Privacy Policy

BetTrading.net

Effective Date: 24 September 2026

1. Introduction

Who we are. BetTrading.net is a service operated by JIA Software Limited, a company registered in England and Wales under company number 11905293, whose registered office is at Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, England, BL6 6HG. JIA Software Limited is the data controller for the personal data described in this policy. In this policy, "we", "us", "our" and "the Company" mean JIA Software Limited.

We are committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains what information we collect, how we use it, how we protect it, and your rights regarding your data.

BetTrading.net is an online subscription platform that provides a desktop trading application to our users. Our mission is to deliver a secure, reliable service while maintaining the highest standards of data protection and privacy.

This Privacy Policy applies to our website (BetTrading.net), desktop application, and all related services. Please read this policy carefully. By registering for an account or using our services, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

2.1 Account Registration Information

When you create an account with BetTrading.net, we collect the following information:

Email address
Password (stored securely as a cryptographic hash using Argon2id)
Age confirmation (18 years or older)

We do not ask for your name when you create an account. Registration collects only the three items above.

Display name is optional and is not collected at registration. Your account has one optional field for a name: a short display name you may add afterwards from your account settings. It exists for a single purpose — to greet you by name in the guides panel inside the desktop application — and nothing identifies, authenticates or bills you by it. You choose what it says, it need not be your real name, it may be left unset, and you can change or clear it at any time. If you do set one it is personal data like any other: it is included in the copy of your data we provide under Section 6, and it is erased with the rest of your account under Section 5. The other place we ask for a name is the pre-launch mailing list described in Section 2.8, which is a separate record and is not an account.

Country of residence is optional and is not collected at registration. You may add it afterwards from your account settings. Tax on a Pro subscription is worked out from the billing address you give at checkout, so this setting is for information only. It may be left unset, and you can change or clear it at any time.

2.2 Subscription and Billing Information

We collect subscription data including:

Subscription status (Active, Inactive, Past Due, Paused, or Cancelled)
Billing period dates
Cancellation and pause history

When you buy Pro, Stripe collects your payment details and your billing address on its own secure payment page. We receive from Stripe a customer reference, your billing name, email address and billing address, the card brand and the last four digits of the card, the payment status, and invoice and refund records. We never receive or store your full card number (see Section 9).

2.3 Analytics and Usage Data

We collect two types of analytics data ourselves, and we also use Google Analytics 4, as described below:

Anonymous First-Party Analytics (whether or not you are signed in):

On our website, including its help centre, these events are recorded only if you have accepted analytics cookies. On the help pages shown inside our desktop application, they are recorded without a cookie choice, because no cookie banner is shown there; Section 3.1 gives the lawful basis
Event names and actions performed
The pages you view, including pages you view while signed in, such as your account page
Search queries and result counts
Device classification (mobile, tablet, desktop)
Note: No cookies, IP addresses, or persistent identifiers are stored, and nothing links these events to your account
Data retained for 90 days then deleted

Authenticated Product Telemetry (logged-in users):

User ID and session ID
Event names and actions taken within the application
Surface accessed (website, desktop app)
Client version number
Your account's subscription tier (Basic or Pro)
Feature adoption and usage patterns
Help article interactions
Note: We NEVER collect betting information, including stakes, prices, selections, markets, profit/loss, or account balances
Data retained for 180 days then aggregated for long-term reporting

Website Analytics (Google Analytics 4):

User acquisition channels and traffic sources
Landing pages and user navigation paths
Device and browser information
Geographic location
Campaign performance data
If you had accepted analytics cookies when you started buying Pro: the identifier Google Analytics stored in your browser, which we keep with the record of that purchase, and, once your subscription first becomes active, a message from our server to Google Analytics saying a purchase was made, with the price and currency of Pro and our reference number for your subscription. That reference is a random number that means nothing outside BetTrading.net, and the message is sent once for each subscription. It never includes your name, your email address, your payment details or any betting information. If you had not accepted analytics cookies, our server sends Google no message about your purchase. Google's tag in your browser still sends the cookieless messages described in Section 2.9 when you view the Pro offer and when you leave our website for the payment page, and those messages include the price and currency of Pro. If you come back to our website from the payment page, the page you return to shows whether you paid or left without paying, and the messages sent from it contain nothing that identifies you or your device. The Cookie Policy, Section 3.2, explains this in full
What Google Analytics does depends on your choice in the cookie banner. If you accept analytics cookies, Google Analytics sets its cookies and measures your visits in the usual way. If you choose Reject all, or have not yet made a choice, no analytics cookie is set and no identifier is stored on your device, but Google's tag still sends Google short measurement messages without cookies. Section 2.9 explains what those messages contain, why we send them and how to stop them

