Privacy Policy

PinnRadar runs a real-time sports odds API at pinnradar.com. In this policy, "we" and "us" mean PinnRadar. Below we set out, in plain terms, which personal data the service handles, the reason for each item, how long it stays with us and what you can ask us to do with it. The policy only describes things the service really does.

Who runs this service

The operator of pinnradar.com is the data controller. Write to info@pinnradar.com about anything to do with your personal data.

Data we handle

Each item below shows when we get it, what we use it for and the legal basis we rely on.

Your email address

When: you sign up, recover a key, buy a plan or contact support. Use: we open and run your account, send you your API key and send account messages such as address verification, receipts and reminders that a plan is about to expire. Basis: performing our contract with you.

Key, plan and usage records

What: your API key (kept only as a one-way hash), your plan, its expiry date and a daily count of requests made with each key. When: for as long as the account exists. Use: checking that requests are authorised, applying plan limits and reconciling billing. Basis: contract.

Payment records

What: the amount, currency and plan, the transaction reference from the payment provider, and the payment status. When: you buy a plan. Use: delivering what you paid for, keeping accounts and preventing fraud. Card numbers and crypto wallet keys never reach us; our payment providers handle the payment itself (see Service providers). Basis: contract and our legal obligations.

How you found us

What: the source of your first visit, for example "google / organic", the referring domain or a campaign tag. When: it is noted on your first visit and linked to your account when you sign up. Use: learning which channels bring in customers. It is first-party only and sits in your browser's localStorage until you sign up. Basis: legitimate interest.

Support messages

What: conversations through the chat widget or by email. When: you get in touch. Use: replying to you and making the documentation better. Basis: legitimate interest.

Server logs

What: IP address, requested path, time and user agent. When: on every request. Use: security, stopping abuse, rate limiting per IP and fixing faults. Logs are rotated on a short cycle. Basis: legitimate interest.

Analytics and advertising cookies

What: cookies from Google Analytics, Microsoft Clarity, Google Ads and Meta. When: for visitors in the EEA and UK, only once you accept cookies. Use: seeing how the site is used, session recordings and heatmaps, and measuring ad campaigns. Basis: consent. The Cookie Policy has the full list.

We never sell personal data. We also make no automated decisions about you that have legal effects.

Emails

Most of what we send is needed to run your account: the verification link, delivery and recovery of your API key, payment receipts, reminders before a plan expires, and security notices.

Now and then we announce product news to customers whose plan is active or ended recently. Each of those emails has a one-click unsubscribe link. Unsubscribing stops the announcements only; account messages keep coming because the service needs them.

Service providers

A small number of outside companies process data for us:

• Hosting. Our servers are in the EU. Cloudflare sits in front of them for content delivery, DDoS protection and TLS.
• Payments. NOWPayments handles crypto checkout and, where it is switched on, Stripe handles card payments. Each one processes your payment under its own privacy policy. We get back only the result and a reference.
• Email delivery. An SMTP provider sends the emails described above and is used for nothing else.
• Analytics and advertising. Google Analytics 4, Google Ads, Microsoft Clarity and the Meta Pixel. In the EEA and UK they depend on your consent. Cookies, purposes and opt-out options are in the Cookie Policy.
• Support assistant. What you type into the on-site assistant is sent to an AI provider so it can produce an answer. Please do not paste secrets, such as your API key, into it.

Google, Microsoft, Meta and Stripe are based in the US. Transfers to them are covered by the EU-US Data Privacy Framework, Standard Contractual Clauses, or both.

How long we keep it

• Account and key data: while the account exists. After the account is deleted, it is deleted or anonymised within 90 days.
• Payment records: 10 years where tax and accounting law requires it.
• Server logs: usually 30 days.
• Support conversations: no longer than 24 months.
• Analytics data: whatever each provider's retention setting is. For GA4 we have set 14 months.

Your rights

If you are in the EEA or UK, you can ask to see, correct, export or delete your data, to restrict how we use it, or to object to its use. Where we rely on consent, you can withdraw it whenever you like; processing done before the withdrawal stays lawful.

Send your request to info@pinnradar.com from the email address on your account. We answer within 30 days. You also have the right to complain to the data protection authority where you live.

If you want your account gone entirely, email us. We remove the account and its key straight away, and the remaining data is purged on the timetable in How long we keep it.

Security

API keys are never stored in readable form; we keep only a SHA-256 hash. All traffic runs over TLS, and only the operator has access to production systems. No system can be made perfectly secure, so if you think your key has leaked, rotate it in the panel or contact us.

Age limit

PinnRadar is meant for adults aged 18 or over and for businesses. We do not knowingly collect data from anyone under 18.

Updates to this policy

When the way we handle data changes, we revise this page and the date at the top. Customers with an active plan are told about significant changes by email.