The short version: we keep what your free profile needs, we never sell it, optional emails need your clear yes, and you can see, export or delete your data at any time.
1. Who we are
Road2Sushi (road2sushi.com) is responsible for the personal data described here (the data controller). Contact us about anything in this policy at info@road2sushi.com. Postal address: info@road2sushi.com.
2. Reading the site without a profile
You can read everything without a profile. Our own code adds no advertising or analytics trackers and does not measure anonymous visitors. Like every website, our web host processes technical data such as your IP address to deliver the pages and keep them secure. Some club and league logos may load from public image servers (jsDelivr and API-Sports), which then see your IP address. Your betslip is stored only in your own browser.
3. What a free profile stores
- Account: your email address, a username made from it, a one-way hash of your password (never the password itself), whether you confirmed your email, when you declared that you are 18 or older, which version of the Terms of use and this policy you accepted and when, your last sign-in, and where you signed up (the sign-up page or a pop-up) and how you reached it: the kind of page and button you came from (for example a match page and the menu), the name of the website that sent you if there was one (for example google.com) and campaign tags in the link. We never store the address of the page, and nothing is stored in your browser for this.
- What you choose to save: the bets you log in My Bet Tracker, your favourite leagues and clubs, your display and betting settings (odds format, time zone, default stake, weekly ceiling, a break), your home page layout, and your community name, score predictions and private league.
- Activity: only with Statistics consent in Cookie settings and while signed in, we note when you were last active, on how many days, roughly how long (at most 60 seconds per minute and 4 hours per day are counted) and which kinds of pages you open, linked to your profile. No IP address, browser details or page links are stored. You can withdraw Statistics consent in Cookie settings or turn measurement off in Settings under Privacy. Switching off deletes the saved activity summary. Summaries expire after 90 days without activity and are removed by daily housekeeping. Staff accounts are never measured. Separately, an unconfirmed profile keeps a coarse last-use timestamp, updated at most daily without page history, so an active profile is not deleted as unused.
- Email choices: whether you want optional emails, which leagues, bet types and topics, how often, and a record of each consent or unsubscribe with the time, where it was given and the words you agreed to.
- Emails we sent you: a log with the date, type, subject and result of each email, and a copy without any links (links in account emails carry one-time codes, so we remove them before storing).
4. Why we use it, and on what legal basis
- To run your profile (contract): sign-in, your tracker, favourites, settings and account emails such as confirmation, password reset and security notices. Account and security emails cannot be switched off while you have a profile.
- To send optional emails (consent): tailored predictions and updates only if you ticked the box at sign-up or turned them on in Settings, and only after you confirmed your email address. Linking email engagement to your account is a separate choice that is off unless you turn it on.
- To keep the site safe (legitimate interest): bot protection, rate limits, the known-device cookie and a coarse last-use timestamp to protect active profiles from cleanup.
- Optional preferences and activity statistics (consent): on-site prompt memory and signed-in activity measurement only with the corresponding cookie choice. You can withdraw either choice in Cookie settings. Optional email consent is a separate choice.
- To meet legal duties (legal obligation): for example to answer a data request or keep records the law requires.
5. Who else processes data for us
- Brevo sends our emails. It receives your email address and the email itself, and, only if you chose optional emails, keeps you on our mailing list. It acts as our data processor.
- Cloudflare Turnstile checks that the sign-up and password reset forms are used by a person and not a bot. Cloudflare processes your IP address and browser signals for that check; we only receive whether it passed.
- Our web host stores the site and its database.
We do not sell your data and we do not share it for advertising. Where a provider processes data outside the EU/EEA, we rely on the safeguards the GDPR requires for such transfers.
6. Cookies and browser storage
- Sign-in cookies keep you signed in for up to 90 days on a device. They are needed for the profile to work.
- A known-device cookie (sushi_ld, up to 365 days, only after a successful sign-in) lets our login protection recognise your own device, so a lock-out aimed at an attacker does not lock you out.
- Your betslip is kept in your browser (local storage) and never reaches our server. Optional pop-up memory and activity measurement require their separate cookie choices.
7. How long we keep it
- Your profile data is kept until you delete your profile. Deleting it in Settings removes it for good. One exception keeps the community game fair: predictions already sealed on the locked board of the round in progress stay there, under the public name they were sealed with and without your account, until that round ends.
- An unused profile whose email was never confirmed gets a reminder after 7 days and can be deleted from day 14, but only if it holds no saved data, has not been used within the last 14 days, and the reminder was accepted for sending at least 7 days earlier. Using the profile cancels any previous cleanup reminder.
- The email log is deleted after 90 days.
- Confirmation and email change links expire after a few days. A link that lets your previous address undo an email change works for 7 days.
- Security counters such as rate limits expire on their own within about an hour.
8. Your rights
You can ask for a copy of your data, ask us to correct or erase it, restrict or object to how we use it, and receive it in a portable format. You can withdraw consent to optional emails at any time with the unsubscribe link in every such email (no sign-in needed) or in Settings, without affecting what happened before. Write to info@road2sushi.com and we answer through the WordPress export and erasure tools, normally within one month. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk) or to the authority where you live.
9. Age
Road2Sushi is for adults only. We do not knowingly keep data about anyone under 18. If you think a child has created a profile, tell us and we will delete it.
10. Changes to this policy
When we change what we store or why, we update this page and its version date. If the change matters for your profile, Settings shows the new version so you can read and accept it.
This policy belongs together with our Terms of use. Questions or requests: info@road2sushi.com.
