Privacy notice

This notice explains what BetSmart (“we”, “us”) stores about you, why, for how long, and what you can ask us to do with it. It covers the website at betsmart.org.uk, the research desk on it, and the BetSmart Telegram bots (the football bot, @BetSmartFootballBot, and the racing bot, @BetsmartRacingbot) with their channels and groups. We've tried to keep it plain. BetSmart is a research and tips service, not a bookmaker: we take no bets and hold no money for betting.

Who is responsible for your data

The data controller is Desultory LTD (company number 17361684, registered in England and Wales), the company named in our Terms. Questions, or any of the requests below: email privacy@betsmart.org.uk.

The website

• No advertising or tracking. The website uses no advertising, no tracking analytics and no tracking cookies. The only cookie it can set is the research desk's log-in cookie, described below, and only if you log in.
• Hosting. The site is hosted by Netlify, which processes basic technical request data (such as your IP address and browser type) to deliver it securely.
• Fonts. Pages load their fonts from Google Fonts, so your browser sends its IP address to Google when it fetches them.
• The free pick. The home page fetches the day's free-pick file from GitHub, so your browser's request (including its IP address) reaches GitHub. No information about you is sent with it.
• If you email us, we receive your email address and what you write, and use them to reply and to keep a record of the conversation.
• Security reports. Our pages carry security rules. Some we enforce, such as never letting another site show our pages inside a frame: your browser keeps to those and sends us no report about them. Others we are still testing: if something on a page breaks one of those, your browser loads it anyway and may send us a report. We keep only which rule it broke, which of our pages it was on, and where the item came from (just a website's address, such as example.com, or a word such as “inline”): no query string, no IP address, no cookie. Those reports are kept with the site's technical logs.

The research desk

The desk (the Research desk page) is for members, who log in with Telegram.

• Log in with Telegram. Telegram's log-in button, loaded from telegram.org, sends us what Telegram passes on when you log in: your Telegram user id and first name, your last name, username and a link to your profile photo if you have them on Telegram, the time you logged in, and Telegram's signature over all of it. We check the signature and that the log-in is less than a day old, check your id against the list described below, and ask Telegram whether that account is a member of our paid members' channels, which decides which parts of the desk you can open. We keep only what goes in the cookie below: not your photo link, not the log-in time, and not your username (unless you have no name on Telegram, when your username is your display name). Telegram's own privacy policy applies to its log-in button, which may set Telegram's own cookies.
• The bs_research cookie. When you log in, we set one cookie called bs_research. It holds a signed record of your Telegram user id, your display name (your first and last name on Telegram, or your username if you have no name there), which desks you can open (football, racing or both) and when it expires. It keeps you logged in so you don't have to log in on every page, and it lets the desk check access on each request. It lasts 12 hours, after which you log in again (so a lapsed membership stops working within 12 hours); logging out deletes it. It is marked HttpOnly, Secure and SameSite=Lax, and it is never used for tracking or advertising. Because it is strictly necessary for a service you asked for, it is set without a consent banner.
• Breaks and under-18 answers. When you log in, and on every request the desk makes for you after that, your Telegram user id is checked against the list the research desk uses to keep out readers who are on a break or who told us they are under 18. It holds a one-way code made from your id, not the id itself. The football bot makes the list on our server. Our sync job keeps a copy and publishes it with the desk to the website's host when the desk is next updated.
• The prices switch. If you switch bookmaker prices on or off, the desk remembers your choice in your browser's local storage (bs_odds). It stays on your device and is not sent to us.
• The desk keeps no database of who logged in. It counts, for each day, how many log-ins there were and how many times a members' feed was opened: a number only, with no user id, name, username or anything else about who it was. That count is written to our host's function log, which keeps it for seven days at most. Our host may also keep short technical logs of requests.

The Telegram bots

When you message a bot, Telegram passes it your Telegram user id and your public name and username; it never gives us your phone number. The football bot stores only your user id, not your name; the racing bot also stores your username and first name. Everything the bots keep is tied to your Telegram user id.

