Privacy Policy

Version 2026-09-27. How Grecotipster handles your personal data, under the EU General Data Protection Regulation (GDPR) and Greek law 4624/2019.

1. Who is responsible

The data controller is the operator of Grecotipster:

2. What we collect

• Your account: email address; your password, stored only as a salted one-way hash (we cannot read it); your plan; when you signed up; and your confirmation that you are 21 or older and accepted these texts, with the version and time.
• My Bets: the budget and the bets you choose to record in your private tracker. Nobody else sees them, and they are never combined with other users' data or published.
• The live channel (only if you connect it): your Telegram user ID and display name, so we can admit you to the channel and remove access when a plan ends.
• Subscriptions (once paid plans open): your plan and its dates, and for each payment the amount, VAT, your name, email and billing country, and the receipts we issue. We never receive your full card number or security code — our payment provider, Whop, handles them on its own secure page and tells us only the card type and last four digits, which are printed on your receipts.
• Technical data: your IP address, browser type and the pages requested, which pass through our network provider and appear in our server logs; and, when something breaks, an error report. Your IP address is also checked against a country table held on our own server to choose the site's language — nobody else is involved.

We do not collect special categories of data, we do not buy data about you, and we do not use advertising or analytics trackers.

3. Why we use it, and on what legal basis

• To provide the service you signed up for — your account, signals, My Bets, the live channel, your subscription and receipts, and emails about them (performance of a contract, GDPR Art. 6(1)(b)).
• To keep accounting and tax records of payments and receipts, and to meet age and consumer-law obligations (legal obligation, Art. 6(1)(c)).
• To keep the service secure and working — preventing abuse and fraud, and finding and fixing errors (legitimate interests, Art. 6(1)(f)). You may object to this at any time.

What you must give us, and why. An email address and a password are needed to create an account; your billing details are needed to take a paid plan, because the contract and Greek tax law require them. Without them we cannot provide that part of the service — everything else is optional.

We send no marketing email without your separate consent, we never sell your data, and we make no automated decisions about you that have legal or similarly significant effects.

4. Who else receives it

Service providers that process data on our behalf, each bound by a data-processing agreement:

• Oracle Cloud Infrastructure — hosts the server and database, in Stockholm, Sweden (EU).
• Cloudflare — delivers and protects the site; sees your IP address and the requests your browser makes.
• Sentry — error monitoring, stored in the EU (Germany), configured not to collect personal data.
• Our email provider — once paid plans open, to deliver receipts. It is named here before it receives any data.

Other recipients, who decide for themselves how they handle data:

• Telegram — only if you choose to join the live channel. Telegram is an independent controller; its own privacy policy applies to your use of Telegram.
• Whop, Inc. (300 Kent Ave #401, Brooklyn, New York 11249, USA) — our payment provider, when you subscribe. You enter your email, name, card and billing address on Whop's own checkout page; Whop charges your card, handles renewals, refunds and chargebacks, and acts as merchant of record for the card payment. We give Whop only your account number with us and the plan you chose, so that your payment reaches your account. Whop handles payment data under its own privacy policy (whop.com/privacy), and its checkout page uses its own cookies and scripts, including for fraud prevention and advertising — none of which run on our pages.
• Our accountant and the tax authorities — billing records, as the law requires.

Transfers outside the EU: Cloudflare, Sentry and Whop are US companies. Where data reaches the United States it is protected by the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as applicable.

5. How long we keep it

• Account and consent records: while your account exists; deleted within one month of your request to close it, except what we must keep by law.
• My Bets: until you reset it (the reset button on that page) or close your account.
• Payment records and receipts: for as long as Greek tax law requires (generally at least five years after the end of the tax year).
• Server logs: 14 days. Error reports: up to 90 days.

6. Your rights

You have the right to access your data, have it corrected, erased or restricted, to receive it in a portable format, to object to processing based on legitimate interests, and to withdraw any consent at any time. Contact us using the details in section 1; we answer within one month. There is no charge.

You may also complain to the Hellenic Data Protection Authority — Kifissias 1–3, 115 23 Athens, Greece · dpa.gr · [email protected] — or to the authority in the EU country where you live.

7. Cookies

We use only cookies that are strictly necessary for the service you ask for, so no consent banner is needed. No advertising, analytics or third-party tracking cookies. Whop's checkout page, when you subscribe, is Whop's own and sets its own cookies under its own policy.

8. Age

Grecotipster is only for people aged 21 and over. We do not knowingly hold data about anyone younger, and we delete an account as soon as we learn it belongs to someone under 21.

9. Security

Passwords are stored as salted hashes, the whole site is served over HTTPS, access to data is restricted, and full card numbers never reach our systems. If a breach ever put your rights at high risk, we would tell you and the authority as the GDPR requires.

10. Changes

If this policy changes, the version date at the top changes with it, and we tell account holders about any significant change before it applies.