Legal documents are provided in English; the English version is the controlling one.

Privacy Policy

Effective date: 21 October 2026 · Version 2026-10-21 · Replaces version 2026-10-15

This Policy explains which personal data mariobets processes, why, on which legal basis, who receives it, how long we keep it and which rights you have. It is written to meet the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the Italian Personal Data Protection Code, the UK GDPR and the Swiss Federal Act on Data Protection.

In plain words.

• We collect only what the Service needs. Most of it you give us yourself.
• We never sell your data and never share it with bookmakers or any other gambling operator.
• On the pages for members there are no ads, no tracking cookies and no analytics services of other companies. On our public pages, Google Analytics and Google's ads run only if you agree to them, and ads are never personalised (section 2.18).
• We count visits to our pages ourselves, in totals only: the counts set no cookie, keep no IP address and tell no visitor apart (section 2.18).
• My record, the list of bets you log, is used to show it to you and to keep your public record of the entries you share (an entry logged in the app is shared by default). Other members see that public record only if you make your profile public.
• A few features use artificial intelligence; we tell you which, and the text they produce is labelled.
• You can see, download, correct and delete your data, mostly by yourself in Profile.

1. Who is responsible for your data

1.1 The controller is [LEGAL ENTITY NAME], [REGISTERED ADDRESS], Italy ("we", "us"). Write to privacy@mariobets.xyz for any question about your data or to exercise your rights.

1.2 We have not appointed a data protection officer: our processing does not require one (Article 37 GDPR). Write to privacy@mariobets.xyz.

1.3 Representative in the United Kingdom (Article 27 UK GDPR): not appointed; UK residents write to privacy@mariobets.xyz. Representative in Switzerland: none is required (Article 14 FADP: no large-scale processing).

2. What we process, why, and on which legal basis

Each part below says which data, why we use it, the legal basis under Article 6 GDPR, and how long we keep it.

2.1 Visiting mariobets

• Data: the IP address, browser and device information that every browser sends with a request, the page requested and the time.
• Why: to deliver pages and to protect the Service from abuse, for example by limiting repeated attempts.
• Legal basis: legitimate interests in running a secure website (Article 6(1)(f)).
• How long: our servers write technical logs of requests (time, IP address, address requested, result) and of errors, and, for each email we send, the recipient's address, the subject and whether it was delivered. Each part of the Service keeps only its most recent 100 MB of logs; older lines are deleted automatically as new ones are written.

2.2 Requesting access

• Data: your email address, your Instagram username, your optional message, the referral code you used (if any) and who it belongs to (no referral reward is given at present), your interface language, your IP address, the dates of the request, the verification code we give you (the one you place in your Instagram bio), the link you use to follow your request (we store only a hash of it), the status of the request, who on our team checked it, our decision and any short note on it, and the invitation code we send you.
• Why: to check that you are a real person and control the Instagram account you gave us, to prevent duplicate or fake accounts, to decide on your request and to send your invitation.
• How we check: you place the verification code in your Instagram bio, and a person on our team opens your public Instagram profile to see it. We collect nothing else from Instagram and use no Instagram or Meta interface. You can remove the code once your request is verified.
• Legal basis: steps you ask us to take before a contract (Article 6(1)(b)), and legitimate interests in keeping the community made of real people (Article 6(1)(f)).
• How long: a request is kept while we decide on it; after a decision, we delete it by hand within 12 months. When you join, your verified Instagram username moves to your account.

2.3 Your account

• Data: email address, username, password (stored only as a salted argon2id hash, never in readable form), email verification status, a new email address you asked to switch to (until you confirm it), interface language (the language of your sign-up — the language the form was filled in, or, when the form does not say, the language of your access request or, failing that, the first of our languages your browser asks for — which we use for the emails, alerts and digests we send you; you can change it in Profile), time zone, the invitation code you used and who created it, who referred you (if anyone), your verified Instagram username, the date the account was created, and the record of what you accepted at sign-up and when a new version of our legal texts was published (document, version, date and time, IP address), including your confirmation that you are 18 or older.
• Why: to create and run your account, and to be able to prove what you accepted.
• Legal basis: contract (Article 6(1)(b)); for the acceptance records, legal obligations and legitimate interests in being able to prove them (Article 6(1)(c) and (f)).
• How long: while your account is open; after that, see section 7.