2.4 Attribution Data

We track your first-touch attribution to understand how you discovered BetTrading.net:

Initial traffic source (organic, direct, referral, paid campaign)
Marketing medium
Campaign name (if applicable)
Landing page

2.5 Legal and Compliance Data

We collect and maintain records of your acceptance of our legal terms:

Age confirmation (18+ years)
Privacy Policy acceptance (versioned, timestamped, and IP-recorded)
Terms of Service acceptance (versioned, timestamped, and IP-recorded)
Your choice about analytics cookies is not among these records: it is kept only in your browser (Cookie Policy, Section 3.1)
Your product telemetry preference (see "Legal bases for processing" below — telemetry runs on legitimate interest, so we record your opt-out rather than an opt-in)
Marketing email opt-in/opt-out status

2.6 Security and Audit Logs

We maintain detailed audit logs of security-related activities for your protection:

Login attempts and authentication events
Account access by support staff
Subscription status changes
Role changes and permission modifications
Timestamps and IP addresses associated with these events

2.7 Device and Technical Information

When you use our desktop application, we may collect:

Application version number
Desktop operating system information
Client-side session information
Note: No personal behavioural or betting data is transmitted from the desktop application

2.8 Mailing List and Registration of Interest

Before we launch, our website invites you to register your interest so that we can tell you when BetTrading.net becomes available. This is separate from an account: joining the mailing list does not create an account, there is no password, and you are not signed in.

If you complete that form, we collect:

First name
Last name
Email address
Your marketing choice — whether you want to hear from us — and the date it was recorded
The same first-touch attribution fields described in Section 2.4 (traffic source, marketing medium, campaign name, and landing page)

Lawful basis: consent. The form asks whether you want to be emailed and we record that choice against your entry. Because the form is public and unauthenticated, a later submission of your address can switch that consent off but can never switch it back on — nobody can consent to marketing on your behalf.

What we use it for: telling you when BetTrading.net launches, and sending news and offers about the service. We do not sell this list, share it with other companies for their own marketing, or use it to advertise to you elsewhere.

How to unsubscribe: every marketing email we send will carry an unsubscribe link. That link opens the /unsubscribe page on our website and records your withdrawal immediately — you do not need an account and you do not need to sign in. You can also email privacy@bettrading.net at any time and ask to be removed. No marketing email has been sent yet, because we have not launched.

Retention: we keep your entry until you ask us to remove it, or until the mailing list has served the purpose it was collected for, whichever comes first. If you unsubscribe rather than asking for erasure, we keep your email address and the record that you withdrew, so that you are not added back. If you hold a BetTrading.net account under the same email address, the matching mailing-list entry is erased when you delete that account, and it is included in the copy of your data we provide under Section 6.

2.9 Google Analytics Without Analytics Cookies

Our website loads Google's tag on every page except the pages of its help centre, whatever you choose in the cookie banner, unless you have used Stop measurement without cookies as described below. What the tag does depends on your choice in the banner. This way of using Google's tag is known as the advanced form of Google Consent Mode.

If you accept analytics cookies, Google Analytics sets the cookies listed in the Cookie Policy, Section 3.2, and measures your visits in the usual way, recognising your browser from one visit to the next by the identifier those cookies hold. Section 2.3 describes that measurement.

If you choose Reject all, or have not yet made a choice, Google Analytics sets no cookie, reads no cookie and stores no identifier on your device. Google's tag still sends Google a short message, known as a cookieless ping, each time a page is viewed and each time one of the events we measure happens, such as creating an account, signing in, viewing the Pro offer or leaving our website for the payment page. Each message contains:

