CONTROLLER

Who is responsible for your data.

The data controller is Powerhouse Affiliates LLC, a Wyoming limited liability company established in the United States, which operates Powerhouse Sports Data. For anything in this policy, write to legal@powerhouseaffiliates.com.

Trading name: Powerhouse Sports Data
Legal name: Powerhouse Affiliates LLC
Entity type: Wyoming limited liability company
Wyoming Secretary of State filing ID: 2026-001935581
Registered agent: Registered Agents Inc
Registered office and mailing address: 30 N Gould St Ste R, Sheridan, WY 82801, United States
Legal and privacy contact email: legal@powerhouseaffiliates.com
Data protection contact: [PENDING: name or role of the privacy contact]
EU representative (GDPR art. 27): [PENDING: GDPR art. 27 EU representative: name and EU address]

We are not established in the European Union, but we offer our services to organisations and people in the EU and the wider European Economic Area, so the EU General Data Protection Regulation (GDPR) applies to the personal data we process about them (article 3(2) GDPR). Our representative in the EU under article 27 GDPR, who you can also contact about any data-protection matter, is: [PENDING: GDPR art. 27 EU representative: name and EU address].

Powerhouse Sports Data is a business-to-business service. It is not directed at consumers or at anyone under 18, and we do not knowingly collect data about them.

WHAT WE COLLECT

The data we collect, why, and for how long.

We collect only the data listed here. We do not sell personal data, we do not use it for automated decisions with legal or similarly significant effects, and we do not load advertising or third-party analytics trackers on this website.

Enterprise enquiry and demo requests

Where: The contact form at /contact.
Data: Full name, business email, company name, role, company website, country, company type, requested sports and delivery formats, audience scale, launch window, intended publishing use, any free-text message, and the first-touch attribution of the visit (the referring website's host name and any utm_source, utm_medium, utm_campaign and utm_content values in the landing URL).
Purpose: Replying to the enquiry, evaluating a possible licence or pilot, and preparing a commercial proposal. A notification containing the enquiry is emailed to our sales team.
Legal basis: Steps taken at your request before entering into a contract (GDPR art. 6(1)(b)) and our legitimate interest in answering business enquiries and understanding which channels bring them (art. 6(1)(f)).
Retention: Up to 24 months after our last contact with you if no contract follows; longer only if a contract is signed, as described under customer accounts.

Customer access applications

Where: The application form at /apply.
Data: Contact name, business email, company name, company website, country, intended publishing use, requested sports and delivery formats, and the time you ticked the agreement box. The form is protected by Cloudflare Turnstile, which checks the browser and receives your IP address when the token is verified.
Purpose: Reviewing whether to open a customer workspace, contacting you about the application, and protecting the form from automated abuse.
Legal basis: Steps taken at your request before entering into a contract (art. 6(1)(b)); our legitimate interest in preventing abuse of the form (art. 6(1)(f)).
Retention: Up to 24 months after the application is decided if no account is opened; otherwise as for customer accounts.

Customer and staff accounts

Where: The partner portal, staff control room and API.
Data: Name, business email, username, a salted password hash or passkey (WebAuthn) credential and any multi-factor settings, session tokens, the API keys and widget origins configured for your organisation (keys are stored hashed), and a record of administrative actions taken in the portal.
Purpose: Providing the licensed service, authenticating users, securing accounts, supporting customers and keeping an audit trail of administrative changes.
Legal basis: Performance of the licence agreement with your organisation (art. 6(1)(b)) and our legitimate interest in securing the service (art. 6(1)(f)).
Retention: For the duration of the agreement. After it ends, account data is deleted or anonymised within 90 days, except records we must keep for commercial, accounting and tax purposes, for as long as the applicable law requires (generally up to seven years).

Security and abuse prevention

Where: Every form and API request.
Data: Your IP address, reduced to its network prefix (/24 for IPv4, /64 for IPv6) and stored only as a keyed hash in a rate-limit counter; request identifiers; and the standard request logs kept by our hosting provider.
Purpose: Rate limiting, blocking automated abuse, investigating incidents and keeping the service available.
Legal basis: Our legitimate interest in the security of the service (art. 6(1)(f)).
Retention: Rate-limit counters expire with their time window and are purged automatically every hour. Hosting logs are kept for the provider's short standard retention period.

