Privacy Policy

drills.poker is operated by Social Done For You LTD, which acts as the controller of personal data described in this Privacy Policy, unless we say otherwise. Contact: Email: info@drills.poker Address: 167-169 Great Portland Street, 5th Floor, London, W1W 5PF

This Privacy Policy applies to personal data we process when you: - visit our website; - create or use an account; - purchase or manage a subscription; - use the app's training, tracking, social, creator, referral, or support features; - contact us; or - otherwise interact with the Service.

We may collect the following categories of personal data. A. Account and profile information This may include: name or display name; email address; username; password or authentication identifiers; profile photo or avatar; biography, social links, or creator information; role or plan information; preferences and settings. B. Session, bankroll, training, and app-use information If you use the app's tracking and training features, we may process data such as: bankroll/session entries; live-session information; cash and tournament details; location/venue/casino details you enter or select; tags, notes, expenses, and session metadata; training progress, scores, accuracy, XP, streaks, and module usage; player notes and tracked-opponent information you enter; hand replay data and hand-builder data; stable/backing/staking data, percentages, makeup fields, deal logs, proof uploads, and related records; dashboards, summaries, and analytics derived from the above. C. Social/community information If the Service includes social features, we may process: friends/connections; comments, messages, reactions, or shares; activity-feed events; leaderboard positions; social preferences and notification settings. D. Payment, subscription, and billing information If you purchase a subscription or receive creator/affiliate/referral benefits, we may process: plan and billing status; payment-related records from our payment providers; subscription status; invoices, receipts, and transaction metadata; creator/affiliate/referral performance, credits, discounts, and payout-related information. We do not store full payment card numbers ourselves where a third-party payment processor handles them. E. Referral, affiliate, and creator-program data If you participate in these features, we may process: referral codes and referral links; click, signup, and conversion records; creator application details; social/channel links you submit; payout profile and payout status information; related fraud, validation, or compliance checks. F. Device, technical, and usage information We may automatically collect: IP address; browser type and version; device type; operating system; app/site usage events; pages viewed; timestamps; crash, performance, and diagnostic data; referrer information; cookie, local storage, or similar identifier data. G. Location data If you use location-based features such as "near me", we may process approximate or precise location data from your device or browser at the time you choose to use that feature, subject to your device/browser permissions and settings. H. Support and communications If you contact us, submit feedback, report bugs, or communicate with us, we may process: your contact details; support messages; screenshots or attachments you send us; support history; bug/feedback metadata.

We collect personal data: - directly from you; - automatically when you use the Service; - from payment, authentication, analytics, hosting, email, and other service providers; - from referral/creator/affiliate workflows; - from device/browser permissions when you choose to use those features; and - from cookies and similar technologies where applicable.

We use personal data for the following purposes. A. To provide the Service This includes: creating and managing accounts; authenticating users; operating app features; saving sessions, notes, drills, and settings; syncing data across the Service; providing dashboards, records, and reports; enabling social/community functionality; enabling backing/stable/referral/creator workflows. Lawful basis: contract; legitimate interests. B. To process subscriptions, billing, payouts, and account administration This includes: handling subscriptions, renewals, invoices, receipts, and plan entitlements; managing refunds, credits, discounts, validations, and payout records; administering referral, affiliate, and creator features. Lawful basis: contract; legal obligation; legitimate interests. C. To improve, analyse, and secure the Service This includes: usage analytics; product improvement; debugging; fraud detection; abuse prevention; security monitoring. Lawful basis: legitimate interests; consent where required. D. To communicate with you This includes: service messages; account and billing notices; support responses; security alerts; important policy or product updates. Lawful basis: contract; legitimate interests; legal obligation where applicable. E. To send marketing or promotional communications Where we send optional marketing, newsletters, or promotional communications, we will do so in accordance with applicable law and, where required, your consent or another valid legal basis. Lawful basis: consent where required; legitimate interests where permitted by law. F. To comply with law and protect rights This includes: responding to lawful requests; enforcing our terms; protecting our rights, users, staff, systems, and property; investigating suspected abuse or unlawful activity. Lawful basis: legal obligation; legitimate interests.

We may use cookies, local storage, pixels, scripts, and similar storage/access technologies for: - essential site/app functionality; - authentication and security; - preferences; - analytics and performance; - onboarding and product experience; - attribution and referral measurement. The analytics ones are named, because you are asked about them by name. Google Analytics (Google Ireland Limited) and PostHog (EU hosting) are loaded only if you agree on the cookie banner, and not before. Decline and neither script is added to the page at all. If you agree, PostHog receives the pages and drills you open, the elements you click and the text on them, and, once you are signed in, your email address as the identifier for your account. Session replay is switched off. Google Analytics receives a smaller set, filtered by a fixed list before it is sent: the page, the drill or feature, your plan, how you found us, and a random identifier that is not your email address and is not derived from it. It is never sent your name, your email address, the venue you play at, or what you have won or lost. Either way, whether you agree or not, we count page views in our own records on our own servers, so we can tell which parts of the product are used. That measurement is not shared with anybody and you can ask us to delete it. If you arrive through a creator's or affiliate's link we remember that code for the visit so the right person is credited. You can change your answer at any time: Cookie settings at the bottom of this page, or Settings, then Privacy, inside the app. Declining after having agreed also deletes the Google and PostHog cookies already on your device.