the name of the event and the details we record with it: the price and currency of Pro and where you started to buy it, including whether you were starting Pro again after a pause; which billing option you chose on your account page and, if you chose to pause Pro or to keep Pro instead of letting a scheduled pause start, whether you then confirmed it and whether it went through; whether you agreed to marketing emails when you joined our mailing list; which form field caused an error when you created an account, and the kind of error; that you created an account or signed in with an email address on our website; which version of the application you chose to download; the colour theme you switched to, and whether you chose it, it followed your device's setting, or our desktop application set it; the choice you made in the cookie banner, and which version of the banner you saw; and which part of our service the event came from
the address and title of the page. We remove everything from the address except the page itself and any campaign details, such as which advertisement or email brought you to us, so the codes in the links we email you, such as a password reset link, are never sent
the address of the page that brought you to ours (the referrer), if your browser shares it, with its address reduced in the same way
the date and time
your browser's user agent, which names your browser, its version and your operating system
your IP address, which Google receives with every message and which Google states Google Analytics does not log or store
the fact that you have not consented to analytics cookies

Google's documentation says these messages may also contain your screen resolution, whether the address of a page you visited included information from clicking an advertisement, and a random number generated each time a page loads. Our website loads once and then changes page without reloading, so that number can stay the same while you move around the site during one visit. It is not stored on your device.

Google's advertising features stay switched off whatever you choose: we never allow Google's tag to use advertising cookies, or to use your data for advertising or advertising personalisation. Google's tag is not loaded on any page shown inside our desktop application, or on the pages of our website's help centre, so none of this happens there.

What the messages are used for. Google uses them to produce aggregate reports for us, such as how many pages were viewed, where visitors came from and where they left, and, once enough people use the website, to model, that is to estimate, the behaviour of visitors who have not accepted analytics cookies.

Our lawful basis. We send these messages on the basis of our legitimate interests: understanding, in aggregate, how our website is used, so that we can improve it. We have assessed that interest against your rights and freedoms. Google receives and processes the messages as one of the service providers listed in Section 4.1, and may process them in the United States under the safeguards described in Section 11. Google keeps the individual messages for the period set in our Google Analytics property, which Google limits to 14 months at most; the aggregate reports built from them do not identify anyone and are not affected by that setting. When we switch on Google Analytics' daily export to Google BigQuery (Section 4.1), these messages are copied there in the same way as every other event Google Analytics collects, and the copy is kept for the period we set on that export.

Your right to object, and how to stop the messages. You have the right to object to this processing at any time. To object, use Stop measurement without cookies in the Cookie settings section at the end of our Cookie Policy; from then on our website does not load Google's tag in that browser. You can also email privacy@bettrading.net and we will explain how. Every page's footer links to the Cookie Policy as Cookies.

Choosing Reject all does not stop these messages. We cannot find the messages sent from your browser among everyone else's, because they carry no identifier, so we cannot pick them out, stop them or delete them for one person from our side. That is why the control works in the browser you use it in: if you use more than one browser or device, use it in each. You can also stop the messages yourself in either of these ways, and our website works normally with either in place:

turn on your browser's tracking protection, or use a content blocker, and make sure it blocks googletagmanager.com. Our website loads Google's tag from there, so if it is blocked, no messages are sent
install Google's Analytics Opt-out Browser Add-on (https://tools.google.com/dlpage/gaoptout), which Google provides to stop its analytics scripts sending information to Google Analytics

We take the objections we receive into account when we review our assessment.

3. How We Use Your Information

We use the information we collect for the following purposes:

Account Administration: Creating, managing, and maintaining your account
Service Delivery: Providing and improving the BetTrading.net platform and desktop application
Authentication: Verifying your identity and managing your login sessions securely
Subscription Management: Managing subscription status, cancellations, and pauses
Communications: Sending transactional emails (verification, password reset, subscription confirmations)
Legal Compliance: Maintaining age verification records and terms acceptance for legal compliance
Product Analytics: Understanding feature adoption, user engagement, and platform improvements
Security: Detecting and preventing fraud, unauthorised access, and abuse
Support: Providing customer support when you contact us
Marketing Attribution: Tracking which campaigns successfully convert users (with consent)

We use your data in an aggregated, anonymised form to:

Generate analytics reports and dashboards
Identify usage trends and optimise platform performance
Create weekly analytics snapshots for long-term reporting
Make informed decisions about feature development and product roadmap

3.1 Legal bases for processing

Under UK GDPR we must tell you the lawful basis for each kind of processing:

