Privacy Policy

1. Data controller

The data controller is Gsoft Solutions Ltd, a company registered in England and Wales (company number 07457304). For privacy requests, email support@betsandladders.com. Our Information Commissioner's Office (ICO) registration is in progress; our registration number will appear here once issued.

2. What data we collect

We collect only what we need to run the Service.

From Betfair (when you log in)

• Your Betfair-issued vendor client ID — used as your B&L user identifier;
• An OAuth access token and refresh token, used by our servers to place, list, and cancel bets on your behalf when you instruct us to;
• Your account profile fields as exposed by the Betfair OAuth API (e.g. country code, currency, timezone).

We do not see, store, or process your Betfair username or password.

From you directly

• The email address you provide at sign-up (used for service notices and, when paid plans launch, invoices);
• Your plan and account preferences (tier, ladder layout, runner preferences).

From a payment provider (when paid plans launch)

Not currently in use. When paid plans launch we will collect the following from the chosen payment processor:

• Mandate / payment-method metadata: identifiers, status, currency;
• Limited metadata describing each charge (date, amount, status).

We do not collect or store your bank login credentials, IBAN, sort code, account number, or card details. Authorisation will happen entirely within the payment provider's flow.

From Zoho Books (when invoices are issued)

Not currently in use. Will be active once paid plans launch.

• Invoice records — invoice number, period, net/VAT/gross amounts, VAT breakdown — as required to issue VAT-compliant UK invoices.

Activity within B&L

• Markets, runners, and bets you view or interact with within the Service — held only for the duration of your session and not retained as a profile of your trading activity beyond what is needed to render your own current bets;
• Diagnostic and error logs (for example, crash reports), which may include your B&L user ID.

Cookies and local storage

We use a small number of strictly necessary cookies and browser storage to run the Service. These don't require consent:

• A Firebase Auth session token (so you stay logged in between visits);
• Local preferences (e.g. ladder layout, runner preferences).

With your consent, we also set one analytics cookie:

• Microsoft Clarity (clarity.ms) records an anonymised view of how you interact with the site — including signed-in pages — through heatmaps and session replay, so we can find and fix usability problems. It only runs if you accept analytics cookies. We mask sensitive information — including your account balance — so it is not captured in recordings, and Clarity does not profile you across other sites.

We manage cookie consent through a banner provided by CookieYes. You can accept or reject analytics cookies when you first visit and change or withdraw your choice at any time from the cookie-settings link in the banner. We do not use third-party advertising cookies.

Full cookie list

These are the cookies we use. Analytics cookies are only set if you accept them.

3. Lawful basis

We process personal data on the following lawful bases under UK GDPR:

• Performance of a contract (Article 6(1)(b)) — for account creation, OAuth-based bet placement, subscription billing, invoicing;
• Legitimate interest (Article 6(1)(f)) — for fraud prevention, abuse detection, diagnostic logging, and securing our infrastructure;
• Legal obligation (Article 6(1)(c)) — for retention of VAT/tax records and for any disclosures required by law;
• Consent (Article 6(1)(a)) — for optional analytics cookies (Microsoft Clarity) only.

We rely on consent only for optional analytics cookies — you can grant or withdraw it at any time via our cookie banner, and rejecting it does not affect your use of the Service. We do not rely on consent for any processing necessary to provide the Service.

4. How we use your data

We use your data to:

• Authenticate you and link your B&L account to your Betfair account;
• Place, list, cancel, and report on bets at your instruction;
• Take subscription payments and issue VAT invoices;
• Send service notices (e.g. mandate-revoked, payment-failed, upcoming renewal) to your registered email;
• Diagnose and fix bugs, prevent abuse, and secure our infrastructure;
• Comply with legal and regulatory obligations.

We do not sell your data, share it for advertising, or build advertising profiles.

5. Who we share data with

We share data only with service providers that are essential to running B&L, and only to the extent necessary. Each is bound by data-processing terms that meet UK GDPR requirements.

• Betfair (data controller in its own right) — to execute bets and account operations on your behalf;
• Google / Firebase — hosting (Firebase Hosting), authentication (Firebase Auth), database (Realtime Database, Firestore), and serverless compute (Cloud Functions, Cloud Run). Primary region: europe-west2 (London) and europe-west1 (Belgium);
• TrueLayer — Open Banking payment processing for the bank mandate and recurring charges;
• Zoho Books — generation and emailing of VAT-compliant invoices;
• Anthropic — when (and only if) the in-app AI assist feature is enabled, your queries and responses pass through Anthropic's API. This feature is disabled by default for all accounts at the time of writing.

We may disclose your data where required by a court order, regulator, or other lawful authority, and we will notify you if we are legally permitted to do so.

6. International transfers

Your data is primarily processed within the UK and EEA. Some of our service providers may transfer or process data outside the UK/EEA — for example Anthropic's API may route requests to the United States. Where this happens, transfers are protected by the UK International Data Transfer Agreement, the EU Standard Contractual Clauses, or another lawful safeguard.

7. Retention

• Account data (Betfair UID, email, preferences) — kept while your account is active; deleted within 90 days of account closure unless retention is required by law;
• Subscription and payment records — kept for 6 years after the end of the relevant tax period, as required by HMRC for VAT records;
• Invoices (Zoho Books) — kept for 6 years for the same reason;
• Diagnostic and error logs — kept for up to 30 days, then automatically deleted.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten"), subject to our legal retention obligations;
• Restrict our processing in defined circumstances;
• Object to processing carried out on a legitimate interest basis;
• Data portability — receive a machine-readable copy of data you've provided to us;
• Not be subject to a decision based solely on automated processing with legal or similarly significant effect. We do not currently make any such decisions about you.

To exercise any of these rights, email support@betsandladders.com. We will respond within one calendar month.

9. Security

We protect your data with industry-standard technical and organisational measures including HTTPS-only transport, server-side storage of OAuth tokens and secrets, principle-of-least-privilege access controls, and audit logging. No system can be made completely secure; we will notify affected users and the ICO promptly in the event of a notifiable data breach.

10. Children

B&L is for adults aged 18 and over only. We do not knowingly collect data from anyone under 18. If you believe we have inadvertently done so, please contact us and we will delete the data.

11. Filing a complaint

If you are not satisfied with our handling of your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK data-protection authority. We would prefer the chance to put things right first — please contact us before escalating.

12. Changes to this policy

We may update this policy from time to time. The version published at /privacy is the version in force. Material changes will be notified by email or in-app notice at least 30 days before they take effect.