Privacy policy

The data controller is Perform Code SAS, 216 rue Clémenceau, 59139 Wattignies (France), registered with the Lille Métropole Trade and Companies Register under number 942 543 943. For any request relating to your data, contact us at [email protected].

To run Elofoot, we collect: (a) account data — email, username, password hashed with Argon2; (b) technical data — connection logs, anonymised IP address, user-agent for security purposes; (c) usage data — generated predictions, favourites, preferences; (d) payment data processed exclusively by Stripe (no card number is stored by Elofoot); (e) consent records — every acceptance of the Terms of Service and every marketing opt-in/opt-out is logged (timestamp, document version, anonymised IP and user-agent at the time of the action) to meet our CNIL evidential obligations. No sensitive data within the meaning of article 9 GDPR is collected. When you pay with mobile money, the payment is processed by our provider pawaPay and approved by you with your operator: Elofoot stores neither a mobile money wallet number nor a PIN code. The phone number is entered on the pawaPay payment page; Elofoot only keeps the information needed to track the payment (transaction ID, amount, currency, country, operator and status).

To run the roulette, Elofoot processes the account ID, draw timestamp, random result and awarded prize. To enforce the 24-hour limit and prevent multiple accounts, we also use a hashed device identifier, a technical anti-fraud fingerprint and a dedicated HttpOnly cookie. For a Pro prize, Stripe promotion and code identifiers are stored; Elofoot stores no card data.

The draw and award rely on performance of the requested service; abuse prevention relies on Perform Code SAS's legitimate interest in protecting fairness and security. The draw ledger is retained with the account and deleted with it, subject to billing data that Stripe and Perform Code SAS must retain to comply with legal obligations.

Your data is used to: (a) provide the service (generate predictions, track your favourites); (b) secure your account; (c) process payments through Stripe; (d) send transactional emails (verification, security, payment confirmation) — these emails are essential to performing the contract and don't require your consent; (e) if, and only if, you've consented, send marketing emails (newsletter, product tips, plan upgrade offers). No data is used for external advertising profiling or sold to third parties. The payment processing referred to in (c) includes, for mobile money payments, their processing through our provider pawaPay.

Processing is based on: performance of the contract (provision of Starter, Pro and Elite subscriptions, transactional emails), legitimate interest (account security, fraud prevention), explicit consent (marketing communications — you can withdraw this consent at any time) and compliance with legal obligations (invoicing, accounting, evidential consent log).

Account data is retained for as long as your account is active. On account deletion, user data is erased within 30 days; only invoices are kept for ten years to comply with accounting and tax obligations (article L123-22 of the French Commercial Code). Technical logs are kept for a maximum of twelve months.

Your data is only shared with our technical processors: Railway Corp. (hosting and infrastructure, United States) under Standard Contractual Clauses and Data Privacy Framework, Stripe (payments), Brevo (transactional AND marketing emails if you've consented — segmentation by subscription plan only, without Stripe customer ID; France/EU), and our AI provider (Anthropic Claude, EU/USA — DPF) to generate predictions. No resale to third parties, no sharing for commercial purposes. For mobile money payments, offered in certain countries only, we also rely on pawaPay (mobile money payment provider), which receives the transaction ID, the amount and the country; the phone number is entered directly on the pawaPay payment page and the payment is approved by you with your mobile operator.

You have the right at any time to access, rectify, erase, object, restrict and port your data. You can also set post-mortem directives. You can export all your data (including your consent history) or delete your account directly from your settings, or by writing to [email protected]. Marketing consent can be withdrawn at any time via your 'Email notifications' settings or via the unsubscribe link at the bottom of every marketing email (compliant with RFC 8058). We respond within one month at most (article 12 GDPR). In case of persistent disagreement, you can file a complaint with the CNIL: www.cnil.fr.

Passwords hashed with Argon2, TLS encryption in transit, time-limited sessions with token rotation, per-user data isolation. As no system is infallible, you'll be informed in the event of a security incident affecting your data within 72 hours, in accordance with article 34 GDPR.