Privacy Policy

GP Predictor is a free Formula 1 prediction competition operated by A.O. Clubul Sportiv FORMULA, a non-commercial association registered in the Republic of Moldova. This policy explains what personal data we hold, why we hold it, and what you can ask us to do with it.

Who we are

The controller of your personal data is A.O. Clubul Sportiv FORMULA, a non-commercial association established in the Republic of Moldova. For anything in this policy — a question, a request or a complaint — write to policy@formula1.md.

What we collect

• Account — your name, email address, a hash of your password, your interface language and time zone, and any optional profile details you choose to fill in, including phone number and date of birth. We use these to run your account.
• Social sign-in — the provider, your identifier at that provider, the email address it returns, and the times the link was made and last used. We use these to sign you in.
• Messaging — the platform and the chat and user identifiers it assigns you, but only if you link a bot yourself. While you are registering through a bot, that conversation also holds the display name from your messaging profile and, briefly, the name and email address you type in; the conversation expires automatically. We use these to send you the reminders and results you asked for.
• Gameplay — your predictions, bets, scores and league memberships. We use these to run the competition and produce the standings.
• Technical — the IP address and browser user agent recorded with your sessions, entries in our activity log, and records of the bot commands you send us and the bot messages we send you. We use these for security and audit.

We store a hash of your password, never the password itself. We ask for no payment details, because there is nothing to pay for, and we collect no special categories of personal data.

Why we may use it

• To perform our agreement with you — creating and maintaining your account, accepting your predictions and bets, scoring them and publishing the standings.
• Our legitimate interests — keeping the competition fair, preventing abuse and duplicate accounts, securing the service, and keeping an audit trail of administrative and scoring decisions.
• Your consent — linking a messaging bot and receiving messages through it. You may withdraw this consent at any time by unlinking the bot, without affecting what was done beforehand.

Cookies

We set these cookies, and no others:

• a session cookie, gp-predictor-session, which keeps you signed in while you browse;
• a CSRF token cookie, XSRF-TOKEN, which protects the forms you submit against cross-site request forgery;
• a remember-me cookie, set only when you choose to stay signed in.

Your language preference is not a cookie at all — we hold it in your session. The first two cookies are strictly necessary for the site to work; the third is set only if you ask for it.

Who we share it with

We do not sell your personal data, and we do not hand it to anyone for marketing. We pass it only to the providers we need in order to run the service:

• our hosting provider, which stores the application and its database;
• our email provider, which delivers account messages such as address verification and password resets;
• the messaging platform you choose to link, which receives only what is needed to deliver a message to your chat.

Our odds provider receives no personal data: we read published odds from it and send it nothing about our members. We disclose data to public authorities only where the law obliges us to.

Where your data is kept

Your data is stored on servers in the European Union. We are established in the Republic of Moldova, so administering the service means we reach that data from Moldova.

How long we keep it

Your account and gameplay data are kept for as long as your account exists. Entries in our activity log are deleted automatically on the schedule below.

The first tier is kept indefinitely because it is the competition's own history and its audit trail. Bot conversations are short-lived: each one carries its own expiry time and is discarded once that time passes.

Inactive accounts are deleted automatically

If an account goes 180 days without a sign-in and has never been used to play — no predictions, no bets, no league of its own, no linked bot, no push notifications and no social sign-in — we delete it. We would rather not hold personal data for an account nobody uses.

You are warned by email twice before anything happens: once 30 days ahead and again 3 days ahead. Both emails carry a link that cancels the deletion in one click without a password, and simply signing in cancels it just as well. An account that is in use, that holds even a single prediction or bet, or that administers a league is never picked up by this process at all.

This is not the same as deleting your account yourself. That de-identifies you and keeps the competition history; this removes the account record outright, because by definition no competition history is attached to it. We email you to confirm once it is done. A dated record of the deletion — including the account's name and email address — stays in the member-actions log, which, as the table above says, we keep indefinitely as the service's audit trail.

Your rights

Where the law gives you the following rights, you have them here:

• Access — to know what data we hold about you and to receive a copy of it.
• Rectification — to have inaccurate data corrected; most of it you can edit yourself in your profile.
• Erasure — to have your personal data removed, as described in the next section.
• Restriction — to have us stop using your data while an objection, or a dispute about its accuracy, is resolved.
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format.
• Objection — to object to processing that we base on our legitimate interests.
• Withdrawal of consent — to withdraw a consent you gave, such as the one for bot messaging, at any time.
• Complaint — to lodge a complaint with your data protection supervisory authority.

To exercise any of these, write to policy@formula1.md from the address on your account. We reply within one month.

Deleting your data

Deleting your account does not erase the competition's history, and we will not pretend otherwise. What it does is irreversibly de-identify you: your name, email address, password, profile details, social sign-in links, any linked bot and the records of your bot commands and messages are destroyed, while your past predictions, bets and results stay in the historical standings under an anonymous label, so that the placings of the members you competed against are unaffected. Nothing in the anonymized record leads back to you, and the step cannot be undone.

Erasure takes effect on our live systems immediately. Backups are not edited; they age out on their own rotation and are overwritten in the ordinary course. Full instructions, including what to do if you can no longer sign in, are on the Data Deletion Instructions page.

Children

GP Predictor is not intended for children. You must be at least 16 years old to hold an account, and we do not knowingly collect personal data from anyone younger. If you have reason to believe a child has created an account, write to us and we will remove it.

Changes to this policy

When we change this policy materially we will update this page and announce the change in the application. Continuing to use GP Predictor after a change means the updated policy applies to you.

Questions or requests about this policy: policy@formula1.md