Last updated: August 27, 2026
Privacy Policy
This policy explains what personal data NinjaBet collects, why we use it, who else sees it and what you can do about it. It covers this website and the account, tools and emails that go with it.
It is written to be read rather than to be survived. If anything here is unclear, ask us — the contact details are at the end.
Who is responsible
NinjaBet is operated by the company below, which decides why and how your personal data is used and is therefore the data controller.
Data controller
ITAR BG LTD
7 Stefan Karadzha Str., 1000 Sofia, Bulgaria
[email protected]
What we collect
Almost all of it is data you give us yourself. The rest is what your browser sends when you visit.
- Account details
- Your email address, your password (kept only as a cryptographic hash, never in readable form), your display name, your country, and the settings you choose: currency, odds format, language and email preferences.
- Subscription and payments
- Your plan, its status and history, and a record of each transaction. Card numbers never reach us — they go straight to the payment provider, which sends us back only a reference and the outcome.
- What you record in the tools
- The bets, balances, bookmakers, odds and stakes you enter in the profit tracker, together with your saved filters, accumulators and the commission rates you set.
- Support and community
- The messages you send us, and your profile and posts if you use the NinjaClub forum.
- Email activity
- Whether an email we sent you was delivered, opened or clicked.
- Technical data
- Your IP address, your browser and device, the country your connection comes from, and diagnostic details when something goes wrong.
- Your cookie choices
- Which categories you allowed or refused, when, and under which version of this policy, together with a one-way hash of your IP address.
Why we use it, and on what legal basis
Every use has a purpose and a legal basis. Where the basis is your consent, you can withdraw it at any time and we stop.
| Purpose | Data used | Legal basis | Kept for |
|---|---|---|---|
| Creating and running your account | Account details | Performance of our contract with you (art. 6(1)(b) GDPR) | As long as your account exists |
| Subscriptions, payments and invoices | Plan, transactions, billing details | Our contract, and our legal obligation to keep accounting records (art. 6(1)(b) and (c)) | Billing records: 10 years |
| Providing the matched-betting tools | What you record in the tools | Performance of our contract with you (art. 6(1)(b)) | As long as your account exists |
| Service emails you cannot switch off: password resets, receipts, expiry notices | Email address, delivery events | Performance of our contract with you (art. 6(1)(b)) | Delivery events: 6 months |
| Marketing emails, offers and tips | Email address, preferences, delivery events | Your consent (art. 6(1)(a)) | Until you unsubscribe |
| Answering support requests | Name, email, what you tell us | Our legitimate interest in helping our users (art. 6(1)(f)) | 2 years after the conversation ends |
| Keeping accounts secure and preventing abuse | IP address, browser, sign-in attempts | Our legitimate interest in protecting the service and its users (art. 6(1)(f)) | Up to 12 months |
| Finding and fixing faults | Technical diagnostics | Our legitimate interest in a service that works (art. 6(1)(f)) | 90 days |
| Measuring how the site is used | Analytics identifiers | Your consent (art. 6(1)(a)) | Up to 14 months |
| Crediting the partner who referred you | Referral code | Your consent (art. 6(1)(a)) | 45 days |
| Proving you were asked about cookies and what you answered | Your choices, a hash of your IP address, your browser | Our legal obligation to be able to demonstrate consent (art. 7(1)) | 5 years |
Who else receives your data
We do not sell your personal data and never have. It reaches another company only where that company does something for us we cannot do ourselves — deliver our email, take a payment, host our servers — and only the part of it they need. Each of them acts on our written instructions.