2.4 Sign-in and security

• Data: session records (a hashed token, IP address, browser information, expiry), sign-in history (time, IP address, browser, outcome), passkeys (a public key, the name you give the passkey, when it was added and last used, and technical details — never your fingerprint or your face, which stay on your device), short-lived sign-in challenges, backup codes (hashed), one-time email codes (hashed, with the number of attempts), whether two-step sign-in is on, security alerts, and audit records of sensitive account actions (who, what, when, result), which include your email address.
• Why: to keep accounts secure, to detect and stop abuse, and to tell you about sign-ins from new places.
• Legal basis: contract and legitimate interests in security (Article 6(1)(b) and (f)).
• How long: sessions expire after 7 days; email codes expire after use or within a short time; sign-in history is kept while your account is open; audit records, see section 7.

2.5 Your setup and preferences

• Data: your country of residence, your experience level, favourite leagues and teams, the bookmakers you chose, your odds format, the date you completed this setup, your time zone, your notification and alert settings (which alerts are on, the minimum gap from the fair price, the price range and the markets they watch), your avatar and bio, whether your profile is public, and — only if you enter them — your bankroll and staking-calculator settings.
• Why: to show the Service the way you asked, and to apply the rules of your country, which decide among other things which bookmakers may be named to you. Until you choose a country, we infer one from your interface language; this only ever narrows what is shown.
• Legal basis: contract (Article 6(1)(b)); for your country, also our legal obligations under the rules on gambling advertising (Article 6(1)(c)).
• How long: while your account is open, or until you change them.

2.6 My record

• Data: the bets you log (match, market, selection, stake, price, bookmaker, date, status, payout, notes and how the entry was made — by hand or from a slip photo), entries grouped into one accumulator, whether you shared an entry (an entry logged in the app is shared by default, whatever your profile setting; an imported history is not), how it was settled, the figures we compute for them (closing price, fair closing price, CLV, model probability), when we sent you the closing-price notice for it, and your personal accuracy page. For each entry we also store the check of the verified record: whether it was verified and, if not, why (for example: imported from a file, logged after kickoff, or at a price above what the market offered), how it was written (one tap on a match page, the entry form, a slip, a file import), the fixture and kickoff it was checked against, the best price our odds data held at that moment, and when the check ran. The check is computed from the entry itself and from our own odds data: it adds no new personal data about you.
• Why: to show you My record and your statistics, and to show on your public record (section 2.7) which shared entries are verified.
• Legal basis: contract (Article 6(1)(b)).
• How long: until you delete the entry or your account. Deleting an entry deletes it.
• Confidentiality: My record is never shared with anyone, never used for marketing and never used to build a profile for a bookmaker or any other third party. Only the entries you share are shown (an entry logged in the app is shared by default), and only if your profile is public, to the members you allow.

2.7 Community features

• Data: if you make your profile public — your username, avatar, bio, follower counts, the entries you share (as results in units, never amounts of money), whether each one is verified and, if not, why, and your place on the leaderboard; who you follow and who follows you. Even when your profile is private, other members can see your username and avatar.
• Why: to let members compare records, as you chose.
• Legal basis: contract — a feature you switch on and off (Article 6(1)(b)).
• How long: while your profile is public; when you make it private, it leaves the public views. You can un-share or delete any entry at any time.

