xG Stat (“we”, “us”, “our”) provides football analytics products and services. We are established in the Netherlands as an eenmanszaak (sole proprietorship) and registered with the Dutch Chamber of Commerce (KvK) under number 98415018. We act as the data controller for personal data processed via our website and app.
This Privacy Policy explains what we collect, why we collect it, and how you can exercise your rights under the EU/UK GDPR and the ePrivacy rules. If anything here is unclear, contact us at support@xgstat.com.
1) What data we collect
a) Account & authentication
Email address. New accounts are created with Google or Apple sign-in, or with a one-time code sent to your email address. If your account predates that change, we may still hold a hashed password for it.
If you use a third-party login (Google or Apple), we receive your email address and the basic profile details that provider makes available.
b) Billing & payments
Payments are processed by Stripe. We do not store card numbers on our servers. Stripe provides us with limited billing metadata (e.g. subscription status, payment method type, last 4 digits, transaction timestamps). See Stripe's privacy notice for details.
c) Usage, device & cookies
We collect essential technical data needed to operate the service (e.g. session tokens, security events, server logs).
With your consent, we collect analytics events (e.g. page views, feature interactions) via tools such as Google Analytics and/or PostHog. IPs are either anonymised or truncated when supported.
Cookies and local storage are used for essential functions (login, preferences) and, if you opt in, analytics/marketing. See “Cookies & consent” below.
d) Support & communications
When you contact us (email or forms), we process the information you provide to handle your request.
e) Push notifications (optional)
Push notifications are off unless you turn them on. If you do, your browser or app creates a push subscription and we store it against your account so we can send the alerts you asked for (for example the full-time verdict for a team you follow).
What we store: a subscription endpoint URL issued by your browser's push service, the encryption keys needed to send to it, and the device or browser it was created on. A subscription is per device, so each device you enable is stored separately.
How messages reach you: through the push service operated by your browser or platform vendor (for example Google, Mozilla or Apple). That service can see the endpoint and the encrypted message, and we cannot control its own processing. Notification content is end-to-end encrypted between us and your device.
Legal basis: your consent, given when you accept the notification prompt. You can withdraw it at any time in Account → Notifications, or by revoking the notification permission in your browser or device settings.
Retention: the subscription is deleted when you turn notifications off on that device, when the push service reports it as expired, or when you delete your account.
We do not use push notifications for advertising, and we do not share push data with anyone beyond the push service required to deliver the message.
We do not intentionally collect special categories of personal data (e.g. health, political opinions) and we do not knowingly collect data from children under 16.
2) Why we process your data (legal bases)
Contract necessity: to create and manage your account, provide the service, process payments, and deliver customer support.
Legitimate interests: to keep our platform secure (fraud/abuse prevention), to debug and improve core functionality, and to defend legal claims. We balance these interests against your rights and expectations.
Consent: for non-essential cookies/trackers (analytics/marketing). You can withdraw consent at any time via the cookie banner/settings.
Legal obligation: to comply with tax, accounting, and regulatory requirements.
3) Cookies & consent
We use a consent banner to obtain your choice before setting any non-essential cookies or loading analytics/marketing tags. Categories used:
Essential - required to run the site (authentication/session, security).
Analytics - to understand product usage and improve the experience (Google Analytics, PostHog).
Marketing - advertising and marketing cookies (Google Ads, if enabled).
You can change your choice any time via .
4) Processors & transfers
We use third-party providers (processors) to host and operate xG Stat. These currently include:
Hosting/Infrastructure: e.g. Vercel (EU/US locations depending on configuration).
Payments: Stripe (EU/US). Card data handled by Stripe.
Analytics (consent-based): Google Analytics and PostHog.
Error monitoring: Sentry, to detect and diagnose faults.
Email: Resend, for account emails and the content emails you have opted into.
Push delivery: the push service of your own browser or platform (Google, Mozilla or Apple). We do not choose it; your browser does when you enable notifications.
Where data is transferred outside the EEA/UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (SCCs) and vendor commitments. More details are available on request.
5) Retention
Account data: kept while your account is active, then deleted or anonymised.
Billing records: retained for up to 7 years to comply with Dutch tax law.
Analytics data (if consented): retained only as long as necessary for improvement and typically no longer than 24 months (tool-specific).
Server logs/security events: short-term retention for debugging and abuse prevention.
Push subscriptions: kept until you turn notifications off on that device, the push service reports the subscription as expired, or you delete your account.
6) Your rights
If you are in the EEA/UK, you have the right to request access, rectification, erasure, restriction, portability, and to object to certain processing. You can also withdraw consent at any time (this does not affect past processing based on consent).
Contact us at support@xgstat.com to exercise your rights. You also have the right to lodge a complaint with your local supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.
7) Security
We use technical and organisational measures appropriate to the risk (TLS in transit, access controls, least-privilege, regular updates). No system is perfectly secure; we encourage you to use a strong, unique password and keep your credentials safe.
8) Children
xG Stat is not directed to children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us data, contact us and we will delete it.
9) Changes to this policy
We may update this Privacy Policy to reflect changes in our services or legal requirements. We will post the updated version here and update the "Last updated" date. If changes are material, we will provide a more prominent notice.
