?

Legal

Privacy Policy

Last updated: August 2026

This policy explains how Tofiko collects, uses and protects your personal data. We process your data lawfully and transparently under the EU General Data Protection Regulation (GDPR).

1. Who we are

Tofiko is an AI-powered football analytics platform operated at tofiko.com. Tofiko is the data controller for the personal data described here. For any privacy question or request, contact us at privacy@tofiko.com.

2. What data we collect

  • Account data — your email address, and (if you sign in with Google) the basic profile your provider returns. Authentication is handled by our processor Supabase.
  • Subscription data — your plan tier and subscription status. Payments are handled by Stripe; we store a Stripe customer reference and status, but we never see or store your card details.
  • Product data — items you save (e.g. your watchlist) and basic preferences.
  • Technical data — essential cookies and limited server logs (e.g. IP address) used to keep you signed in and to protect the service. We also record the date and time you sign in, so we can see whether the product is worth coming back to. This is never shared and is not used to profile you.

We do not knowingly collect data from anyone under 18, and we do not collect special-category (sensitive) personal data.

3. How we use your data

  • To create and operate your account and authenticate you;
  • To provide the tier of service you are entitled to;
  • To manage subscriptions and process payments (via Stripe);
  • To send essential service messages (e.g. sign-in links, account or billing notices);
  • To secure the service and prevent abuse.

We do not sell your data, we do not use it for advertising, and we do not carry out automated decision-making or profiling that produces legal effects for you.

4. Legal basis for processing

We rely on performance of a contract (to provide your account and subscription), our legitimate interests (to secure and improve the service), legal obligations (e.g. tax/accounting once payments are enabled), and your consent where it is required.

Email we send you. Two kinds, and they are treated differently. Mail about your account — signing you in, replying to a support message, telling you about your subscription — is sent under the contract, carries no unsubscribe link and cannot be switched off while you have an account. Mail we publish — the daily brief, the weekly review and product updates — is sent only if you switch it on. Nothing is on by default. Every one of those messages carries a one-click unsubscribe that works without signing in, and you can change or stop any of them at any time from your account page.

We do not track whether you open an email. There is no tracking pixel in anything we send, and we do not ask our email provider to report opens. We do record that a message was delivered, bounced or drew a spam complaint, because without that we cannot tell that our mail is broken; and we record clicks on links in our own emails, because a click is something you chose to do.

5. Processors and sub-processors

We share data only with the providers we need to run the service, under appropriate data-processing terms:

  • Supabase — authentication and database;
  • Stripe — payment processing and subscription billing;
  • Vercel — hosting of the web application;
  • Our hosting provider — the server running our API and database, located in the European Union;
  • Email provider — used to deliver both kinds of email described above.
  • Anthropic — the AI model behind our in-app support assistant. What you type in the support chat, the recent messages in your thread and the account details needed to answer you are sent to Anthropic to generate a reply and to translate it into your language.

Where a provider processes data outside the EU/EEA, that transfer is covered by appropriate safeguards (such as the EU Standard Contractual Clauses). We do not sell, rent or share your personal data with any other third party.

6. Data retention

We keep your account data for as long as your account is active. If you delete your account or ask us to erase your data, we remove it from our systems within 30 days, except where we must keep certain records (e.g. invoices) to meet legal obligations.

7. Your rights under the GDPR

  • Access — get a copy of the data we hold about you;
  • Rectification — correct inaccurate data;
  • Erasure — delete your account and data (“right to be forgotten”);
  • Portability — receive your data in a portable format;
  • Restriction / objection — limit or object to certain processing;
  • Withdraw consent — at any time, where processing is based on consent;
  • Complain — to your national data protection authority (in Italy, the Garante per la protezione dei dati personali).

To exercise any of these rights, email privacy@tofiko.com.

8. YouTube API Services

Tofiko uses YouTube API Services to publish our own short videos to our own YouTube channel, @TofikoFootball, and to read back the public statistics of those videos (view counts and likes) for our own internal reporting.

By using the YouTube API Services, we are bound by the YouTube Terms of Service. Google’s handling of any data it receives is described in the Google Privacy Policy.

What we access. We access only the YouTube account that we own. We do not ask you to connect your YouTube account, and we never access any YouTube data belonging to visitors of this site.

What we store. We store the video IDs of our own uploads and their public view and like counts, so we can see which of our videos performed well. This data is refreshed at least every 30 days and is deleted when it is no longer needed. We do not store any YouTube user data of any kind.

Revoking access. The single Google account we use to publish can revoke our application’s access at any time via the Google security settings page at https://myaccount.google.com/permissions.

9. Cookies

We use only essential and functional cookies. See our Cookie Policy for the full list.

10. Changes to this policy

We may update this policy from time to time. The “last updated” date above reflects the latest revision; we will notify you of material changes where required.

11. Contact

For any privacy question or request, contact privacy@tofiko.com.