2.8 Notifications and service emails

• Data: your email address; for browser notifications, the subscription your browser gives us (an address at your browser's push service, encryption keys), your browser's name, the date of the last successful delivery and the number of failed ones; for Telegram, your Telegram chat identifier and, while you link it, a one-time link code; your notification settings; the price alerts you set on a match (match, market, selection, target price, and when and at which price and bookmaker it was reached); your market-signal alert rules (type, parameters, channels); a record of the alerts we sent you (match, market, selection, time), so that none is sent twice; for the news digest, its frequency, number of items, minimum relevance, sources, language, a token for the unsubscribe link and the date it was last sent; for the weekly recap of your own record, whether it is on, when you last changed that switch and the last week we sent it for; delivery status.
• What the providers see: each email, browser notification or Telegram message carries its text (for example a match, a market and a price; for the weekly recap, that week's figures from My record) to the provider that delivers it (section 5). Browser notifications are encrypted so that the push service cannot read them.
• Why: to send the emails the Service needs (verification, password reset, sign-in codes, security alerts), the closing-price notice for the bets you log once you open a channel, and the alerts, digests and weekly recap you turn on.
• Legal basis: contract (Article 6(1)(b)); for security alerts, also legitimate interests in security (Article 6(1)(f)).
• How long: until you turn the channel off or delete your account. Every digest and every weekly recap contains a link to turn it off.

2.9 Marketing emails — only if you agree

• mariobets news: if you tick the box, we may email you news about mariobets. Legal basis: your consent (Article 6(1)(a)). You can withdraw it at any time in Profile or through the link in each email; we keep the record of when you gave it.
• No partner offers: we have no partners, no affiliates and no third-party offers, so we never ask for consent to share your contact details with anyone for marketing, and we share nobody's data for marketing. We will never share your data with a bookmaker, a betting exchange or any other gambling operator. If this ever changed, we would name each partner in this Policy first and ask for a new, separate consent; nobody would be included without it.

2.10 Subscriptions and payments — when paid plans are active

• Data: your Stripe customer and subscription identifiers, plan, status, use of the free trial, billing dates, cancellation status and payment history; when the subscription started, whether you asked at checkout for the service to start during the withdrawal period, and, if you withdraw, when we received your withdrawal and what we refunded. Stripe collects your card details directly; we never see your full card number.
• Why: to take payments, manage your subscription and keep the accounting records the law requires.
• Legal basis: contract (Article 6(1)(b)) and legal obligations on tax and accounting (Article 6(1)(c)).
• How long: subscription data while your account is open; accounting records for 10 years (Article 2220 of the Italian Civil Code).
• Stripe processes payment data for us and, for its own fraud prevention and legal duties, also as an independent controller under its own privacy policy.

2.11 Referrals and free access

• Data: your referral code, the requests made with it and the people who joined with it (no referral reward is given at present), any free days granted and the date your free access ends; if we give you free access ourselves, your email address on our list of free accounts, with a short internal note on why.
• Legal basis: contract (Article 6(1)(b)).
• How long: while your account is open.

2.12 Features that use artificial intelligence

• Reading a betting slip: if you upload a photo of a slip, the image is sent to Anthropic, our AI provider, which transcribes the printed text. The result is a draft that you check and correct before anything is saved. We do not keep the image. A slip may show personal details such as a name or an account number: please crop them out before uploading. Legal basis: contract — a feature you choose to use (Article 6(1)(b)).
• News digests and explanations: AI summarises football headlines (the publishers' headlines and source names only) and explains why a model figure may be unreliable (match data only). No personal data about members is sent for these, and the digest is written in the language you read the page in.
• AI match previews: AI writes short previews of upcoming matches from our fixture data only. No data about members is sent.
• Ask mariobets: to answer, your question and its language are sent to Anthropic, with the earlier questions and answers of the same conversation; if you ask about your own record, also a summary of it (the number of entries, how many are settled and open, your average CLV and its interval), never anyone else's data. Nothing is stored: the conversation lives in your browser tab and is gone when you reload. To apply the limits we keep a pseudonymous count of your questions of the day and of the AI cost of your questions in the month (under a code derived from your account, not your account itself), deleted once the day or the month is over, and an anonymous monthly count of how questions were answered. While the Predictions (Pronostici) section is offered, a question recognised by its words as being about the section or its accumulator calculator (for example one that names them) gets a fixed answer, written in advance, with no AI call; any other question is sent as described above. Legal basis: contract — a feature you choose to use (Article 6(1)(b)).
• What AI is never used for: making decisions about you, profiling you, recognising emotions or writing predictions. No decision that has legal or similarly significant effects on you is taken solely by automated means (Article 22 GDPR).
• Labels: text generated by AI is labelled as such where it is shown, in line with Article 50 of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689).
• Anthropic acts as our processor under its commercial terms, which exclude the use of our inputs and outputs to train its models.