First-party website measurement

Where: Pages of powerhousesportsdata.com.
Data: Page views and clicks on main calls to action, recorded only as coarse categories: the section of the site, the kind of referrer, and the campaign source, medium and name. No cookie, device identifier, IP address or user identifier is stored with these events.
Purpose: Understanding which pages and campaigns bring business enquiries.
Legal basis: Our legitimate interest in measuring the performance of our website (art. 6(1)(f)). See the Cookie Policy for the session storage this uses.
Retention: Aggregated event records are kept for up to 24 months.

Business contacts and prospecting

Where: Our sales records (CRM).
Data: Names, job titles, business email addresses and company details of people at existing or prospective customers, which we receive from you directly, at events, or from public company websites and professional sources.
Purpose: Managing customer relationships and contacting organisations that may be interested in our B2B products.
Legal basis: Our legitimate interest in business-to-business marketing (art. 6(1)(f)). We only send commercial emails where the law that applies to the recipient permits it (for example the ePrivacy rules of an EU country or the US CAN-SPAM Act), and every message lets you object.
Retention: Until you object, or up to 24 months after the last meaningful contact.

Fields marked as required on our forms are needed to answer you; if you leave them out we cannot process the request. Ticking the agreement box on a form confirms that you have read this policy and want us to contact you about that request. Where we rely on legitimate interests, you can object at any time.

SERVICE PROVIDERS

Who processes data on our behalf.

These providers process personal data only on our instructions, under data-processing terms that meet article 28 GDPR.

Provider	What it does for us	Location and safeguard
Vercel Inc.	Hosting and delivery of the website, partner portal and API. Server functions run in the Dublin (Ireland) region; static content is served from a global edge network.	EU processing region; United States company (EU–US Data Privacy Framework and Standard Contractual Clauses).
Supabase Inc.	Database, user authentication and account emails such as sign-in and password recovery.	Database hosted in the AWS eu-west-1 region (Ireland); United States company (Standard Contractual Clauses).
Resend (Plus Five Five, Inc.)	Transactional email: internal notifications of enquiries and applications, and customer invitation emails.	United States (EU–US Data Privacy Framework and Standard Contractual Clauses).
Cloudflare, Inc.	Turnstile bot protection on the customer access application form.	Global network; United States company (EU–US Data Privacy Framework and Standard Contractual Clauses).
Proton AG	Business mailbox where our email is received and stored.	Switzerland (European Commission adequacy decision).

INTERNATIONAL TRANSFERS

Where your data is stored.

Powerhouse Affiliates LLC is a United States company, so our staff access and manage personal data from the United States. Our database is hosted in Ireland and our server functions run in Dublin, so data at rest is stored in the European Economic Area, but it is processed from outside the EEA whenever we or our providers work with it. Several providers are also United States companies and may access data, for example to provide support or deliver email. Transfers to providers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses (article 46 GDPR). Wherever data is accessed, we apply the protections described in this policy. You can ask us for a copy of the relevant safeguards.

YOUR RIGHTS

How to access, correct or delete your data.

You can ask us for access to your personal data, and for its rectification, erasure, restriction or portability. You can object to processing based on our legitimate interests, including business prospecting, and withdraw any consent you have given without affecting earlier processing. Send your request to legal@powerhouseaffiliates.com. We will reply within one month and may ask you to confirm your identity.

If you are in the EU or EEA and think we have not handled your data lawfully, you can complain to the data-protection supervisory authority where you live, work or think the problem happened. In Spain that is the Agencia Española de Protección de Datos (AEPD, www.aepd.es). We would appreciate the chance to resolve your concern first.

SECURITY

How we protect it.

Data is encrypted in transit, session cookies are HttpOnly and Secure, API keys are stored only as hashes, IP addresses used for rate limiting are stored only as keyed hashes of the network prefix, and administrative actions are recorded in an audit log. Access to customer data is limited to staff who need it.

CHANGES

Changes to this policy.

We update this policy when what we collect or the providers we use change, and show the date of the latest review at the top of the page. Cookies and browser storage are described in the cookie policy; use of the service is governed by the terms of service.