Performance of a contract — creating and running your account, authenticating you, and managing your subscription. Without this data we cannot provide the service you are paying for.
Legal obligation — age verification records, terms and privacy acceptance records, and subscription and billing history retained for tax and accounting purposes.
Consent — analytics cookies and the Google Analytics measurement that uses them, including the purchase measurement described in Section 2.3, and the mailing list described in Section 2.8. Analytics cookies are not set until you accept them, and you may withdraw either consent at any time (see Section 6).
Legitimate interests — authenticated product telemetry, the anonymous first-party analytics recorded on the help pages shown inside our desktop application (Section 2.3), the Google Analytics measurement without cookies described in Section 2.9, security and audit logging, and fraud prevention. Our legitimate interest is in understanding which features are used and how our website is used so we can improve them, and in keeping accounts secure.

For Google Analytics without cookies specifically, Section 2.9 sets out what is sent, our assessment, and how to object and stop it.

For product telemetry specifically, we rely on legitimate interests rather than consent, and we balance that against your rights by: collecting no betting information of any kind; retaining event-level data for only 180 days; and giving you an opt-out in your account settings and in the desktop application's Preferences. When you opt out, the server stops recording your telemetry on arrival — it does not rely on the application choosing not to send it.

You have the right to object to processing based on legitimate interests at any time (see section 6).

4.1 Third-Party Service Providers

We share your information with trusted third-party service providers who assist us in operating our platform:

Azure Services (Cloud Infrastructure):

Azure SQL Database: Stores your encrypted personal and subscription data
Azure Key Vault: Secures our cryptographic keys and secrets
Azure Communication Services: Sends transactional emails on our behalf

Stripe and its affiliates:

Payment processing, subscription billing, tax calculation and fraud prevention

Our contract for these services is with Stripe Payments Europe, Limited. Where Stripe's Financial Services Terms apply, Stripe Payments UK Ltd may also act. Stripe also acts as an independent controller when it meets its own legal and fraud-prevention obligations. Stripe's privacy policy explains that processing.

Google Services:

Google Analytics 4: Measures how our website is used, with analytics cookies if you accept them and without cookies if you do not (Section 2.9). Google keeps the individual events for the period set in our Google Analytics property, which Google limits to 14 months at most
Google BigQuery: Once we switch on Google Analytics' daily export, receives a copy of the raw events Google Analytics collects, including the messages sent without cookies described in Section 2.9, and keeps it for the period we set on that export. You can stop both in the ways Section 2.9 describes
Google Search Console: Provides search query data and SEO insights

All third-party service providers are contractually required to maintain the confidentiality and security of your data and to use it only for purposes authorised by us.

4.2 Legal Requirements

We may disclose your information if required by law, regulation, or legal process, including but not limited to:

Responding to a subpoena, court order, or government agency request
Enforcing our Terms of Service or other agreements
Protecting the safety, rights, and property of BetTrading.net, our users, or the public

4.3 Business Transfers

In the event of a merger, acquisition, bankruptcy, or sale of assets, your information may be transferred as part of that transaction. We will provide notice of any such change in ownership or control of your personal information.

5. Data Retention

We retain your information for as long as necessary to provide our services and comply with legal obligations. Specific retention periods are:

Account Data: Retained for the life of your account, plus 30 days after account deletion for GDPR compliance
Anonymous Analytics: Deleted after 90 days
Authenticated Product Telemetry: Retained for 180 days, then aggregated into permanent snapshots
Weekly Analytics Snapshots: Retained permanently for historical reporting
Audit Logs: Retained for security and compliance purposes, minimum 1 year
Consent Records: Retained for the life of your account and 30 days after deletion
Checkout Records, including the Google Analytics identifier described in Section 2.3 where you had accepted analytics cookies: deleted when you close your account
Mailing List Entries: Retained until you ask to be removed. If you unsubscribe rather than asking for erasure, your email address and the record of your withdrawal are kept so that you are not added back (see Section 2.8)
Subscription History: Retained for 7 years after the subscription ends, for financial and tax compliance
Billing Event Records Received from Stripe: The message Stripe sends us about a payment carries your billing name, email address, billing address, and the card's brand and last four digits. We delete that message 90 days after we receive it, and keep the event's reference and type for 7 years with your subscription history
Billing Email Records: for each email about your subscription, or about closing your account, that we owe you, such as a purchase confirmation, a notice that a payment has failed or the date your account will close, we keep which email it is, the dates it concerns, and whether and when it was sent. We keep nothing of its content beyond the few facts needed to write it, and never your email address. Each record is deleted 90 days after the email was prepared, or when your account is erased if that is sooner
Azure Database Backups: Minimum 7-day retention for disaster recovery

