Privacy Policy
Effective Date: September 7, 2026
This Privacy Policy explains how the Bingo Poker AI team ("we", "us", the data controller for the Service) processes personal data when you use Bingo Poker AI (the "Service"). For anything not defined here, see our Terms of Service.
1. Summary
We collect as little as possible: an e-mail address if you sign in, pseudonymised gameplay records used to train and review your decisions, and basic security logs. We do not sell personal data, we run no advertising trackers, and gameplay logs are stored under random identifiers that are not linked to your identity in the same database.
2. Data We Collect
| Category | What it includes | Source | Purpose |
|---|---|---|---|
| Account data | E-mail address; authentication identifiers | You (via Google sign-in or magic link), processed through Supabase Auth | Creating and signing you into your account; sending sign-in e-mails |
| Gameplay records | Decisions, actions, and outcomes of practice hands against AI opponents, tied to a random in-app identifier (user_ref) | Generated as you use the Service | Displaying your history, reviews, ratings, and progress; product analytics in aggregate |
| Payment status | Subscription plan and entitlement state | Our merchant of record, Paddle (or Creem) | Enabling paid features. Card numbers are never sent to us — payments run entirely on Paddle's/Creem's checkout |
| Security logs | IP address, request timestamps, user agent | Server infrastructure | Preventing abuse, rate limiting, debugging |
| Support data | Whatever you choose to include in feedback or support e-mails | You | Answering and improving the Service |
We do not collect: advertising identifiers, contacts, precise location, or biometric data. Gameplay logs contain no phone numbers, third-party account IDs, or device serial numbers.
3. Legal Bases (GDPR/UK)
Performance of a contract (account, gameplay, payment status); legitimate interests (security logs, aggregate product improvement); consent (optional e-mails you request). You may object to legitimate-interest processing at any time (Section 8).
4. Retention
- Raw gameplay logs: 24 months. After that, only aggregated statistics (e.g., heatmap distributions no longer tied to a user_ref) are kept.
- Account data is kept while your account is active. After account deletion it is erased from live systems within 30 days, except where law requires longer storage (e.g., payment records, which Paddle retains under its own compliance obligations).
- Security logs are kept up to 12 months.
5. Sharing and Processors
We never sell your data. We share it only with:
- Supabase (authentication; hosted on AWS, United States) — account e-mail and auth identifiers;
- Resend (e-mail delivery) — your e-mail address, to send sign-in links;
- Paddle / Creem (merchant of record for payments, global tax compliance) — purchase and subscription data;
- Cloud/hosting providers operating our servers (United States).
These providers process data on our instructions under their own privacy and security terms (linked in Section 12).
6. Cookies and Tracking
The Service uses only what is technically necessary: session/login tokens and security preferences. We use no advertising cookies and no third-party analytics trackers.
7. International Transfers
We operate from outside the EU/UK, and our providers host primarily in the United States. Where required, transfers rely on appropriate safeguards such as the EU Standard Contractual Clauses offered by our processors.
8. Your Rights
Depending on your residence (EU/UK GDPR, California CCPA/CPRA, and similar laws), you may request: access, correction, deletion, data portability, restriction, objection, and confirmation that we do not sell personal information (we do not, and do not process California opt-out signals because we engage in no sale or sharing for cross-context advertising).
How to exercise: e-mail support@bingge.ai, or use in-account deletion. California residents may also use an authorised agent. We respond within 30 days.
9. Children
The Service is not directed to anyone under 18, and we do not knowingly collect their data. If you believe a minor has an account, contact us and we will delete it.
10. Security
Encryption in transit (HTTPS/TLS) and at rest for sensitive stores; least-privilege access; pseudonymised gameplay records (the identifier linking user_ref to your identity is stored separately from the logs).
11. Changes
We will post any updated Policy here with a new effective date and announce material changes in advance (in-app or by e-mail).
12. Contact
Bingo Poker AI — support@bingge.ai
Processor policies: Supabase (supabase.com/privacy) · Resend (resend.com/legal/privacy) · Paddle (paddle.com/legal/privacy) · Creem (creem.io/privacy)