The football bot keeps

• Your settings: whether alerts are on and how many messages you want, quiet hours, your filters (minimum odds, leagues, markets), the bookmakers you hold, saved teams, players and fixtures, muted strategies and builder preferences, and whether you have seen the welcome tour.
• What you have open in the bot: the slips and rules you're building, your filters, the teams and players you looked at, the screen you were on and any reply it is waiting for, saved to a file so a restart doesn't lose it, and copied with the nightly backups. It has no set time limit. Within minutes of you taking a break it is cleared, and nothing more is saved to it until the break ends. It is deleted if you ask us to delete your data.
• What you choose to record: a betting bank (starting and current figure) if you set one; bets you log (stake, odds, selection, result, profit or loss); your current run of settled losses, which is used only to show a safer-gambling warning; rules you write; player watches and slips you save.
• Breaks (self-exclusion): when a break you started ends, whether you started it in this bot or in the racing bot.
• Your age answer: if we ask whether you are aged 18 or over (when you ask to join the free BetSmart group, or before the bot first shows you a tip or a price), your answer and when you gave it. If you say you are under 18, the bot closes to your account for good and removes you from our groups. That is not a break: it has no end date. If you pay for a plan, we are told your Telegram user id so that the plan can be cancelled and refunded.
• Your access: whether you have a subscription and how it was granted (the MyMembers members' channel, a Stripe payment, or a grant from us), and, if you paid through Stripe, your Stripe customer and subscription ids.
• What we sent you: which tips and alerts were sent to you and when, the message ids of your daily card so it can be updated, and a note if delivery to you keeps failing, so we stop retrying.
• What gets used: a daily count of the buttons you tapped, the commands you sent, the lookups you made by typing a name (only whether it was a player, team or fixture), and the buttons, commands, messages and inline searches the paywall turned down — the kind only, never what you typed, and no time of day — kept for 90 days. Nothing is counted while you are on a break.
• Research limits (only if a limited free or research plan is switched on): which player, team and fixture cards you opened each UK day, so a daily limit can be applied, kept for 90 days.
• How you found us and referrals: the label of the link that first brought you to the bot (for example a campaign link from a post), when you arrived, whether you joined the free BetSmart group, when you first opened a research card and when you first paid; if someone invited you, their user id and when you joined through their link; and, if an invite programme is running, a record of whether your first paid month earned the person who invited you a reward. If you joined through someone's invite link, that person may be told — in a message or on their /invite screen — that someone opened BetSmart through it, and later that a friend they invited has stayed subscribed for a set number of days. That never names you or gives your user id, but they may be able to tell it was you. When a referral reward falls due, the bot looks up the referrer's Telegram name and username and sends them, with both readers' ids and the date the friend subscribed, to the owner's own chat with the bot, so the reward can be paid.

The racing bot keeps

• Your Telegram user id, username and first name (saved or brought up to date when you start the bot or save something in it, and when you join the paid members' channel, even if you never open the bot), when we first saw your account, and whether your chat with the bot is active.
• Your settings: odds format, preferred bookmaker, odds range, result notifications, and whether you get the morning Ones-to-Watch message, with the date it was last sent to you.
• Horses you follow and the day we last told you about each, price alerts you set (kept after they fire or you cancel them), your bet slip, bets you log from it and their results, and which result and non-runner messages were sent to you.
• Breaks: when a break you started ends.
• If you told the football bot you are under 18: that, and when the racing bot learned it, so it stays closed to you too.
• Your access (subscription and how it was granted, Stripe ids if you paid through Stripe).

Breaks in both bots

• A break taken in either BetSmart bot applies in both, and so does telling the football bot you are under 18. For that, each bot passes the other your Telegram user id and when your break ends (or that you said you are under 18), as a file on our own server.
• The football bot also adds breaks taken in the racing bot to the list the research desk uses to keep out readers who are on a break or who told us they are under 18. It holds a one-way code made from your id, not the id itself.

Groups and channels

• If you join a BetSmart group or channel on Telegram, the bots can check whether you are a member. Depending on how a group is set up, other members may be able to see that you are in it: that is a Telegram feature.
• If you start a break in either bot, the football bot removes you from the free BetSmart group (and, when the members' channel feed is on, from that channel) until the break ends. If you pay for a plan, we are sent your Telegram user id and the date your break ends, so that we can pause your billing for the break if you ask us to. A plan keeps renewing during a break, and you can cancel it yourself at any time under My Orders at MyMembers.io; it then ends with the period you have paid for.

Technical logs

The servers that run the bots keep technical logs to find and fix faults. They can include your Telegram user id with what the bot did for you: the command or button you used, a message we sent or could not send, and a subscription starting or ending. Each log file is deleted 7 days after its last entry. The bots' screen output, which the server keeps by size rather than by date, has user ids blanked out.