When you request account deletion, we:

Stop any subscription from renewing, so you are not charged again. A paid-up subscription is cancelled with effect from the end of the period you have already paid for, as our Terms of Service say, and closing your account does not by itself refund any of that period. If a payment has failed, or a pause you asked for has already started, we cancel it at once. A pause that has not started yet is cancelled instead, and the subscription ends at the end of the period you have already paid for. We also close any payment you started but did not finish
Close your account when that paid-up period ends, if you have one. Until then your account stays open, you keep Pro, we keep your data as we do for any open account, and you can keep your account from your account page instead. If you have no paid-up subscription, we close your account straight away
On closing your account, soft-delete it (marking it as deleted but retaining data) and sign you out everywhere
Permanently erase your personal data within 30 days of closing your account, except the subscription history and security records described in this section
Erase associated analytics events, attribution data, and help article feedback
Erase any mailing-list entry held under the same email address
Keep your subscription history for 7 years after the subscription ends, including after your account is erased, because tax and accounting law requires it

What your subscription history still contains once your account is erased. It no longer includes your name or email address. It does still include:

the dates, price and status of each subscription, each change to its status, and which of our processes made each change
the reason for cancelling, if you chose one from the list Stripe offered
Stripe's reference for each subscription, and for each message Stripe sent us about it
the internal number we gave your account

This history is not anonymous. Stripe's references can be matched to Stripe's own records of your payments, which include your name, email address and billing details. Your account number also appears in our security records (see Section 2.6), next to the IP addresses used to sign in to and manage your account, so for as long as we keep those records — at least 1 year — they can link your subscription history to those IP addresses. The history we keep is therefore pseudonymised rather than anonymous: it is still personal data, and we treat it as such.

Stripe keeps its own records of your payments for the periods the law requires, and we cannot delete them.

If you are located in the European Union, United Kingdom, or other jurisdictions with similar privacy laws, you have the following rights:

Right to Access (Data Subject Access Request):

You have the right to request a copy of all personal data we hold about you. We will provide this information in a structured, commonly-used format (typically JSON) within 30 days of your request.

Your account settings include a "Download my data" option that gives you most of that copy immediately: your account details, your subscription and consent history, your product usage events, any help-page feedback you have left, and your marketing list entry if you have one. Our security audit records — the sign-in, password and account-change events described in section 2.6, and the timestamps and IP addresses attached to them — are not part of that download, because we also keep them to protect accounts and to meet our own security obligations. They are still your personal data: email privacy@bettrading.net and we will include them in a full copy within 30 days.

Right to Rectification:

If you believe any of your personal data is inaccurate or incomplete, you may request that we correct it. You can change your display name and your country of residence yourself in your account settings, and clear either of them there. To correct your email address, or anything else, email us at privacy@bettrading.net and we will make the change.

Right to Erasure ("Right to be Forgotten"):

You have the right to request deletion of your account and all associated personal data. You can close your account from your account page. When you do, we will:

Close your account straight away and sign you out everywhere, if you do not have Pro, if a payment for your subscription has failed, or if a pause you asked for has already started
If you have a paid-up Pro subscription, including one with a pause that has not started yet, keep your account open, and you keep Pro until the end of the period you have already paid for. Your subscription will not renew, and we close your account when that period ends. We email you the date it will close, and until then you can choose Keep my account on your account page to withdraw your request
Permanently erase your personal data within 30 days of closing your account
Note: Some data is kept for longer to meet legal and financial obligations — your subscription history, which we keep for 7 years after the subscription ends and which is pseudonymised rather than anonymous, and our security records, which we keep for at least 1 year. Section 5 explains what is kept and for how long

Right to Data Portability:

You have the right to receive a copy of your personal data in a structured, commonly-used, machine-readable format (JSON) and to request that we transfer it to another service provider. We will provide this within 30 days of your request.