Everything in this list that runs inside your browser is described cookie by cookie in the Cookie Policy. Cookie Policy
| Service | Company | What it does for us | Processed in |
|---|---|---|---|
| Cloudflare Privacy policy | Cloudflare, Inc. | Delivers the site and stops attacks before they reach our servers. | US / global edge EU Standard Contractual Clauses |
| Cloudflare Turnstile Privacy policy | Cloudflare, Inc. | Checks that a sign-in or sign-up comes from a person rather than a script. | US / global edge EU Standard Contractual Clauses |
| Netlify Privacy policy | Netlify, Inc. | Hosts and serves the website. | US / global edge EU Standard Contractual Clauses |
| Trustpilot widget Privacy policy | Trustpilot A/S | Shows our review score. | Denmark / EU |
| Sentry Privacy policy | Functional Software, Inc. | Reports errors so we can fix them. | US EU Standard Contractual Clauses |
| Wistia video player Privacy policy | Wistia, Inc. | Plays the videos in our guides and offers. | US EU Standard Contractual Clauses |
| YouTube player Privacy policy | Google Ireland Limited | Plays embedded videos. | Ireland / US EU–US Data Privacy Framework |
| Help Scout Beacon Privacy policy | Help Scout, Inc. | Runs the help widget and our support inbox. | US EU Standard Contractual Clauses |
| Google Analytics 4 Privacy policy | Google Ireland Limited | Measures how the site is used, in aggregate. | Ireland / US EU–US Data Privacy Framework |
| Amazon Web Services Privacy policy | Amazon Web Services, Inc. | Hosts our servers and databases. | US (us-east-2) EU Standard Contractual Clauses |
| Mailgun Privacy policy | Sinch Email (Mailgun Technologies, Inc.) | Delivers our email. | US EU Standard Contractual Clauses |
| Stripe Privacy policy | Stripe Payments Europe, Ltd. | Processes card and wallet payments. | Ireland / US EU Standard Contractual Clauses |
| PayPal Privacy policy | PayPal (Europe) S.à r.l. et Cie, S.C.A. | Processes PayPal payments. | Luxembourg / US EU Standard Contractual Clauses |
| Cardinity Privacy policy | UAB Click2Sell | Processes card payments. | Lithuania / EU |
We also hand over data where the law requires it — to a tax authority, a regulator or a court — and to our professional advisers, who are bound to confidentiality. If the business were ever sold, your data would move with it and we would tell you before that happened.
Data sent outside Europe
Some of the companies above process data outside the European Economic Area, mostly in the United States. Where that happens we rely on the European Commission's Standard Contractual Clauses and, where noted, on the EU–US Data Privacy Framework. The table says which applies to whom, and you can ask us for a copy.
How long we keep it
The table above gives the period for each purpose. As a rule we hold your data for as long as you have an account with us. When you close it we delete or anonymise what we hold, apart from the records we are obliged to keep — chiefly billing and accounting records, and the proof of your cookie choices.
Your rights
These rights are yours under the GDPR. Using them costs nothing and we will not treat you differently for it.
- Access — Ask what we hold about you and get a copy of it.
- Rectification — Have anything inaccurate corrected or anything incomplete filled in.
- Erasure — Have your data deleted, where we have no obligation to keep it.
- Restriction — Ask us to pause using it while a question about it is resolved.
- Portability — Receive the data you gave us in a machine-readable file, or have us send it to someone else.
- Objection — Object to any use we base on our legitimate interest.
- Withdrawing consent — Take back a consent at any time, as easily as you gave it. Cookie choices are one click away from the link at the bottom of every page. Withdrawing does not undo what was lawful beforehand.
To use any of them, write to us at the address at the end of this page. We answer within one month; if a request turns out to be complicated we may need longer and will say so and why.
If you think we have got this wrong, you can complain to your supervisory authority: Commission for Personal Data Protection (Bulgaria)
For visitors in the United States
We do not sell or share your personal information in the sense the California Consumer Privacy Act gives those words, and we do not use it for cross-context behavioural advertising.
NinjaBet sits below the revenue and volume thresholds that make the CCPA apply to a business, so its opt-out machinery does not apply here. The rights described above are open to you regardless: write to us and we will answer.
Automated decisions
We do not make decisions about you by purely automated means that produce legal effects or affect you in a similarly significant way. The tools calculate odds, stakes and profits from what you enter; they decide nothing about you.
How we protect it
Traffic is encrypted in transit, passwords are stored only as cryptographic hashes, and access to production systems is limited to the people who need it. No system is perfect: if a breach ever puts you at risk, we will tell you and the authority as the law requires.
Age
This service is for adults. It is not aimed at anyone under 18 and we do not knowingly collect their data. If you believe a minor has given us data, tell us and we will delete it.
Changes to this policy
We update this page when what we do changes. Every version is dated, and when a change affects something you consented to we ask you again rather than assuming your earlier answer still stands.