Privacy Policy

Data controller

Optimer Solution AS (Norwegian company reg. no. 935 933 242) is the data controller for the personal data processed in Bantercup.

Privacy enquiries: postmaster@optimer.no

What data we process

• Email address — used for login and communication
• Display name — shown on leaderboards and member lists in your leagues (defaults to your email prefix)
• Predictions and answers — the scores you predict, answers to season and bonus questions, and the points you earn
• League memberships — which leagues you are in and your role (admin/player)
• Email preferences — whether you have opted out of newsletters
• Technical data — login timestamps, session IP address (stored by Supabase Auth for security)
• Payment data — if you activate a league as admin, we store a reference to the Stripe session. Card details never touch our systems.

Purpose and legal basis

We process this data to deliver the Service you signed up for. The legal basis is GDPR article 6(1)(b) — necessary to perform the agreement between you and us. Security logging relies on article 6(1)(f) — legitimate interest in preventing abuse.

Newsletters about new seasons and features are sent to existing users under the Norwegian Marketing Control Act § 15 (existing customer relationship). Every such email contains an unsubscribe link, and you can turn this off at any time on the profile page. Round reminders about your own predictions are part of the Service.

Who we share data with (processors)

We use the following sub-processors, all chosen for GDPR compliance and relevant security certifications:

We never sell or share your personal data with other third parties for marketing.

Retention and deletion

We keep your data for as long as you have an account. You can delete your account yourself from the profile page. If you have never played in a league or paid, everything is deleted immediately. If you have played with others, the account is anonymised instead: your name and email address are removed, while predictions and points remain in the league history without any link to you. Payment records are kept as long as Norwegian bookkeeping law requires (up to 5 years).

Your rights

Under the GDPR you have the right to:

• Access the data we hold about you
• Have inaccurate data corrected
• Have your data deleted (unless we are legally required to keep it)
• Receive your data in a machine-readable format
• Withdraw consent
• Complain to the Norwegian Data Protection Authority (datatilsynet.no)

Send requests to postmaster@optimer.no. We normally reply within 30 days.

Cookies

We only use strictly necessary cookies: your login session (Supabase Auth) and your language choice. We use no third-party tracking or analytics cookies.

Security

All traffic runs over HTTPS. You log in with a one-time code sent by email, or with a password of your choosing; passwords are stored only as secure hashes by Supabase Auth and cannot be read by us. Data is stored encrypted on Supabase servers in the EU.

Changes to this policy

We may update this privacy policy. Material changes are announced by email and in the Service at least 14 days before they take effect.