2.13 Contact form and messages to us

• Data: your email address, the subject, your message, and your IP address (used only for a short-term limit on the number of messages, never stored with the message). The message is not stored in our database: it is delivered by email (through our email provider) to our mailbox, with your address as the reply address.
• Why: to answer you.
• Legal basis: legitimate interests in answering the people who write to us, or steps before a contract (Article 6(1)(f) or (b)).
• How long: as long as needed to handle your request, and at most 24 months.

2.14 Well-being tools

• Data: the end date of a break you start, your weekly limit, any pending change to it and when that change takes effect; the stakes you logged this week are read from My record to show how much of the limit is used; and the budgets you enter in the accumulator calculator (section 2.16), which count against the same limit.
• Why: to apply the tool you chose.
• Legal basis: contract (Article 6(1)(b)).
• How long: while your account is open. Never shared and never used for marketing.

2.15 Footballers, coaches and referees

• Data: names, clubs, statistics and availability (injuries, suspensions) as published by clubs, competitions and the media; names and statistics of referees.
• Why: football information.
• Legal basis: legitimate interests and the freedom of information (Article 6(1)(f) and Article 85 GDPR); information about injuries only as it has been made public (Article 9(2)(e)).
• Your rights: if this concerns you, you can object at privacy@mariobets.xyz.

2.16 Predictions and the accumulator calculator

• Data: we keep the budgets you enter in the accumulator calculator (the largest in each 30-minute session, how many times you calculated and when), only to count them against your weekly limit; the calculation itself and the selections you save for it are kept only in your browser tab. Predictions are the same for every member; the country you chose decides which bookmaker may be named in a prediction's price detail.
• Why: to apply the weekly limit the calculator needs (section 2.14) and to show the section for your country.
• Legal basis: contract (Article 6(1)(b)).
• How long: while your account is open.

2.17 The forecast lab

• Data: the probabilities you give for a match, when you gave them and last changed them, their score after the result, and your place in the lab ranking (shown to other members with your username only if your profile is public). Once a match has started, members may see the average of the members' forecasts on it, never one member's forecast.
• Why: to run the game you chose to play.
• Legal basis: contract — a feature you choose to use (Article 6(1)(b)).
• How long: until you delete a forecast (possible before kickoff) or your account.

2.18 Visit statistics, Google Analytics, Google's ads and Search Console

Our public pages are the home page, the request for access, the legal pages and the contact page; the pages for members are the ones you reach once signed in. The cookies involved, with their names and durations, are listed in the Cookie Policy, section 3.

Our own visit counts — always on.

