Privacy Policy

The data controller is Ben Haile, a sole trader established in England and Wales, trading as karambet.

For anything in this policy — including a request to access or delete your data — contact benhailebusiness@gmail.com.

Account data. Your email address, and either a password (stored only as a hash by our authentication provider, never in readable form) or an identifier from the Google account you signed in with. We never receive your Google password.

Subscription data. Your plan, subscription status, the date the current period ends, whether a cancellation is pending, and the customer and subscription identifiers issued by Stripe. We also keep a record of the billing events Stripe sends us. We never receive or store your card number — card details are entered on Stripe’s own checkout page and stay with Stripe.

Product usage. Which matches you have unlocked with your free allowance and when, so that the allowance can be counted and not double-charged.

Analytics and attribution. When you first arrive we generate a random visitor identifier and store it in a cookie, together with any campaign parameters in the link you followed, the referring website, and the time you landed. We record a small set of milestone events against that identifier — landing on the site, viewing a demo, starting sign-up, completing sign-up, spending an unlock, reaching the upgrade page, and starting or completing checkout — plus whether you are browsing inside an app’s built-in browser. The visitor identifier is a random value; it is not derived from your IP address, email, or device. It is linked to your account only after you successfully sign up.

Technical logs. Our hosting providers process standard server logs, which include IP addresses, for security and reliability. We also use privacy-focused page and performance analytics from our host, which report visits in aggregate.

Anti-abuse signals. To stop people creating many accounts to farm free unlocks, we may record coarse signals such as a hashed device or network identifier, failed verification attempts, and the rate at which accounts are created, and use them to rate-limit clear outliers.

• To provide the service — your account, your free allowance, and your subscription. Legal basis: performance of our contract with you.
• To take payment and keep billing records. Legal basis: performance of our contract, and our legal obligation to retain financial records.
• To keep the service secure and prevent abuse. Legal basis: our legitimate interest in protecting the service and other users.
• To understand which content brings people to the site and where they drop out, so that we can improve it. Legal basis: your consent for non-essential cookies, and otherwise our legitimate interest in improving a service you use.
• To contact you about your account — sign-in links, verification codes, receipts, and material changes to the service or these policies. Legal basis: performance of our contract.

We use a small number of first-party cookies. We do not use advertising cookies.

• Authentication cookies — set by our authentication provider to keep you signed in. Strictly necessary; the site cannot work without them.
• kb_vid — a random visitor identifier, stored for 30 days, used to join the milestone events described in section 2 into a single anonymous journey.
• kb_attr — the campaign parameters and referrer from your first visit, stored for 30 days, so that we can tell which post or link brought you here. The first visit wins: later links do not overwrite it.
• kb_sid — a random identifier kept only for the current browser session, used to distinguish same-session conversion from later visits.

You can delete or block cookies in your browser settings at any time. Blocking the authentication cookies will prevent you from signing in; blocking the other three has no effect on how the product works for you.

We keep the list short and use each provider only for what it is named for. Each acts as our processor under contract.

• Supabase — authentication, the account database, and delivery of sign-in and verification emails.
• Stripe — payment processing and the billing portal. Stripe is an independent controller of the payment data it collects; see its own privacy policy.
• Vercel — hosting of the website, plus aggregate page and performance analytics.
• Railway — hosting of the statistics service that produces the numbers you see.

Our account database is hosted in Stockholm, Sweden. Sweden is in the European Economic Area, which the UK Government has found to provide an adequate level of protection, so no further safeguard is needed for that transfer. Stripe and Vercel may process data in the United States; those transfers rely on the UK’s approved safeguards, such as the International Data Transfer Agreement or the UK Extension to the EU–US Data Privacy Framework. We will also disclose data where the law requires it.

• Account and subscription data: for as long as your account is open, and for 30 days after you ask us to delete it.
• Billing and tax records: six years from the end of the relevant financial year, as UK tax law requires. This applies even after your account is deleted.
• Analytics and attribution events: 24 months.
• Server logs: as retained by our hosting providers, typically for a short period for security purposes.

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted, subject to records we must keep by law
• restrict or object to how we use it, including where we rely on legitimate interests
• receive your data in a portable form
• withdraw consent at any time, where we rely on consent

Contact benhailebusiness@gmail.com to exercise any of these. We will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.

Access to your account requires authentication, passwords are only ever stored hashed by our provider, database access is restricted by row-level security so that one account cannot read another’s data, and traffic is encrypted in transit. No system is perfectly secure, but we take these measures seriously and review them.

karambet is not for anyone under 18 and we do not knowingly collect data from children. If you believe a child has given us personal data, contact us and we will delete it.

The statistics and probabilities shown in the product are generated by models applied to public match data — not to you. We do not profile you, and we do not make automated decisions about you that produce legal or similarly significant effects. The only automated limits we apply to an account are the free-unlock allowance and the anti-abuse rate limits described in section 2, and you can contact us to have either reviewed.

If we change this policy the date at the top of the page will change, and we will tell you by email or in the product where the change materially affects you.