Right to Object to Processing:

You have the right to object to our processing of your personal data for marketing purposes, analytics, or other non-essential purposes. Each preference has its own control, and they are deliberately kept apart because they cover different processing on different lawful bases:

Analytics cookies, and the Google Analytics measurement that uses them (consent) — use the Cookie settings section at the end of our Cookie Policy, which every page's footer links to as Cookies. Before we launch, a Cookie settings link on the pre-launch page reopens the consent banner instead. This choice is remembered in the browser you make it in, not against your account.
Product telemetry (legitimate interests) — use the Product analytics opt-out in your account settings, or the equivalent setting in the desktop application's Preferences. This one is stored against your account and applies on every device you sign in from.

These two are separate controls over separate processing, and neither changes the other. Declining analytics cookies does not switch off product telemetry, and opting out of product telemetry does not decline analytics cookies — so if you want both stopped, set both. Your account page shows the state of each and links to the other.

Marketing email (consent) — every marketing email we send will carry an unsubscribe link, which opens the /unsubscribe page on our website and records your withdrawal immediately. You do not need an account and you do not need to sign in. You can also email privacy@bettrading.net and ask to be removed. Section 2.8 sets out what the mailing list holds and how long we keep it.
Google Analytics without cookies (legitimate interests) — choosing Reject all does not stop the cookieless measurement messages Google's tag sends. To object, use Stop measurement without cookies in the same Cookie settings section at the end of our Cookie Policy, reached from the Cookies link in every page's footer; our website then stops loading Google's tag in that browser. Section 2.9 explains what the messages contain and the other ways to stop them.

Right to Withdraw Consent:

For any data processing that requires your consent (that is, analytics cookies and the Google Analytics measurement that uses them), you may withdraw that consent at any time in the Cookie settings section at the end of our Cookie Policy, reachable from the Cookies link in the footer of every page. Withdrawing is exactly as easy as giving consent — the same two buttons, side by side — takes effect immediately, and does not affect the lawfulness of processing carried out before you withdrew. Withdrawing stops analytics cookies being used, but Google's tag goes on sending the cookieless messages described in Section 2.9 unless you also use Stop measurement without cookies.

Right to Lodge a Complaint:

If you believe we have violated your privacy rights, you have the right to lodge a complaint with your local data protection authority (e.g., the ICO in the UK).

To exercise any of these rights, please contact us at privacy@bettrading.net with your request. We will respond within 30 days.

7. Cookies and Online Tracking

7.1 Essential Cookies

We use strictly necessary cookies to operate the BetTrading.net platform. These cookies are essential for:

Maintaining your login session (HttpOnly, Secure, SameSite=Strict)
Rotating your refresh tokens securely
Protecting against cross-site request forgery (CSRF), which the SameSite=Strict attribute above does without needing a second cookie

We set exactly one cookie, refreshToken, and it expires 30 days after it is issued. It does not require your consent, as it is necessary for the service to function — without it we cannot keep you signed in. The Cookie Policy, Section 3.1, lists it in full with its security attributes.

7.2 Analytics Cookies (Google Analytics 4)

We use Google Analytics 4 (GA4) to understand how visitors use our website and improve user experience. GA4 uses cookies to track:

Pages visited
Duration of visit
Traffic sources
Device and browser information

Analytics cookies REQUIRE YOUR CONSENT before they are placed. You will be prompted to accept or decline analytics cookies when you first visit our website. You can change your preference at any time in the Cookie settings section at the end of our Cookie Policy, reachable from the Cookies link in the footer of every page.

If you choose Reject all, or have not yet made a choice, no analytics cookie is placed, but Google's tag still sends Google the cookieless measurement messages described in Section 2.9, unless you use Stop measurement without cookies in the Cookie settings section at the end of our Cookie Policy, reached from the Cookies link in every page's footer.

7.3 Managing Cookies

You can control cookies through your browser settings. Most browsers allow you to:

View cookies stored on your device
Delete specific cookies or all cookies
Disable cookies entirely (though this may prevent BetTrading.net from functioning properly)

You can also opt out of GA4 tracking using Google's Opt-Out Browser Add-on.

8. Data Security

We implement comprehensive security measures to protect your personal information from unauthorised access, alteration, disclosure, or destruction.

