account and can include notes an administrator wrote, such as the reason for a ban. Your saved cards are removed from Stripe. Copies in server logs remain until newer logs replace them.
- A key keeps working for up to a minute after deletion, and a live stream that is already open keeps running until it disconnects. Records of requests made in that time, and of webhook deliveries already under way, are removed automatically within about an hour.
- If you can't sign in, email us from your account's address and we will delete it for you.
11. Security
All connections to the Service use HTTPS. Passwords are stored as scrypt hashes and keys as one-way argon2id hashes, card data is handled only by Stripe, and access to our production systems is limited to PingOdds administrators, whose actions on customer accounts are logged. No system is perfectly secure; if a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.
12. Children
The Service is not for anyone under 18 or under the age of majority where they live, and we don't knowingly collect personal information from them. If you believe a minor has given us personal information, contact us and we will delete it.
13. Changes to this policy
We may update this policy. We will post the new version here with a new effective date, and email you at least 30 days before a material change takes effect.
14. Contact
Questions or requests about your privacy? Email [email protected].