Courtesy translation provided for information purposes — in the event of any discrepancy, the French version prevails.
Privacy Policy
Compliant with the General Data Protection Regulation (GDPR — EU 2016/679) and the French Data Protection Act.
1. Data controller
Data controller: KACZOR IT CONSULTING, SARL with share capital of 1,000 €, publisher of the ZeroStake website
Registered office: 4 rue du Lavoir, 95680 Montlignon, France — RCS Pontoise 995 084 308
Contact for personal data matters: [email protected]
2. Data collected
Account data (required at sign-up):
- Email address
- Username
- Password (stored as an argon2id hash — never in plain text)
Fictional game data (generated through use):
- Fictional bets placed, history and simulated results
- Fictional balance and fictional wallet transactions
- Game statistics (fictional ROI, fictional win rate)
- Membership of fictional groups
Support data (if you write to us):
- Name or username, email address, subject and content of your message
- Subsequent exchanges related to that request
- The contact form can be used without an account: in that case only this data is processed
Subscription data (only if you subscribe to ZeroStake PRO):
- Stripe customer ID, subscription status and renewal date
- Payment is handled entirely by Stripe: ZeroStake never sees, receives or stores any card data
Technical data:
- Access logs (IP address, user-agent, date/time) — retained 90 days
- JWT session cookie (httpOnly, secure, sameSite=strict)
- Refresh token (SHA-256 hashed in the database)
ZeroStake collects no banking data, no payment card, no identity document. All bets, balances and winnings in the application are 100% fictional: no real-money deposit, withdrawal or winnings exist. The only possible real payment is the optional ZeroStake PRO subscription, collected by Stripe, which unlocks features — never game money.
3. Legal basis for processing
Performance of the contract (Art. 6.1.b GDPR): processing of account and fictional game data to provide the service the user signed up for.
Legitimate interest (Art. 6.1.f GDPR): securing the application (access logs, fraud detection, token rotation).
Consent (Art. 6.1.a GDPR): cookies that are not strictly necessary — only after the user's explicit consent.
4. Retention periods
Account data: for as long as the account is active. Upon a deletion request, the account and all associated data are immediately and permanently removed from the active database.
Fictional game data: for as long as the account is active, then immediate deletion upon closure (cascading deletion with the account).
Backups: residual copies may persist for up to 30 days in the encrypted database backups before being automatically overwritten. These backups are never restored except in the event of a major technical incident.
Support messages: 3 years from the last exchange, in line with the limitation period applicable to consumer disputes. Earlier deletion on request when no dispute is pending.
Subscription data: retained for the duration of the subscription. The associated invoices and accounting records are kept for 10 years as a legal obligation (Art. L123-22 of the French Commercial Code) — this obligation prevails over a deletion request.
Technical logs: rolling 90 days.
Refresh tokens: 30 days, then automatic invalidation.
5. Your rights
Under the GDPR and the French Data Protection Act, you have the following rights:
- Right of access: obtain confirmation that data about you is being processed and receive a copy of it.
- Right to rectification: have inaccurate data about you corrected.
- Right to erasure: request the deletion of your data (via the "Delete my account" function in the settings).
- Right to portability: receive your data in a structured, machine-readable format.
- Right to object: object to processing based on legitimate interest.
- Right to restriction: request the temporary suspension of processing.
To exercise these rights: [email protected]. Response within 30 days. In the event of a dispute, you may lodge a complaint with the CNIL (the French data protection authority).
6. Cookies
Strictly necessary cookies (no consent required):
- JWT session cookie — authentication, session duration
- Refresh token cookie — httpOnly, secure, sameSite=strict
- Interface preferences (theme) — localStorage
Audience measurement cookies — subject to consent:
With your agreement ("Accept all" button), we use Google Analytics 4 (provided by Google Ireland Ltd) to measure site audience in aggregate (page views, referrers, devices). These cookies are never set without your prior explicit consent, which you can withdraw at any time via the cookie banner.
- Google Analytics cookie lifetime: 13 months maximum
- Audience data retained by Google: 14 months maximum
- Anonymised IP — never cross-referenced with your account data
Advertising or third-party tracking cookies:
No advertising or third-party tracking cookie is set without your prior explicit consent. With your “Advertising” consent, we use the Meta pixel (Meta Platforms Ireland Ltd) to measure the effectiveness of our advertising campaigns. No personal data from your account is sent to it, and you can withdraw your consent at any time via the cookie banner.
7. Transfers outside the European Union
ZeroStake's infrastructure is hosted by OVHcloud on servers located in the European Union. Your account and fictional game data are stored there and do not leave it.
Stripe (Stripe Payments Europe Ltd, Ireland) receives your email address and account identifier only if you subscribe to the PRO plan, for payment and invoicing management. Stripe may transfer this data to Stripe Inc. (United States), covered by the EU–US Data Privacy Framework and standard contractual clauses. Without a subscription, no data is sent to Stripe.
If, and only if, you accept audience measurement cookies, Google Analytics may involve a transfer of technical data to Google LLC (United States). This transfer is covered by the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), to which Google LLC has certified, as well as by standard contractual clauses. If you refuse these cookies, no such transfer takes place.
AI-generated analyses: match analyses and daily selections are produced via Anthropic's API (Claude). Only public sports data (teams, competition, odds, statistics) is sent to it — no personal data about you: no email, no username, no identifier, no betting history. Your analyses are then stored on our European infrastructure and linked to your account, with us only.
8. Data security
ZeroStake implements the following technical and organisational measures:
- Password hashing with argon2id
- Refresh tokens hashed in the database (SHA-256)
- Encrypted transmission via HTTPS/TLS
- Automatic JWT token rotation (15-minute expiry)
- httpOnly, secure, sameSite=strict cookies
- Rate limiting on authentication endpoints
Last updated: July 2026