Privacy Policy

1. Who We Are & GDPR Article 13 Compliance

Bucephus (“we”, “us”, “our”) is the Data Controller under GDPR. This policy outlines our compliance with Article 13 of the GDPR, explaining how we collect and process personal data when you use bucephus.com(the “Service”). Our legal basis for processing includes contract performance (payments and platform operation), consent (cookie preference, marketing), and legal obligations (KYC verification).

2. Data We Collect

• Account data: Email address, name, and OAuth profile data collected via Clerk Auth (Google, email).
• Payment data: Payment card details processed exclusively by Stripe — we never store raw card numbers.
• Identity data (KYC): Passport or driver's licence scan for Top 10 leaderboard entries or VIP Athlete Pass checkout, processed via Stripe Identity.
• Usage data: Page views, prediction events, session duration via PostHog (anonymised IP).
• View history: Market pages you view are stored temporarily (72 hours) to power trending and personalized recommendations. No browsing history is retained beyond this window.
• User-generated content: Predictions, chat messages, room names stored in Supabase.

3. How We Use Your Data

• Providing and improving the Service.
• Processing payments and tier upgrades.
• Sending transactional emails (account verification, purchase receipts) via Resend.
• Detecting and preventing bot activity and fraud.
• Complying with legal obligations (KYC, anti-money-laundering screening).

We do not sell your personal data to third parties. We do not use your data for automated profiling that produces legal or similarly significant effects.

4. Pulse Credits

Pulse Credits are non-monetary, non-redeemable loyalty tokens. They cannot be purchased with real money, transferred between users, or converted to cash. They carry no monetary value and are governed solely by our Terms of Service.

5. Cookies & Tracking

We use strictly necessary cookies (authentication sessions via Clerk) and analytics cookies (PostHog). You may opt out of analytics tracking in your browser settings. We do not serve third-party advertising cookies.

6. Data Retention & Deletion

Account data is retained while your account is active. You may request deletion by emailing [email protected]. Stripe and Clerk retain data per their own retention policies. KYC data is retained for 5 years to satisfy regulatory requirements.

7. Your Rights (GDPR / CCPA)

Depending on your jurisdiction, you have rights to access, rectify, erase, port, or restrict processing of your data. EU/UK residents may lodge a complaint with their local data protection authority. California residents may exercise their CCPA rights via the contact below.

8. Third-Party Services

The following third-party processors handle data on our behalf:

9. Contact

Privacy questions: [email protected]