Privacy Policy

Version 3.5 · Updated 23 October 2026 · UK GDPR

We collect the data needed to run Odds Scanner AI and, if you allow it, to measure how people find and use the app. We tell you, in plain English, what we do with each piece. CX Media Ltd is the data controller.

What we collect

Account data

• Email, name, password hash — for sign-in and support; plus your Google or Apple identifier if you sign in with them. When you sign up with email, we ask ZeroBounce, our email-validation provider, whether the address can receive email; only the address is sent, and we don't keep the answer.

Betting activity

• The bets you track (stake, odds, bookmaker, notes) and the tips you follow — to power My Bets and your alerts.

Preferences

• Your market, language, odds format and notification choices — to tailor the app to you.

Device & technical data

• OS, app version and push token — for compatibility and notifications; and your IP address, briefly, to rate-limit abuse.

App install

• Our attribution provider AppsFlyer records the install: device model and operating system, IP address, an AppsFlyer ID and, on Android, your device's advertising ID. This tells us which campaign, if any, led to the install. In the UK and the European Economic Area (EEA) this happens only if you accept in our consent form; elsewhere, when you first open the app. On our campaign pages on oddsscanner.ai, the download button on a phone is an AppsFlyer link: tapping it sends AppsFlyer the campaign named in the page's link (campaign, ad set and ad), your IP address and device type, so the install can be matched to that campaign once it is recorded as above. If you accept measurement on those pages (see “Campaign pages on our website”), the link also carries Meta's click ID. If your browser sends a Do Not Track or Global Privacy Control signal, the button goes straight to the app store instead.

App usage and measurement — only if you allow tracking

• The actions you take in the app: creating an account (and whether with email, Google or Apple), opening a tip, following a tip, applying filters, tapping a bookmaker's odds, finishing the How to Bet guide, and the screens you open. With them: your market and language, an app instance ID, your device's advertising ID (on iPhone only if you allow tracking), device model and operating system, and an approximate location (country and region) derived from your IP address.

Campaign pages on our website — only if you accept

• Our app-download pages on oddsscanner.ai, the ones our ads link to, ask before measuring anything. If you accept, the Meta Pixel records that you viewed the page and tapped the download button (with the page's country and app store), together with the page address, your IP address, browser type and Meta's cookies. AppsFlyer keeps the campaign details from the link and the page you came from in your browser for up to 2 hours, and records that the page was viewed. This tells us, and Meta, which ad led to the visit and the install. If you reject, or your browser sends Do Not Track or Global Privacy Control, none of this happens. Our other web pages don't use these tools.

Why we use it

• Service delivery: Authenticate you (including checking at sign-up that your email address can receive email), surface tips, run notifications. Lawful basis: contract.

• Communications: Service emails (always). Product news and tips by email after you create an account, unless you tick “Don't send me tips and product news by email” when you sign up; every email has an unsubscribe link. Lawful basis: legitimate interests.

• Measurement and advertising attribution: Understand which campaigns bring people to the app, measure how the app is used and improve our marketing. Lawful basis: consent for in-app measurement, for measurement on our campaign pages and, in the UK and EEA, for the install record, which you can withdraw at any time (see Your rights); elsewhere legitimate interests for the install record.

• Compliance: Detect fraudulent accounts and respond to lawful requests. Lawful basis: legal obligation.

Who sees your data

• Our engineers, on a need-to-know basis, with audit logs.

• Sub-processors that operate the service: our hosting provider in the United States (servers and database), Google and Apple (sign-in), Resend (email), ZeroBounce (email-address validation at sign-up), Cloudflare (media storage), Expo/Apple/Google (push delivery), GetResponse (product emails), AppsFlyer (install attribution, in-app measurement and, if you accept, campaign-page measurement) and Google (Google Analytics for Firebase).

• Advertising partners: Meta, Google Ads and Apple Search Ads receive install data through AppsFlyer to measure their campaigns, and in-app event data only if you allow tracking (Google Ads also through Google Analytics). Meta also receives campaign-page visits and download taps through the Meta Pixel, only if you accept on those pages. For that collection, Meta and CX Media Ltd are joint controllers; Meta is responsible for its own use of the data.

• Authorities, only when compelled by valid legal process.

How long we keep it

• Account & betting data — while your account is active, plus 30 days.

• Support emails — 2 years from last contact.

• Your email in our product-email list — until you unsubscribe or delete your account.

• App usage data in Google Analytics — 14 months.

• Install and event data in AppsFlyer — aggregated reports up to 25 months; user-level data for shorter periods set by AppsFlyer and its advertising partners.

• Meta Pixel cookies — 90 days; what Meta receives is kept under Meta's own policy.

• Campaign details AppsFlyer stores in your browser — 2 hours.

Where it lives

Our main servers are in the United States. Push tokens and CDN edge data may transit other regions, and AppsFlyer, Google and Meta may process measurement data, and ZeroBounce email addresses, in other countries; transfers outside the UK rely on the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses or, where the recipient is certified, the UK–US data bridge, and additional safeguards.

Your rights

Under the UK GDPR you can, at any time:

1. Access a copy of your data.

2. Correct anything inaccurate.

3. Delete your account and personal data.

4. Port your data to another service.

5. Object to processing based on legitimate interest, including product emails.

6. Withdraw consent, including for tracking and measurement — without affecting prior processing.

• Delete your account: in the app, Profile → Delete Account.

• Change your tracking choice: in the app, Profile → Privacy Settings (in the UK and EEA it reopens our consent form; on iPhone elsewhere it opens the app's iPhone settings). Also on iPhone, Settings → Privacy & Security → Tracking; on Android, Settings → Privacy → Ads (delete or reset your advertising ID). On our campaign pages: Cookie settings at the bottom of the page.

• Stop product emails: use the unsubscribe link in any email.

• Anything else: email support@oddsscanner.ai.

We respond within 30 days.

Children

Our service is not directed at people under 18 and we do not knowingly collect data from minors. If we learn we hold such data, we delete it.

Security

Data in transit is encrypted with TLS 1.2 or higher. Media files, including profile photos, are encrypted at rest with AES-256. Access to our systems is restricted to the people who need it and is logged. We disclose incidents as required by applicable law.

Complaints

You can complain to the Information Commissioner's Office (ICO), the UK's data protection authority. We'd prefer to resolve things first, so please reach out to us before filing a complaint.

Data Protection Officer · CX Media Ltd · Malta.