• Data: when one of our pages is opened, it sends our server a short message with the page's address (without the part after a question mark, which can hold a code), whether it is the first page of the visit, the address of the site that linked to it and the campaign tags of the address (the utm_ tags), if any. From it, and from what your browser sends with any request (section 2.1), our server adds one to counts kept per day, which record at most: the day; the page and the first page of the visit; the domain name of the site that linked to it and its kind (search engine, social network, AI assistant, other site, campaign or none); the campaign tags; the type of device (phone, tablet or computer); your browser's language and the country it suggests (worked out from the language, never from your IP address); and whether the page was opened by a signed-in member or by a visitor, never which member. Each of these is counted on its own, never combined with another in the same row, so no row can describe one person.
• Distinct visitors: to estimate how many different visitors came each day, our server computes, in its memory only, a keyed code from your IP address and your browser's identification string. The key is random, is never written anywhere and is replaced every day, so the codes cannot be recomputed by anyone, us included. The IP address, the browser's identification string and the code are never stored for the counts, and the counts set no cookie and use no local storage; only when a page takes you to its version in your language is the address of the page you came from kept in that tab for the move (mb-lang-hop: read once, within 10 seconds, then deleted; see the Cookie Policy, section 1).
• Members: if you are signed in, your browser sends our sign-in cookie with the message, as it does with every request to our server; our server looks at it only to count the page as a member's, never which member, and to leave out the owner's own visits.
• Server logs: like every request, the message may also be recorded, with your IP address and the time, in the technical server logs of section 2.1, which are kept apart from the counts and hold only their most recent 100 MB.
• Not counted: the owner's own visits and automated clients such as search-engine crawlers.
• Why: to know how many people visit which pages and where they come from, so that we can run and improve the Service.
• Legal basis: legitimate interests (Article 6(1)(f)).
• How long: the codes live in memory for one day at most; the totals are kept as long as they are useful and are not personal data.

Google Analytics — only if you accept it.

• Where and when: we may use Google Analytics 4 on our public pages, never on the pages for members, and only in a browser where you accepted it in our cookie notice. Until you accept, and if you refuse, its script is not loaded and nothing is sent to Google.
• Data: Google Analytics receives at most: the pages you open there (their address without the part after a question mark, except the campaign tags, and their title), the time, the address of the site that linked to them, what you do on a page that Google Analytics measures (for example scrolling to its end or following a link out of the site), your browser and operating system, the type of device (phone, tablet or computer), your language, the country and region that Google derives from your IP address, and the random identifier kept in the _ga cookie. We send Google no user identifier, no email address and nothing from your account, and we do not combine these data with anything else we hold.
• Your IP address: Google Analytics 4 does not log or store IP addresses. For visitors in the EU, Google uses the address on servers in the EU only to derive the country and region, and then discards it.
• Our settings: we have turned off Google signals, the collection of granular location and device data (such as the city, the model of the device or the screen resolution), ads personalisation and the sharing of the data with Google for its own purposes. Through Google's consent mode, Google's tag is told that you agreed to analytics only: storage for advertising, the use of your data for ads and ad personalisation stay refused.
• Why: to know, in aggregate, how visitors find and use our public pages. In our admin dashboard we see only aggregate figures (for example visits, pages, sources, countries and devices per day), never a single visitor.
• Legal basis: your consent (Article 6(1)(a); for the cookies, Article 122 of the Italian Personal Data Protection Code). You can withdraw it at any time, without affecting what was done before, with the link Privacy and cookie settings, which is also at the foot of the home page and of the request for access.
• How long: Google keeps the data for 2 months and then deletes them; the Google Analytics cookies last at most 13 months in your browser; the aggregate figures in our dashboard identify nobody.
• Google's role: Google Ireland Limited processes these data for us, as our processor, under Google's data processing terms for Google Analytics; Google LLC, in the USA, acts as its sub-processor. Transfers to Google LLC rely on its certification under the EU-U.S. Data Privacy Framework and on the Standard Contractual Clauses in Google's terms (section 6).

Google's ads — only on the home page and the request for access, and only as you choose.

