Privacy Policy
Version 8. Last updated: 2 November 2026
ESK Solutions Pty Ltd (ABN 12 690 345 469), trading as SockOdds, operates the sockodds.com website and API. This policy explains how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles.
Information we collect
- Account and contact information, including name, email address, company, support messages and partner or subscription requests.
- Service identifiers, including API-key hashes, key IDs, plan, Stripe customer and subscription references, and the legal-policy versions you accepted. API authentication uses one-way hashes. We also keep an encrypted account copy of newly issued keys so the signed-in owner can view or copy them. Older keys can be linked by their owner by submitting a saved copy. The encryption secret is held separately from the database; API keys are never stored as plaintext in the database or browser storage.
- Usage and technical information, including request time, client address, user agent, endpoint, response status, latency, usage counters and objects served.
- Billing information supplied to Stripe. We receive transaction and subscription metadata but do not store complete card numbers.
How we collect and use information
We collect information directly from forms and support communications, automatically when the site or API is used, and from Stripe in connection with billing. We use it to create and secure accounts, authenticate and meter API use, provide support, process subscriptions, communicate operational or legal changes, prevent abuse, investigate incidents, comply with law, and improve the Service using aggregated or de-identified information. We do not sell personal information or use it for third-party advertising.
Email marketing preferences
Signup offers an optional, preselected checkbox for SockOdds news, coverage updates and offers. You can untick it and still receive the same free trial. If it stays selected, we ask you to confirm that you want these emails before recording marketing agreement. We store the choice, timestamp, disclosure version and a hashed account identifier so we can respect your preference and show when and how it was recorded. Existing opt-outs and delivery suppression are not reversed by another signup.
You can change marketing preferences in your account or unsubscribe using the link in a marketing email without signing in. Sign-in, billing and essential account messages continue independently. Phone verification does not subscribe you to SMS marketing.
Phone verification
New signups must supply a mobile number and confirm an SMS code before creating a free key or starting paid checkout. We collect the number and verification timestamps to secure signup and prevent abuse, not for SMS marketing. BetBank's shared verification service, hosted on Supabase, uses Twilio Verify to send and check the code. SockOdds does not store verification codes. For the one-time free Pro trial, we retain a hash of the verified mobile number alongside the account email, trial start and expiry, object count and first/last usage timestamps to prevent repeated trials and show your allowance. Unused local verification records expire after 10 minutes and are deleted during subsequent verification activity or weekly retention maintenance. Used verification records are retained while needed for the account; records with no associated account are deleted after 30 days. Provider retention is governed by their policies.
Service providers and disclosure
We disclose only what is reasonably necessary to service providers that operate the Service: Stripe for payments and subscription management; Resend for sign-in, service and opted-in marketing emails; DigitalOcean for application hosting; Cloudflare for DNS, security and email routing; Supabase for managed database and phone verification services; Twilio for SMS phone verification; and our support-email provider. We may also disclose information where required by law, to investigate fraud or security incidents, or to establish or defend legal claims. Providers handle information under their own terms and privacy commitments.
Email sign-in uses short-lived, single-use links and a secure session cookie. We store hashes of sign-in and session tokens, not account passwords. Session cookies are necessary to keep you signed in; API keys are not stored in browser storage. Transactional email processing includes the recipient address and the message needed to deliver sign-in links, account notices and onboarding information.
Overseas handling
Our providers may process or store information in Australia, the United States and other countries where they or their subprocessors operate. Overseas recipients may be subject to different privacy laws. Where the Australian Privacy Principles apply, we take reasonable steps appropriate to the circumstances before disclosure and review provider safeguards.
Retention
Operational HTTP logs containing client addresses are normally retained for 30 days. Usage and security records are retained while an account is active and for a reasonable period afterwards to resolve billing, abuse and legal issues. Acceptance and transaction records may be retained for the period needed to establish contractual, tax and accounting records. Support records are retained while needed to resolve the request and for reasonable business follow-up. When information is no longer required, we delete or de-identify it, subject to backups and legal retention duties.
Cookies and browser storage
The public site uses no advertising or behavioural-tracking cookies. Stripe may use cookies on its checkout and billing pages under Stripe's policy. The account and explorer pages keep an API key only in the current page's memory and send it to our API when you submit a request; they do not intentionally persist it in browser storage. To learn which channels bring customers, the site keeps one small first-visit note in your browser's local storage: the domain of the website that referred you, any campaign tags in the link you followed, the first page you opened and the date. It is sent with the signup or checkout form, where we record the channel (for example search, social or direct) against a one-way hash of your email address. It contains no identifiers, is not shared with anyone, and you can clear it with your browser's site data.
Security and data breaches
We use TLS, restricted production access, hashed API authentication, encrypted account key copies, rate limits and operational logging. No internet service can guarantee absolute security. If a suspected breach occurs, we will contain and assess it and notify affected individuals and the Office of the Australian Information Commissioner when required under the Notifiable Data Breaches scheme.
Access, correction and deletion
Email [email protected] to request access to or correction of personal information, or deletion of an account. We may need to verify identity. We aim to respond within 30 days and will explain any lawful refusal. Account deletion deactivates the key promptly; associated personal information is deleted or de-identified when no longer legally or operationally required.
Complaints
Send a privacy complaint to [email protected] with enough detail for us to investigate. We will acknowledge it and aim to provide a substantive response within 30 days. If you are not satisfied, you may complain to the Office of the Australian Information Commissioner.
Children
The Service is for people aged 18 and over. We do not knowingly collect personal information from anyone under 18. Contact us if you believe we have done so.
Third-party links
This site links to bookmakers and other services. Their privacy practices are governed by their policies, not this one.
Changes
We may update this policy. We will post the new version and effective date and give account holders reasonable notice of material changes, unless an urgent legal or security change requires earlier effect.
Contact
ESK Solutions Pty Ltd, New South Wales, Australia. Privacy enquiries: [email protected].