We may share personal data with: - hosting and infrastructure providers; - authentication providers; - payment processors; - analytics and performance providers (Google Analytics and PostHog, as described in section 6, and only with your agreement); - customer support, email, and communications providers; - cloud storage and database providers; - mapping / geolocation / venue-search providers; - fraud-prevention or security providers; - professional advisers where reasonably necessary; - authorities, regulators, courts, or law enforcement where required by law or to protect rights; and - other users, but only to the extent your settings, actions, features, or relationship workflows are designed to share content with them. Who those providers actually are, today, so the list above is not the only answer you get: - Our application platform provider hosts drills.poker, stores the database and handles sign-in. Everything you put into drills.poker is stored with them. We will name them on request. - Stripe takes payments. Card details go to Stripe and never reach us: we hold the customer and subscription identifiers Stripe gives back, and whether you are on a paid plan. - Resend sends our automated and transactional email, and Brevo holds the contact record behind our email programme. Both receive your email address and the name on your account. - Google Analytics and PostHog, only if you agree on the cookie banner, as described in section 6. - OpenStreetMap's Overpass service is asked for casinos near you, and only when you tap Near Me while starting a session and our own venue list does not have enough matches. It receives an approximate position, rounded to about a kilometre, never your exact one. - An AI service provided through that platform reads the screenshots and spreadsheets you choose to upload to the tournament scanner and the session importer, so that the figures in them can be filled in for you. Only the file you upload for that purpose is sent, and only when you start a scan or an import. We may also share data in connection with a merger, acquisition, financing, reorganisation, or sale of assets, subject to appropriate safeguards. We do not sell your personal data.

The Service may process records, notes, uploads, screenshots, hand data, proof submissions, and other user-generated materials. Please remember: - other users may rely on your submissions operationally, but we do not independently verify all user-submitted content; - user-submitted data may be incomplete, inaccurate, delayed, or disputed; and - use of these features does not make us a party to any private arrangement between users.

Some of our providers may process personal data outside your country. Where we transfer personal data internationally, we will use appropriate safeguards where required by law, such as contractual protections or recognised adequacy mechanisms.

We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including to: - provide the Service; - maintain user records and account history; - comply with legal, tax, accounting, and regulatory obligations; - investigate disputes, abuse, or fraud; - enforce our agreements; and - improve and secure the Service. Retention periods may vary depending on the type of data and the purpose. Account/profile data may be retained while your account remains active and for a reasonable period afterwards. Subscription and billing records may be retained for longer where required for accounting, tax, legal, or audit reasons. Where appropriate, we may delete, aggregate, or anonymise data. Two periods we can give you now rather than in general terms. The usage events behind our own internal dashboards, which record which pages and drills were opened and when, are deleted automatically after thirteen months. And when you ask us to delete your account, your data is removed within 30 days of the request: you can ask from Settings, then Account, then Delete account, or by emailing info@drills.poker. We action deletion requests by hand, we keep a record of each request so none is lost, and we stop sending you marketing as soon as the request is made rather than when it is completed.

Depending on your location and applicable law, you may have rights including: - the right to be informed; - the right of access; - the right to rectification; - the right to erasure; - the right to restrict processing; - the right to data portability; - the right to object; and - the right to withdraw consent where consent is our basis. These rights are not absolute and may be subject to conditions or exceptions. To exercise rights, contact us at: info@drills.poker We may need to verify your identity before acting on a request. If you are unhappy with how we handle your personal data, you may also have the right to complain to your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

We use reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure. No system is perfectly secure, and we cannot guarantee absolute security. You are also responsible for helping protect your account, including by keeping credentials secure and using appropriate device/browser security.

The Service is not intended for children. We do not knowingly collect personal data from anyone under the applicable minimum age for use of the Service. If you believe a child has provided personal data to us unlawfully, contact us and we will investigate.

We may use automated tools for operational purposes such as analytics, fraud screening, entitlement checks, referral validation, or product personalisation. We do not make solely automated decisions with legal or similarly significant effects on you unless permitted by law and appropriately disclosed.

The Service may link to or integrate with third-party services. Their privacy practices are governed by their own policies, not ours, and we encourage you to review them.

We may update this Privacy Policy from time to time. If we make material changes, we may notify you through the Service, by email, or by other reasonable means. The "Last updated" date above will also change.

If you have questions or requests about this Privacy Policy or your personal data, contact: info@drills.poker 167-169 Great Portland Street, 5th Floor, London, W1W 5PF