Payments

Paid subscriptions are sold through MyMembers, with card payments processed by Stripe. When you subscribe, your account and payment details are collected and processed by them under their own privacy policies. We never see or store your full card details. MyMembers adds you to, and removes you from, the paid members' channels, and the bots read that membership to decide your access.

Why we use it, and on what basis

• To give you the service you asked for (the bots' features, your settings, the desk log-in, your subscription access): because it is necessary for our contract with you.
• Safer gambling (breaks, the losing-run warning, removing you from groups during a break, telling us about a paying reader's break): our legitimate interest, and yours, in making a break actually work.
• The age question (your answer, and closing the bot to an account that says it is under 18): our legitimate interest, and yours, in keeping BetSmart to adults.
• How readers find us, referral rewards and usage counts: our legitimate interest in knowing which posts and features are useful and in paying rewards we have promised. These never include what you type.
• Payment records: our contract with you and our legal obligations, such as tax records.

We don't sell your data, we don't use it for advertising, and we don't share it with bookmakers.

How long we keep it

• Usage counts (buttons, commands, typed lookups and paywall refusals): 90 days, then deleted automatically.
• Research-limit records: 90 days, then deleted automatically.
• How you found us and referral records: 24 months from when they were recorded. Deletion is not yet automatic, so we delete them by hand: if you ask us to delete them sooner, we will.
• Breaks (self-exclusion) and under-18 answers: A break that has not ended, and an under-18 answer, are kept even if you ask us to delete your data, so deleting can never reopen a bot early. A break that has ended is deleted with the rest.
• Technical logs: each log file on the bots' server is deleted 7 days after its last entry. The bots' screen output, which the server keeps by size rather than by date, has user ids blanked out. The website's technical logs (our host's function logs), which hold the desk's daily counts and the security reports, keep entries for seven days at most.
• The research desk's list: replaced each time the desk is updated. Earlier copies stay in our website host's record of past versions of the site until the host deletes them, which it does after 90 days at most.
• Backups: each bot's database is copied every night so it can be restored after a fault. Those nightly copies are deleted as new ones are made: the football bot's normally within a week, the racing bot's normally within two weeks. Copies of these nightly backups are also kept on the owner's computer, off the server, and deleted on the same schedule. If copying fails, the newest copy is kept until a newer one arrives. Copies we make by hand during maintenance are kept longer, until we delete them by hand. Something we delete can stay in a backup until that backup is deleted.
• The desk cookie: 12 hours, or until you log out.
• What you have open in the football bot (its saved session file): no set time limit; cleared within minutes of you taking a break, and deleted if you ask us to delete your data. Its nightly copies are deleted with the football bot's backups, above.
• Everything else (settings, bank, logged bets, rules, saved items, access records): while you use the bots, and deleted when you ask us to, apart from a break that has not ended, an under-18 answer, and anything the law requires us to keep.
• Emails: as long as needed to deal with your message, and no longer than 24 months.

Who else handles it

• Telegram delivers every message between you and the bots; Telegram's own privacy policy applies to your use of Telegram.
• Netlify hosts the website and runs the desk's log-in.
• MyMembers and Stripe handle subscriptions and payments.
• Google (fonts) and GitHub (the free-pick file) receive your browser's requests for those files.
• The bots run on a server provided by OVHcloud, in London, UK.

Some of these companies process data outside the UK, for example in the United States. Those transfers are covered by each company's own data-protection terms; email us if you want the details.

Your rights

Under UK data protection law you can ask for a copy of the personal data we hold about you, ask us to correct it or delete it, object to or ask us to restrict how we use it, and ask for it in a portable form. If you ask us to delete your data, we delete it, with two exceptions: anything the law requires us to keep, and the following. A break that has not ended, and an under-18 answer, are kept even if you ask us to delete your data, so deleting can never reopen a bot early. A break that has ended is deleted with the rest. Deleted data can stay in a backup until that backup is deleted (see "How long we keep it").

How to ask: email privacy@betsmart.org.uk with your Telegram username, so we can find your records. We may ask you to confirm the request from your Telegram account. There's no form for this inside the bots yet. We will reply within one month.

You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk.

Age

BetSmart is for adults aged 18 or over. The football bot may ask you to confirm you are 18 or over, and keeps your answer. If you tell it you are under 18, we keep that answer and its date so both bots stay closed to the account; if you think we hold anything else about someone under 18, email us and we will delete it.

Changes

We will update this notice when what we collect changes. The date at the top always shows the current version.

18+ only. Please gamble responsibly. Nothing on this site is financial advice. See our Terms.