Privacy Policy

Last updated: 12 April 2026

This Privacy Policy explains how OriginalXG ("we", "us", "our") collects, uses, and protects information about you when you use our website at originalxg.com and any related services (the "Service").

OriginalXG is a statistical football prediction site. We are the data controller for the personal data we process.

What We Collect

Information you provide

  • Email address — when you sign up for our newsletter, create an account, or subscribe.
  • Account information — subscription status, email preferences, and any notification preferences you set.
  • Payment information — handled entirely by Stripe. We never see or store your card details. We receive a token from Stripe that lets us manage your subscription.

Information collected automatically

  • Usage data — pages visited, approximate location (country/region inferred from IP), device type, and browser. Collected via privacy-respecting analytics.
  • Cookies — we use a minimal set of cookies: a session cookie to keep you logged in, and analytics cookies where you have consented.
  • Authentication tokens — short-lived tokens used when you sign in via magic link.

How We Use Your Data

  • To provide the Service (account access, subscription management, delivery of predictions and newsletters).
  • To send you service emails (login magic links, payment receipts, subscription notifications).
  • To send marketing emails, only if you have opted in. You can unsubscribe at any time using the link in every email.
  • To improve the Service — understanding which pages are popular, what content performs well, and where users hit issues.
  • To comply with legal obligations (tax, accounting, responding to lawful requests).

Legal Basis (UK GDPR)

We process your personal data on the following legal bases:

  • Contract — to deliver the Service you've signed up for (account, subscription, predictions).
  • Consent — for marketing emails, non-essential cookies, and optional notifications.
  • Legitimate interests — to keep the Service secure, prevent fraud, and understand how the Service is used.
  • Legal obligation — where we are required to retain records (e.g. for tax).

Who We Share Data With

We only share your data with trusted service providers who help us run the Service. We never sell your data.

  • Stripe (payment processing) — handles card details and subscription billing.
  • Cloudflare (hosting and infrastructure) — runs the site and API.
  • Resend (transactional and marketing email) — sends login links, receipts, and newsletters.
  • Analytics provider — aggregated, pseudonymised usage data only.

All providers are bound by data processing agreements and only process data on our instructions.

Data Retention

  • Account data — retained while your account is active and for up to 12 months after cancellation, then deleted or anonymised.
  • Payment records — retained for 7 years where required for tax and accounting.
  • Newsletter subscribers — retained until you unsubscribe, then removed within 30 days.
  • Usage logs — typically retained for 30-90 days.

Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you
  • Correct inaccurate data
  • Delete your data ("right to be forgotten")
  • Restrict or object to processing
  • Receive your data in a portable format
  • Withdraw consent for marketing at any time

To exercise any of these rights, email privacy@originalxg.com. We'll respond within 30 days.

Cookies

We use the minimum number of cookies necessary. Essential cookies (session and authentication) are set when you log in. Analytics cookies are only set with your consent. You can manage your cookie preferences at any time through your browser settings or our cookie banner.

International Transfers

Some of our service providers process data outside the UK/EEA. Where this happens, we rely on UK Adequacy Regulations or Standard Contractual Clauses to protect your data.

Children

OriginalXG is not intended for anyone under 18. We do not knowingly collect data from children. If you believe we have collected data from a child, please contact us and we will delete it.

Security

We use industry-standard security: HTTPS across the site, hashed authentication tokens, and PCI-compliant payment processing via Stripe. No system is 100% secure, but we take reasonable steps to protect your data.

Changes to This Policy

We may update this policy from time to time. Material changes will be announced via email to account holders. The "Last updated" date at the top of this page will always reflect the most recent version.

Contact & Complaints

For any privacy questions, email privacy@originalxg.com.

If you're not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.