OddsAPI.dev Privacy Policy
Last updated: 31 October 2026
1. Who we are
1.1 This policy explains how OddsAPI.dev (www.oddsapi.dev and api.oddsapi.dev, "we", "us") handles personal data.
1.2 We are the controller of the personal data described in this policy.
1.3 For privacy questions or requests, email support@oddsapi.dev.
1.4 This policy covers our website, our dashboard, our API and our communications with you. The Service is intended for developers and businesses aged 18 and over.
2. Personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, name, a hashed password (managed by our authentication provider), and account settings | You |
| Google sign-in data | If you use Google sign-in: your name, email address, profile picture and Google account ID | Google, with your permission |
| API credentials | Hashed API keys and key metadata, such as the key prefix, creation date and last use | Generated by us |
| Usage logs | Endpoints called, request parameters, timestamps, response codes, IP address, user agent, and request and quota counts | Your use of the API and dashboard |
| Billing status | Plan, subscription status, trial status, payment and renewal dates, and the customer and transaction references from our payment provider | Dodo Payments |
| Referral and attribution data | Referring site, UTM campaign parameters and landing page captured on your first visit, plus any affiliate or referral code | Your browser, and our referral partner |
| Support and communications | Messages you send us by email or chat, and whether you open or click our emails | You, and our email and chat tools |
| Website and device data | Pages visited, browser and device type, approximate location derived from your IP address, and cookie or local storage identifiers | Your browser |
We do not collect or store your full card details. Dodo Payments, our Merchant of Record, collects and holds your payment information directly.
We do not knowingly collect special category (sensitive) data, and we do not need it. Please do not send it to us.
3. How we use your data and our lawful bases
UK and EU data protection law requires us to have a lawful basis for each use of your data. Our purposes and lawful bases are:
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Creating and running your account; issuing API keys; authenticating requests; providing the Service | Contract |
| Counting usage, enforcing quotas and rate limits, and showing usage in your dashboard | Contract |
| Managing trials, subscriptions and plan changes with our payment provider | Contract |
| Keeping the Service secure; detecting and preventing fraud, abuse, key sharing, trial abuse and breaches of our Terms | Legitimate interests (protecting our Service, customers and data) |
| Debugging, monitoring performance and improving the Service | Legitimate interests |
| Responding to support requests | Contract or legitimate interests |
| Sending essential service emails, such as account, security, billing and API change notices | Contract or legitimate interests |
| Sending product updates and marketing emails | Legitimate interests, or consent where the law requires it. You can opt out at any time. |
| Measuring where sign-ups come from, and paying referral and affiliate commissions | Legitimate interests, plus consent for non-essential cookies where required |
| Keeping records for accounting, tax and legal purposes; responding to lawful requests; establishing or defending legal claims | Legal obligation, or legitimate interests |
Where we rely on legitimate interests, we have weighed our interests against your rights. You can object to this processing (see section 9).
Automated systems enforce rate limits and flag suspected abuse. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing. You can ask for a human to review any suspension.
5. International transfers
5.1 Several of our providers are based in, or process data in, the United States and other countries outside the UK and the European Economic Area (EEA).
5.2 When we transfer personal data outside the UK or EEA, we rely on at least one of the following safeguards:
- an adequacy decision or regulations, including the EU-US Data Privacy Framework and the UK Extension to it, where the provider is certified
- the European Commission's Standard Contractual Clauses, together with the UK International Data Transfer Addendum
- another lawful transfer mechanism
5.3 You can ask us for more information about these safeguards.
6. Security
6.1 We use measures appropriate to the risk to protect your data. These include encryption in transit (TLS), storing API keys only in hashed form, access controls, and limiting staff access to the people who need it.
6.2 No system is completely secure. You are responsible for keeping your password and API keys secret. If we become aware of a breach that affects your personal data, we will notify you and the relevant authorities where the law requires us to.
7. How long we keep data
We keep personal data only for as long as we need it for the purposes in this policy:
| Data | Retention |
|---|---|
| Account data and API key records | While your account is open, then deleted or anonymised within 30 days of account deletion |
| Raw usage logs, including IP address and user agent | 90 days |
| Aggregated usage counts (with no IP address or user agent) | For the life of the account. Kept longer only in anonymised form. |
| Billing status and subscription history | Up to 7 years, for accounting, tax and dispute purposes |
| Trial eligibility and abuse-prevention records | Up to 3 years after your last activity, to prevent repeated trials and abuse |
| Support conversations | 2 years after the conversation ends |
| Marketing email data | Until you unsubscribe, then kept on a suppression list so we do not email you again |
| Referral and attribution data | For the life of the account, or as long as needed to settle referral commissions |
Backups may hold data for up to a further 30 days before they are overwritten. We may keep data longer where the law requires it, or where we need it to establish, exercise or defend legal claims.
9. Your rights (UK, EU and similar laws)
9.1 Depending on where you live, you may have the right to:
- access a copy of your personal data
- correct inaccurate data
- delete your data
- restrict our processing, or object to it, including to direct marketing at any time
- port your data, which means receiving it in a machine-readable format
- withdraw consent at any time, where we rely on consent. This does not affect processing that happened before you withdrew it.
9.2 To exercise these rights, email support@oddsapi.dev. We may need to verify your identity first. We will respond within one month, and we may extend this where the law allows.
9.3 Some data we must keep, for example billing records required by tax law. If so, we will tell you.
9.4 You also have the right to complain to a data protection authority. You can contact the authority where you live or work. We would appreciate the chance to resolve your concern first.
10. California and other US state privacy rights
10.1 If you are a California resident, or live in another US state with a comprehensive privacy law, the following applies to you:
- Categories we collect. We collect the categories in section 2: identifiers (name, email address, IP address, account IDs), commercial information (subscription and billing status), internet activity (usage logs, website usage), approximate geolocation (from your IP address) and inferences limited to fraud and abuse detection. We collect these for the purposes in section 3, and we disclose them to the service providers in section 4.
- No sale or sharing. We do not sell personal information, and we do not "share" it for cross-context behavioural advertising, as those terms are defined under the California Consumer Privacy Act (CCPA). We do not use or disclose sensitive personal information for purposes that would require an opt-out.
10.2 Your rights. You may ask to know what personal information we have collected about you, and to correct or delete it. Email support@oddsapi.dev with "US Privacy Request" in the subject line. You may use an authorised agent, and we will verify requests before acting on them.
10.3 We will not discriminate against you for using your rights. If we deny a request, you can appeal by replying to our response.
11. Marketing emails
11.1 We may email you about product updates, new features and offers related to OddsAPI.dev. Every marketing email includes an unsubscribe link, and you can also opt out by contacting us.
11.2 Service emails cannot be turned off while your account is active, because they relate to security, billing or important changes to the API.
12. Children
The Service is not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.
13. Data in your own applications
13.1 The API provides odds data and does not need personal data about your end users. Please do not include end-user personal data in API requests.
13.2 You are responsible for your own privacy notices and legal compliance for any personal data you process in your own applications.
14. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by email or in the dashboard before they take effect. The "Last updated" date shows when the policy last changed.
15. Contact
Email: support@oddsapi.dev