xG Stat (“we”, “us”, “our”) provides football analytics products and services. We are established in the Netherlands as an eenmanszaak (sole proprietorship) and registered with the Dutch Chamber of Commerce (KvK) under number 98415018. We act as the data controller for personal data processed via our website and app.
This Privacy Policy explains what we collect, why we collect it, and how you can exercise your rights under the EU/UK GDPR and the ePrivacy rules. If anything here is unclear, contact us at support@xgstat.com.
1) What data we collect
a) Account & authentication
Email address. New accounts are created with Google or Apple sign-in, or with a one-time code sent to your email address. If your account predates that change, we may still hold a hashed password for it.
If you use a third-party login (Google or Apple), we receive your email address and the basic profile details that provider makes available.
b) Billing & payments
Payments are processed by Stripe. We do not store card numbers on our servers. Stripe provides us with limited billing metadata (e.g. subscription status, payment method type, last 4 digits, transaction timestamps). See Stripe's privacy notice for details.
c) Usage, device & cookies
We collect essential technical data needed to operate the service (e.g. session tokens, security events, server logs).
With your consent, we collect analytics events (e.g. page views, feature interactions) via tools such as Google Analytics and/or PostHog. IPs are either anonymised or truncated when supported.
Cookies and local storage are used for essential functions (login, preferences) and, if you opt in, analytics/marketing. See “Cookies & consent” below.
d) Support & communications
When you contact us (email or forms), we process the information you provide to handle your request.
e) Push notifications (optional)
Push notifications are off unless you turn them on. If you do, your browser or app creates a push subscription and we store it against your account so we can send the alerts you asked for (for example the full-time verdict for a team you follow).
What we store: a subscription endpoint URL issued by your browser's push service, the encryption keys needed to send to it, and the device or browser it was created on. A subscription is per device, so each device you enable is stored separately.
How messages reach you: through the push service operated by your browser or platform vendor (for example Google, Mozilla or Apple). That service can see the endpoint and the encrypted message, and we cannot control its own processing. Notification content is end-to-end encrypted between us and your device.
Legal basis: your consent, given when you accept the notification prompt. You can withdraw it at any time in Account → Notifications, or by revoking the notification permission in your browser or device settings.
Retention: the subscription is deleted when you turn notifications off on that device, when the push service reports it as expired, or when you delete your account.
We do not use push notifications for advertising, and we do not share push data with anyone beyond the push service required to deliver the message.
f) AI assistant connections (optional)
You can connect an AI assistant (Claude or ChatGPT) to your account so that it can look up xG Stat data on your behalf. The connection uses OAuth: the assistant never sees your password or a session cookie, and you can disconnect it at any time in Account → AI assistants or from the assistant itself. When you connect one, we process:
A consent record for the connection: which assistant you approved, when, and the tokens that let it call us. Access tokens expire after 15 minutes and are renewed by the assistant while the connection is live.
A per-call event for each question the assistant puts to our data: the tool name, your plan tier, which assistant called, the outcome (answered, nothing stored yet, not found, over quota or error) and how long it took. We never record the question you typed, the arguments the assistant sent, or the answer text.
Daily usage counters that enforce the fair-use limits: calls per day, calls per minute, and which players, teams and matches you looked up that day. They expire within 8 days.
Each answer, including a summary of your synced fantasy squad if you ask for it, is returned to the assistant provider you chose and is then handled under that provider's own terms and privacy policy, not ours. Answers are short written summaries with a link to the page they came from; they never include raw match event data.
Legal basis: contract necessity for the connection and the calls you make through it, and our legitimate interest in keeping the service fair and secure for the usage counters and the per-call event.
We do not intentionally collect special categories of personal data (e.g. health, political opinions) and we do not knowingly collect data from children under 16.
2) Why we process your data (legal bases)
Contract necessity: to create and manage your account, provide the service, process payments, and deliver customer support.
Legitimate interests: to keep our platform secure (fraud/abuse prevention), to debug and improve core functionality, and to defend legal claims. We balance these interests against your rights and expectations.
Consent: for non-essential cookies/trackers (analytics/marketing). You can withdraw consent at any time via the cookie banner/settings.
Legal obligation: to comply with tax, accounting, and regulatory requirements.
3) Cookies & consent
We use a consent banner to obtain your choice before setting any non-essential cookies or loading analytics/marketing tags. Categories used:
Essential - required to run the site (authentication/session, security).
Analytics - to understand product usage and improve the experience (Google Analytics, PostHog).
Marketing - advertising and marketing cookies (Google Ads, if enabled).
You can change your choice any time via .
4) Processors & transfers
We use third-party providers (processors) to host and operate xG Stat. These currently include:
Hosting/Infrastructure: e.g. Vercel (EU/US locations depending on configuration).
Payments: Stripe (EU/US). Card data handled by Stripe.
Analytics (consent-based): Google Analytics and PostHog.
Error monitoring: Sentry, to detect and diagnose faults.
Email: Resend, for account emails and the content emails you have opted into.
Push delivery: the push service of your own browser or platform (Google, Mozilla or Apple). We do not choose it; your browser does when you enable notifications.
AI assistant providers (optional): the maker of the assistant you connect (Anthropic for Claude, OpenAI for ChatGPT). They act on your instructions, not ours: the answers we return to them are processed under their terms.
Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and vendor commitments. More details are available on request.
5) Retention
Account data: kept while your account is active, then deleted or anonymised.
Billing records: retained for up to 7 years to comply with Dutch tax law.
Analytics data (if consented): retained only as long as necessary for improvement and typically no longer than 24 months (tool-specific).
Server logs/security events: short-term retention for debugging and abuse prevention.
Push subscriptions: kept until you turn notifications off on that device, the push service reports the subscription as expired, or you delete your account.
AI assistant connections: the consent record and its tokens are deleted when you disconnect the assistant or delete your account; usage counters expire within 8 days; the per-call event is kept with our analytics data, typically no longer than 24 months. What an assistant provider keeps of an answer is governed by that provider's own retention policy.
6) Your rights
If you are in the EEA/UK, you have the right to request access, rectification, erasure, restriction, portability, and to object to certain processing. You can also withdraw consent at any time (this does not affect past processing based on consent).
Contact us at support@xgstat.com to exercise your rights. You also have the right to lodge a complaint with your local supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
7) Security
We use technical and organisational measures appropriate to the risk (TLS in transit, access controls, least-privilege, regular updates). No system is perfectly secure; we encourage you to use a strong, unique password and keep your credentials safe.
8) Children
xG Stat is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
9) Changes to this policy
We may update this Privacy Policy to reflect changes in our services or legal requirements. We will post the updated version here and update the "Last updated" date. If changes are material, we will provide a more prominent notice.
