Privacy Policy
Last updated: 2026-09-30
This Privacy Policy describes how Mantisnap, sole trader, SIRET 50981295400030, registered at 8 bd Déodat de Séverac, 31300 Toulouse, France ("Mantisnap", "the Publisher", "we") processes personal data collected through the scorexact.com website and application (the "Service"), in accordance with the General Data Protection Regulation (GDPR) and applicable French data protection law.
Contact for any question regarding your personal data: contact@scorexact.com.
Account and authentication
Data collected: email address, password (encrypted, never accessible to us in plain text), username.
Purpose: account creation, login, and management of your subscription.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Retention: for as long as your account is active, then deleted within a reasonable period after account deletion, subject to legal retention obligations (accounting, tax).
Recipient: Supabase Inc. (database and authentication hosting).
Payment
Data collected: none directly by us. Card details are entered and processed exclusively by Stripe.
Purpose: processing your subscription payment.
Legal basis: performance of a contract (Art. 6.1.b GDPR).
Retention: for the duration of your subscription, then according to Stripe's own retention rules and applicable accounting obligations.
Recipient: Stripe, Inc. (payment processor, PCI-DSS certified).
Telegram alerts (scorexact Pro)
Data collected: your Telegram user ID, when you choose to link your Telegram account.
Purpose: sending you live position alerts on a private Telegram channel, included with your scorexact Pro subscription, and removing you automatically when your subscription ends.
Legal basis: performance of a contract (feature included with the paid scorexact Pro subscription).
Retention: for as long as your scorexact Pro subscription is active; the link is removed when the subscription ends.
Recipient: Telegram FZ-LLC.
Commercial communications
Data collected: email address.
Purpose: sending you news, offers, and updates about scorexact.
Legal basis: your consent, given via an unticked checkbox at sign-up (Art. 6.1.a GDPR). This consent is entirely optional and has no effect on your access to the Service.
Retention: until you withdraw your consent, or 3 years after your last interaction with our communications.
Withdrawal: you may withdraw this consent at any time from your account settings, or via the unsubscribe link included in every commercial email.
Recipient: none — sent directly, no third-party marketing platform at this time.
Cookies and local storage
Data collected: your language and theme (light/dark) preferences, stored in your browser's local storage, and, for authenticated pages, a technical session cookie required for login. A random, non-identifying anonymous visitor identifier is also stored in local storage to keep track of ad-unlocked content (see "Advertising" below).
Purpose: remembering your preferences, keeping you logged in between visits, and knowing which match you've unlocked by watching an ad.
Legal basis: legitimate interest (strictly functional storage, no advertising or cross-site tracking through this specific storage).
Retention: until you clear your browser data or log out.
Advertising
Data collected: cookie and advertising identifiers and usage data collected by Google and its advertising partners (i) through the ads displayed on the Site (Google AdSense) and (ii) when you choose to watch a rewarded video ad to unlock a match's content for free (Google Ad Manager).
Purpose: serving and measuring ads, limiting how often an ad is shown, preventing fraud and, only with your consent, personalising ads; remunerating the Site and this feature.
Legal basis: your consent, collected through the consent message shown on your first visit, provided by a Google-certified consent management platform (Art. 6.1.a GDPR). You may withdraw or change your consent at any time through that message's settings. Without your consent, personalised ads are not served. You can also manage ad personalisation from your Google account at adssettings.google.com.
Retention: governed by Google's own retention policies for advertising data; see Google's Privacy Policy.
Recipient: Google Ireland Limited (Google AdSense and Google Ad Manager).
Recipients and sub-processors
Your personal data may be shared with the following categories of recipients, strictly to the extent necessary for the purposes described above:
- Supabase Inc. — database, authentication, and file storage hosting
- Stripe, Inc. — payment processing
- Vercel Inc. — application and serverless function hosting
- GitHub, Inc. — source code hosting
- Telegram FZ-LLC — alert delivery (scorexact Pro subscribers only)
- SportMonks — public sports data provider (does not receive your personal data; listed here for transparency on data sourced from them)
- Google Ireland Limited — advertising (Google AdSense display ads; Google Ad Manager rewarded ads, only if you choose to watch one)
- Public authorities, where required by applicable law
International data transfers
Some of the recipients listed above are located outside the European Union (in particular the United States). Where this results in a transfer of your personal data to a third country, we ensure it is carried out under appropriate safeguards within the meaning of Art. 46 GDPR (standard contractual clauses, or the recipient's adherence to the EU-U.S. Data Privacy Framework, where applicable).
Your rights
In accordance with the GDPR, you have the following rights regarding your personal data: right of access, right to rectification, right to erasure, right to restriction of processing, right to data portability, right to object to processing, and right to withdraw your consent at any time (without affecting the lawfulness of processing carried out before withdrawal).
To exercise any of these rights, contact us at contact@scorexact.com. We will respond within one month, extendable by two additional months for complex requests.
You also have the right to lodge a complaint with the French data protection authority (CNIL): 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.
Security
We implement reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or alteration (encrypted transport, access restricted to what is necessary, reliance on hosting providers with recognized security certifications).
Changes to this Policy
This Privacy Policy may be updated to reflect changes to the Service or applicable regulations. The date at the top of this page indicates the last update. Material changes will be brought to your attention.
This page is available in several languages for convenience. In the event of any discrepancy or dispute regarding interpretation, the French version shall prevail.