Privacy policy

The controller of personal data for Dobitka users is Mateusz Rutkowski Testy, Kraków, Poland, NIP: 7962790612, REGON: 381659867.

Privacy contact: rodo@dobitka.pl.

• Account email, optional nickname and favourite club.
• Adult confirmation timestamp and terms acceptance audit.
• Match setups: lineup, formation, playing style and changes.
• Simulation results, points, rankings and tournament picks.
• Payment metadata handled through Stripe; card data is not stored by Dobitka.
• Transactional email delivery data through Resend.
• Technical data such as hashed IP, user agent, CSRF/session data and security logs.

• GDPR art. 6(1)(b): account, simulation and digital service delivery.
• GDPR art. 6(1)(a): optional consent and 18+ declaration.
• GDPR art. 6(1)(c): accounting, tax and legal obligations.
• GDPR art. 6(1)(f): security, abuse prevention, rate limiting and fraud prevention.

• Account data: until account deletion.
• Setups and simulation results: through the relevant football season, then aggregated where possible.
• Payments and invoices: for the required accounting retention period.
• Hashed IP and request metadata: up to 30 days.
• Server logs: according to provider retention policies.

Dobitka uses Vercel, Supabase, Stripe, Resend, Anthropic, a model service host, Upstash and API-Sports/API-Football. These services process only the data needed for hosting, authentication, simulation, email, payments, security or football data.

Under GDPR you may request access, correction, deletion, restriction, portability, objection and withdrawal of consent where applicable. You may also lodge a complaint with the Polish data protection authority.

Dobitka is intended for adults, 18+. If we learn that an account belongs to a minor, the account and related personal data will be removed.

We may update this policy. Material changes are communicated by email to active users or by an in-product banner in advance.