1. General Information

This policy describes how SERWIN collects, uses and protects your personal data in accordance with EU Regulation 2016/679 (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and applicable international privacy laws.

It is important to read this policy before using the service. By using SERWIN, you agree to the practices described in this document.

2. Data Controller

SERWIN — Sports Prediction Simulator
Headquarters: Italy
Email: privacy@serwin.net
Website: www.serwin.net

Server: OVH VPS — Frankfurt, Germany (European Union)

Note for international users:
This service complies with the GDPR (European Union), CCPA/CPRA (California) and other privacy laws applicable in your country of residence.

3. Data Collected

Data provided by the user:

• Name (username)
• Email address
• Password (stored in encrypted form, never in plain text)
• Country of residence and time zone
• GDPR consents (privacy, terms, marketing) with timestamp and IP address

Data collected automatically:

• IP address at the time of registration
• Device type, operating system and app version
• Usage data: predictions created, interactions, reactions
• Performance statistics: accuracy, credits, tipster level
• Device token for push notifications
• System logs for security and debugging
• App version and operating system (iOS/Android) — automatically detected at login
• Viewed match state history (anonymous technical data, retained for 30 days)

Data we do NOT collect:

• Payment details (handled exclusively by Google Play / App Store)
• Sensitive data (ethnic origin, political opinions, health data)
• Information relating to criminal convictions or offences

4. Purposes and Legal Basis for Processing

Performance of a contract:

• Account creation and provision of the service
• Management of virtual credits and leaderboards

Legitimate interest:

• App security and prevention of misuse
• Anonymous statistical analysis to improve the service
• Performance monitoring and error correction

Explicit consent:

• Push notifications
• Marketing communications
• Personalised advertising (Google AdMob)
• Profiling for relevant advertising

Legal obligations:

• Compliance with tax obligations or requests from competent authorities

5. Third-Party Services

• VPS Germany (EU): backend and database hosting — all data remains within the EU
• AWS S3 (USA): user avatar storage — data transfer covered by the EU-US SCCs/Data Privacy Framework
• Expo Push Notifications: push notifications via anonymous device tokens
• PHPMailer / SMTP: transactional emails (account verification, password reset)
• Google AdMob: in-app advertising — requires explicit consent on first launch
• Google Play / App Store: in-app purchases and subscriptions — SERWIN never accesses payment details
• API-Football: real-time sports data — no personal data shared, only technical queries

The service may contain links or references to third-party websites and services. SERWIN is not responsible for the privacy practices of such external services.

6. Advertising and Profiling

SERWIN uses Google AdMob to display advertisements. Consent is requested on first launch via a dedicated banner.

Subject to your explicit consent, we may carry out anonymous profiling of your activity within the service in order to display more relevant advertisements. Such profiling does not allow for the direct identification of the individual.

You may opt out of advertising profiling at any time:

• By contacting privacy@serwin.net
• Via your device's privacy settings
• iOS: Settings → Privacy → Advertising
• Android: Settings → Privacy → Ads

7. Transfer of Data Outside the EU

Data is stored on servers located in Germany (European Union).

The use of AWS S3, Google AdMob and the Google/Apple app stores involves the transfer of certain data to the United States. This is carried out in accordance with the Standard Contractual Clauses (SCCs) approved by the European Commission and the EU-US Data Privacy Framework, ensuring a level of protection equivalent to that in Europe.

In the event of a merger, acquisition or sale of the business, user data may be transferred to the new data controller, who will be bound by this policy and must ensure the same level of protection.

8. Cookies and Tracking Technologies

We use tracking technologies for:

• Essential functionality: login, app security, session management
• Preferences: language, time zone, UI settings
• Push notifications: anonymous device token (Expo)
• Advertising: Google AdMob — only with your explicit consent

You can manage your preferences via the consent banner when you first launch the app or via your profile settings.

9. Data Retention

• Account data: until the user requests deletion
• Bet history: 125 days
• Security logs: 12 months
• Operational logs: 7–14 days
• Notifications: 20–60 days depending on status

Deletion requests are processed within 30 days of receipt. We may retain certain data for a longer period where required by legal or regulatory obligations.

10. User Rights (GDPR & CCPA)

For all users:

• Right of access: to know what data we hold
• Right to rectification: to correct inaccurate data
• Right to erasure: to have your account and associated data deleted
• Right to data portability: to receive your data in a structured format
• Right to object: to object to processing for marketing or profiling purposes
• Right to withdraw consent: withdraw consent at any time
• Right to restriction: request restriction of processing
• Account deletion: directly from the app (Profile → Settings → Delete Account) or by writing to privacy@serwin.net

For users in California (CCPA/CPRA):

• Right to opt out of the sharing of data for behavioural advertising
• Right not to be discriminated against for exercising your rights

To exercise any of these rights: privacy@serwin.net

11. Data Security

• Passwords stored in encrypted form (bcrypt hash)
• Encrypted communications via HTTPS/TLS
• Authentication using dual JWT tokens (auth_token + refresh_token)
• Rate limiting on all APIs to prevent abuse
• Access logs and audit trails to detect anomalous activity

In the event of a data breach, we will notify affected users and the relevant authorities within the timeframes set out in applicable legislation.

12. Protection of Minors

SERWIN is intended for adults (18+). We do not knowingly collect data from minors. If a parent discovers that their child has created an account, they may contact us to request its immediate deletion at privacy@serwin.net.

13. Simulated Nature of the Service

SERWIN is a sports prediction SIMULATOR.

• We do NOT handle real-money betting
• Credits are VIRTUAL and have no monetary value
• Service provided for educational and entertainment purposes
• No connection with bookmakers or real betting sites

14. Changes to the Policy

We reserve the right to amend this policy. Users will be notified of significant changes via an in-app notification. Continued use of the service following the publication of changes constitutes acceptance of the new policy.