Privacy Policy

xG Stat (“we”, “us”, “our”) provides football analytics products and services. We are established in the Netherlands as an eenmanszaak (sole proprietorship) and registered with the Dutch Chamber of Commerce (KvK) under number 98415018. We act as the data controller for personal data processed via our website and app.

This Privacy Policy explains what we collect, why we collect it, and how you can exercise your rights under the EU/UK GDPR and the ePrivacy rules. If anything here is unclear, contact us at support@xgstat.com.

1) What data we collect

a) Account & authentication

• Email address and hashed credentials (if you sign up with email/password).
• If you use a third-party login (e.g. Google), we may receive your email and basic profile details made available by that provider.

b) Billing & payments

Payments are processed by Stripe. We do not store card numbers on our servers. Stripe provides us with limited billing metadata (e.g. subscription status, payment method type, last 4 digits, transaction timestamps). See Stripe's privacy notice for details.

c) Usage, device & cookies

• We collect essential technical data needed to operate the service (e.g. session tokens, security events, server logs).
• With your consent, we collect analytics events (e.g. page views, feature interactions) via tools such as Google Analytics and/or PostHog. IPs are either anonymised or truncated when supported.
• Cookies and local storage are used for essential functions (login, preferences) and, if you opt in, analytics/marketing. See “Cookies & consent” below.

d) Support & communications

When you contact us (email or forms), we process the information you provide to handle your request.

We do not intentionally collect special categories of personal data (e.g. health, political opinions) and we do not knowingly collect data from children under 16.

2) Why we process your data (legal bases)

• Contract necessity: to create and manage your account, provide the service, process payments, and deliver customer support.
• Legitimate interests: to keep our platform secure (fraud/abuse prevention), to debug and improve core functionality, and to defend legal claims. We balance these interests against your rights and expectations.
• Consent: for non-essential cookies/trackers (analytics/marketing). You can withdraw consent at any time via the cookie banner/settings.
• Legal obligation: to comply with tax, accounting, and regulatory requirements.

3) Cookies & consent

We use a consent banner to obtain your choice before setting any non-essential cookies or loading analytics/marketing tags. Categories used:

• Essential – required to run the site (authentication/session, security).
• Analytics – to understand product usage and improve the experience (Google Analytics, PostHog, Canny feedback).
• Marketing – advertising and marketing cookies (Google Ads, if enabled).

You can change your choice any time via Cookie settings.

4) Processors & transfers

We use third-party providers (processors) to host and operate xG Stat. These currently include:

• Hosting/Infrastructure: e.g. Vercel (EU/US locations depending on configuration).
• Payments: Stripe (EU/US). Card data handled by Stripe.
• Analytics (consent-based): Google Analytics, PostHog, and Canny (user feedback).

Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and vendor commitments. More details are available on request.

5) Retention

• Account data: kept while your account is active, then deleted or anonymised.
• Billing records: retained for up to 7 years to comply with Dutch tax law.
• Analytics data (if consented): retained only as long as necessary for improvement and typically no longer than 24 months (tool-specific).
• Server logs/security events: short-term retention for debugging and abuse prevention.

6) Your rights

If you are in the EEA/UK, you have the right to request access, rectification, erasure, restriction, portability, and to object to certain processing. You can also withdraw consent at any time (this does not affect past processing based on consent).

Contact us at support@xgstat.com to exercise your rights. You also have the right to lodge a complaint with your local supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

7) Security

We use technical and organisational measures appropriate to the risk (TLS in transit, access controls, least-privilege, regular updates). No system is perfectly secure; we encourage you to use a strong, unique password and keep your credentials safe.

8) Children

xG Stat is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.

9) Changes to this policy

We may update this Privacy Policy to reflect changes in our services or legal requirements. We will post the updated version here and update the "Last updated" date. If changes are material, we will provide a more prominent notice.

10) Contact

For any privacy questions or requests, email support@xgstat.com.

Controller: xG Stat, registered in the Netherlands (KvK 98415018), based in Amsterdam.

Note: Rules for brand, logo and visual usage are covered by our Terms of Service / Brand Guidelines (not by this Privacy Policy).