• Where and when: we may show ads served by Google AdSense on our home page and on the request for access, never on the pages for members, the legal pages or the contact page; ads are off unless we switch them on. When they are on, these pages first show Google's consent message, a consent management platform certified by Google under the IAB Europe Transparency & Consent Framework. To show it, Google's consent script loads before you choose and receives your IP address and browser information, as with any request.
• Your choice: ads load only after you have chosen, and only if you agree to Google storing and reading information on your device. If you refuse, or close the message without choosing, no ad is loaded and no advertising cookie is set. Google keeps your choices in its FCCDCF cookie.
• Never personalised: we have turned off personalised ads. The ads are chosen from the content of the page and your general location, not from a profile of you; Google uses its cookies, if you allowed them, to limit how often you see an ad, to measure the ads and to prevent fraud. We do not allow ads for gambling or betting.
• Data Google receives: your IP address and browser information, the address of the page, the identifiers in Google's advertising cookies if you allowed them, and your choices in the consent message.
• Google's role: Google Ireland Limited decides how it uses these data to serve and measure ads and to prevent fraud, as an independent controller under Google's Privacy Policy; see also how Google uses information from sites that use its services. We receive from Google only aggregate reports on the ads (for example views, clicks and earnings per page, country and device). Transfers to Google LLC in the USA rely on its certification under the EU-U.S. Data Privacy Framework (section 6).
• Legal basis: for the ads and Google's advertising cookies, your consent, given in Google's message (Article 6(1)(a); for the cookies, Article 122 of the Italian Personal Data Protection Code); you can change or withdraw it at any time with the link Privacy and cookie settings, which is also at the foot of the home page and of the request for access. For loading Google's consent message, which must happen before you choose so that you can be asked at all, and for keeping your choice in its FCCDCF cookie: our legitimate interests in asking for your consent, and recording it, before any ad, as the law requires (Article 6(1)(f); Article 7(1) GDPR).

Google Search Console. We use it to see how our public pages appear in Google Search: which searches showed them, how often they were clicked, their position, and which pages Google has indexed. These are aggregate figures from Google Search; we send Google no data about visitors or members for it, and nothing of Google's runs on our pages for it.

3. Do you have to give us your data?

To request access and create an account you must give your email address, your Instagram username, a username, a password and your confirmation that you are 18 or older; without them we cannot create your account. Everything else is optional, and the Service works without it.

4. What we never do

• We never sell or rent personal data.
• We never share data with bookmakers, betting exchanges or other gambling operators.
• On the pages for members we use no advertising, no tracking cookies and no analytics or scripts of other companies. On our public pages, Google Analytics and Google's ads run only with your consent, and we never show personalised ads (section 2.18).
• We do not profile members for marketing and take no automated decisions about them.
• We do not knowingly process data of anyone under 18.
• We do not intentionally collect special categories of data about members (such as health data).

5. Who receives your data

We share data only with providers who work for us under a data processing agreement, and only as much as each one needs, except where the table says that a recipient acts as an independent provider or controller.

Providers that receive no personal data. The Service fetches football data and prices from data providers (The Odds API, odds-api.io, OddsPapi, Sportmonks, TheStatsAPI, Club Elo, football-data.co.uk, and openfootball on GitHub; API-Football is not used at present), weather from Open-Meteo, news from the publishers' RSS feeds, and exchange prices for our own reference from Betfair (paused at present); these requests come from our server and carry no data about members. Each day's seal of our sealed record is sent to the public OpenTimestamps calendars, which receive a blinded 32-byte digest only. Our TLS certificates come from Let's Encrypt, which receives no member data. Google Search Console gives us aggregate figures on how our public pages appear in Google Search and receives no data about visitors or members (section 2.18).

Other recipients: public authorities, when the law requires it; our lawyers, accountants and auditors, bound by confidentiality; and, if the business is transferred, the company that takes over the Service, which must keep protecting your data as described here (we will tell you beforehand). Other members see only what sections 2.7 and 2.17 describe. On the News page, article images are loaded from the publishers' own servers only if you turn images on (the choice is remembered in that browser); those servers then receive your IP address and browser information (see the Cookie Policy).

6. International transfers

6.1 Our database is hosted in the European Union (Finland).

6.2 Some recipients are in the United States. Where a recipient is certified under the EU-U.S. Data Privacy Framework (and, for UK and Swiss data, its UK Extension and the Swiss-U.S. framework), the transfer relies on the corresponding adequacy decision. Otherwise it relies on the Standard Contractual Clauses adopted by the European Commission (Decision (EU) 2021/914), with the UK Addendum or the Swiss adaptations where needed, and on additional safeguards where an assessment shows they are required.