8.1 Encryption and Authentication

All data in transit: Encrypted using TLS 1.2 or higher (HTTPS)
All data at rest: Database encryption using Transparent Data Encryption (TDE)
Passwords: Hashed using Argon2id with per-user salting (we cannot recover or view your password)
Authentication tokens: Signed using RS256 asymmetric cryptography
Secrets management: All cryptographic keys and secrets stored in Azure Key Vault

8.2 Session Management

Access tokens: Expire after 15 minutes
Refresh tokens: Expire after 30 days
Refresh token rotation: Every time a new token is issued
Reuse detection: If a previously-rotated token is used again, the entire token family is revoked and you must re-authenticate
Desktop app tokens: Stored securely using Windows DPAPI or Credential Manager (never in plaintext)

8.3 Access Control

All endpoints require authentication (deny-by-default model)
Role-based access control: permissions are granted according to your account's subscription tier
Ownership verification: Every API call is validated server-side to prevent unauthorised access to other users' data
Rate limiting: Protective limits on login, registration, and password reset endpoints to prevent brute-force attacks

8.4 Network Security

Database firewall: SQL Database restricted to Azure services only
CORS policy: Explicit origin allowlist (never wildcard)

8.5 Monitoring and Incident Response

Centralised logging: Security-relevant events are written to a server-side audit log
Audit trail: Detailed audit logs of all security-relevant actions, including repeated failed logins, refresh-token reuse and account-lockout events
Automatic responses: Some suspicious events are acted on by the service itself at the moment they occur, without waiting for anyone to read a log. Repeated failed logins trigger an increasing lockout on the account, and if a refresh token is presented after it has already been rotated, the entire token family is revoked and every session on that account must sign in again
What we do not do: we do not currently operate automated alerting that notifies a person of an individual security event as it happens. Suspicious events are recorded to the audit log and acted on automatically as described above, and where an incident would affect you the breach-notification commitment below applies. We state this rather than leave it to be assumed
Data breach response: We will notify affected users within 72 hours of discovering a breach, as required by law

8.6 Secure Development

Dependency scanning: Automated vulnerability scanning using Snyk
Code review: All code changes reviewed before deployment
Parameterised queries: All database queries use parameterised statements to prevent SQL injection
Input validation: All user input validated server-side
Security headers: Content-Security-Policy, X-Frame-Options, HSTS, and other protective headers enabled

9. Payment Processing

9.1 Stripe Processes Our Payments

Payments are processed by Stripe (Stripe Payments Europe, Limited). Card details are entered only on Stripe's own pages and never reach BetTrading.net. We do not store, process or transmit payment card data of any kind.

9.2 Billing History

We keep subscription and billing history for 7 years to comply with tax and accounting law.

10. Children's Privacy

BetTrading.net is not intended for use by children under 18 years of age. We do not knowingly collect personal information from anyone under 18.

Upon registration, you confirm that you are 18 years of age or older. We verify this age confirmation at account creation and maintain records of your acceptance.

If we become aware that we have collected personal information from a minor, we will immediately delete such information and terminate the minor's account.

If you believe we have collected information from a child, please contact us immediately at privacy@bettrading.net.

11. International Data Transfers

BetTrading.net is operated from the United Kingdom, and your personal data is stored on Azure infrastructure located in UK South and UK West data centres.

If you are located outside the United Kingdom, your data will be transferred to, stored in, and processed within the UK. By using BetTrading.net, you consent to this transfer.

For transfers outside the UK (such as to Google Analytics in the United States), we rely on standard contractual clauses and other legal mechanisms approved by UK and EU data protection authorities. Where Stripe processes your payment data outside the United Kingdom, we rely on the same approved mechanisms.

12. Contact Us

If you have questions about this Privacy Policy, wish to exercise your data rights, or want to report a privacy concern, please contact the data controller:

Data controller: JIA Software Limited (registered in England and Wales, company number 11905293)
Registered office: Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, England, BL6 6HG
Email: privacy@bettrading.net
Website: www.bettrading.net

We will respond to all privacy enquiries within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection authority (in the UK, this is the Information Commissioner's Office at ico.org.uk).

13. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.

We will notify you of material changes by:

Posting the updated policy on our website with a new "Effective Date"
Sending you an email notification if we have your email address on file
Requesting your explicit consent if the changes materially alter how we process your data

Your continued use of BetTrading.net after changes become effective constitutes your acceptance of the updated Privacy Policy. We encourage you to review this policy regularly.

You can view the version history of this Privacy Policy and see when material changes were made by reviewing the "Effective Date" at the top of this document.

Last Updated: 24 September 2026

BetTrading.net Privacy Policy

All legal documents