Privacy Policy
This policy explains how Curvalo (the “app”) handles personal data under Regulation (EU) 2016/679 (GDPR).
1. Data controller
[Controller: Stefano Zarro, VAT no. [P.IVA], registered at [ADDRESS]]
Privacy contact: support@curvalo.app
2. Where your data lives
We do not use a third-party authentication provider: accounts are managed directly by Curvalo on its own servers in the European Union (Contabo, Germany). App data is stored on MongoDB Atlas ([EU cluster region to be confirmed]).
3. Data we process
- Account: your email address and the sign-in identifiers provided by Sign in with Apple or Sign in with Google, plus your in-app preferences.
- Bet slips: the images you upload (photos or screenshots, see section 6 on how they are processed), the information extracted from them (matches, markets, odds, stake, result) and the history of slips you save.
- Subscription: subscription status and purchase identifiers. We never see or store your card or payment details: payment is handled by Apple.
- App usage: usage events and technical data (device model, OS version, errors) to understand how to improve the app.
- Push notifications: your device token, if you enable them.
- Communications: messages you send to support.
4. Why we process it and on what legal basis
- Creating your account, reading slips, following matches and computing statistics: performance of a contract (Art. 6(1)(b) GDPR).
- Managing your subscription and sending service emails (sign-in, security, receipts): performance of a contract.
- Aggregate usage analytics, security, abuse prevention and improving the app: legitimate interest (Art. 6(1)(f)).
- Push notifications and optional communications: consent (Art. 6(1)(a)), which you can withdraw at any time.
- Legal obligations, such as tax and accounting: Art. 6(1)(c).
5. Providers that receive data
We do not sell your data. We share it only with providers acting on our behalf (processors):
- Contabo GmbH (Germany, EU): the servers running the app and the accounts.
- MongoDB Atlas (MongoDB, Inc.): the app database.
- Google Gemini (Google): bet slip images are sent to Google to extract their text (selections, odds, stake). See section 6.
- RevenueCat: management and verification of subscriptions bought through Apple.
- PostHog (EU region): app usage analytics.
- Resend: sending emails (for example service emails).
- Apple and Google: sign-in with your Apple or Google account and, for Apple, push notifications and payments. For push notifications we also use the Expo service.
We may also disclose data to the competent authorities where required by law.
6. Bet slip images and Google
When you scan a slip, the image is sent from our servers to the Google Gemini API, run by Google, for one purpose: reading the text in it (matches, markets, odds, stake). We use the free (unpaid) tier of the Gemini API. Under Google’s terms for that tier, Google may use the content sent to it to provide, improve and develop its products, services and machine-learning technologies, and human reviewers may read and process it. Google asks not to send sensitive, confidential or personal information through this tier.
So please do not photograph or screenshot slips that show personal data (for example your name, address, document or card numbers, or account details). Crop or hide them first.
On our side, a compressed copy of the image and the extracted result are stored in our database to check and improve the quality of the scan. The image is deleted immediately when you delete your account, and otherwise automatically after 90 days; the extracted slip data stays in your history until you delete it or your account.
If we move to a paid Gemini tier, where Google does not use content to improve its products, we will update this policy.
7. Transfers outside the European Economic Area
Some providers (for example Google, RevenueCat, Resend, MongoDB) may process data in the United States or other non-EU countries. This applies in particular to the bet slip images sent to Google. In that case we rely on GDPR safeguards such as the European Commission’s Standard Contractual Clauses or the EU-US Data Privacy Framework.
8. How long we keep data
We keep your account and slip data for as long as you keep your account. When you delete your account in the app, your profile, slip history and statistics are permanently removed. Scan images and their stored scan data are deleted at the same time; otherwise images are kept for at most 90 days (see section 6). Some data may remain for as long as legal obligations require (for example accounting records of payments handled by Apple) or to defend a legal claim.
9. Deleting your account
You can delete your account at any time from inside the app, in the profile settings (“Delete account”). Deletion is permanent. Deleting your account does not cancel your subscription: do that in your App Store settings.
10. Your rights
You have the right to access, rectify, erase, restrict, port and object, and to withdraw consent where processing is based on it. To exercise them write to support@curvalo.app: we reply within one month. You may also lodge a complaint with the Italian data protection authority (garanteprivacy.it) or the authority in your country.
11. Children
Curvalo is for adults only (18+). If we find that we collected data from a minor, we delete it.
12. Security
We apply reasonable technical and organisational measures, including encrypted connections and access control. No system is risk-free: please also protect access to your Apple or Google account.
13. Changes
We may update this policy. For material changes we will notify you in the app or by email and update the date at the top of this page.