6.3 For residents of Switzerland: personal data may be disclosed to Finland, Germany, Ireland and the United States, on the bases described above.

6.4 You can ask for a copy of the safeguards at privacy@mariobets.xyz.

7. Retention and deletion

Deleting your account. You can delete your account at any time in Profile. If you have a paid subscription, it ends at the same moment and no further payment is taken — we ask our payment provider for every subscription you have with us, not only the one our records show (if we cannot reach our payment provider to stop it, nothing is deleted and we ask you to try again, so that you are never charged for an account that no longer exists). We then delete your sessions (with their IP addresses and browser details), your sign-in history, pending email codes, backup codes, passkeys, My record, your forecasts in the forecast lab, the budgets you entered in the accumulator calculator, your follows (both ways), price alerts, market-signal rules, browser-notification subscriptions, the record of alerts sent to you, your news-digest subscription, your weekly-recap setting, the link to your Stripe customer record, your place on our list of free accounts, and which invitation you used. We erase from your account your email address, username, password, bio, avatar, Instagram username, Telegram link, preferences and favourites, country, chosen bookmakers, calculator and well-being settings, referral code and free-access date; what remains is an empty row with an internal number and the dates the account was created and deleted. Your access request and any invitation bound to you are kept without your email address, Instagram username, message, IP address or notes. Acceptance records and security audit records are kept separately, with restricted access, for the period in the table, so that we can prove what was accepted and defend legal claims; a referral reward granted in the past keeps only two internal account numbers, because the other member's free days depend on it. Invoices and payment records stay with Stripe for the accounting period (section 2.10). If you withdrew from a subscription and we have not finished refunding you yet, the record of that subscription (its Stripe identifiers, dates and the amount refunded, without your name or email address) is kept until the refund is complete, because we owe it to you.

8. How we protect your data

Passwords are stored with argon2id, a strong salted hash. Session tokens, backup codes and verification codes are stored only as hashes. Two-step sign-in with email codes and phishing-resistant passkeys is available. Connections are always encrypted (HTTPS with HSTS). The pages for members load only our own scripts; our public pages load Google's scripts only as section 2.18 describes. Access to data is limited to the people who need it and is logged. If a personal data breach puts your rights at risk, we inform the supervisory authority within 72 hours and, where the law requires, you without undue delay.

9. Your rights

Under the conditions set by the law, you have the right to:

• access your data and receive a copy — Profile › export gives you your main data as a file at any time;
• rectify inaccurate data — most of it directly in Profile;
• erase your data — Profile › delete account, or ask us;
• restrict processing;
• data portability — the export is in a machine-readable format (JSON);
• withdraw your consent at any time, without affecting what was done before;
• object — see below.

Right to object. You may object at any time, for reasons relating to your situation, to processing based on our legitimate interests. You may object at any time, without giving reasons, to the use of your data for direct marketing.

To exercise a right, use the tools in Profile or write to privacy@mariobets.xyz. It is free. We answer within one month; for complex requests we may extend this by two further months and will tell you why. We may ask you to confirm your identity first.

10. Complaints to a supervisory authority

You can complain to a supervisory authority. Because we are established in Italy, our lead authority is the Garante per la protezione dei dati personali. You can also complain to the authority of the EU or EEA country where you live or work (the European Data Protection Board lists them at edpb.europa.eu). In the United Kingdom, the authority is the Information Commissioner's Office; in Switzerland, the Federal Data Protection and Information Commissioner. We would be glad to hear from you first at privacy@mariobets.xyz.

11. Age

mariobets is for people aged 18 or older. If we learn that an account belongs to someone under 18, we close it and delete the data.

12. Cookies

The Service itself uses only what it needs to work. The cookies of Google Analytics and of Google's ads are used only on our public pages and only with your consent (section 2.18). See the Cookie Policy.

13. Changes to this Policy

We update this Policy when our processing changes or the law requires it. If a change matters to you, we tell you by email or in the Service before it applies and, where the law requires it, ask for your consent. The version and the effective date at the top always show which text applies.

← All documents