Privacy Policy

Introduction and Data Controller

This Privacy Policy explains which personal data we process when you use the 11Stat (11stat.com) football data analytics platform, on which legal basis and for which purposes we process it, with whom we share it, how long we retain it, and your rights under the Turkish Personal Data Protection Law No. 6698 (KVKK) and the European General Data Protection Regulation (GDPR). 11Stat is not a betting/gambling service and never sells your personal data for advertising or betting purposes.

Data Controller: 11Stat (11stat.com). Contact for all data protection requests and KVKK/GDPR applications: [email protected].

1. Data We Process

• Account data: email address and password (passwords are hashed with one-way scrypt; no plain text is stored).
• Membership/payment data: your chosen plan, payment confirmation/transaction reference (card details are not stored by us; they are processed on the payment provider's side).
• Usage data: daily analysis query count (for limits), session information and error logs.
• Technical data: IP address (for abuse prevention/rate limiting), browser/language preference.

2. Purposes of Processing and Legal Basis

We process data to create and maintain your membership, enforce the daily analysis limit, ensure security and improve the service (performance of the contract and legitimate interest). Marketing emails are sent only with your consent.

3. Sharing

We do not sell your personal data and do not share it with third parties for advertising purposes. It is shared only with providers necessary for the operation of the service (hosting, payment, email delivery) and with competent authorities where legally required.

4. International Transfers and Service Providers (Sub-processors)

We use a limited number of trusted service providers (hosting/servers, payment processing, transactional email delivery) to operate the service. For card payments we use Stripe, Inc. (US-based; transfer safeguards are provided under the GDPR through Standard Contractual Clauses); card details are not stored on 11Stat servers and are processed directly in Stripe's PCI-DSS compliant environment. You can find Stripe's privacy policy at stripe.com/privacy. Some of these providers' servers may be located abroad; in that case, transfers are carried out in accordance with Article 9 of the KVKK and Chapter V of the GDPR, within the framework of safeguards ensuring adequate protection (e.g. standard contractual clauses). Providers process your data only on our behalf and under our instructions, limited by contract.

5. Retention Period

Account data is retained for as long as your membership continues; data subject to legal obligations (e.g. payment/invoice records) is retained for the period required by the applicable legislation. If you wish to close your account, your data — except for records subject to mandatory retention — is deleted, destroyed or anonymized within a reasonable period.

6. Data Security

Passwords are stored using one-way scrypt hashing (no plain text is kept), sessions are signed with HMAC and access is restricted by authorization. Data in transit is encrypted via TLS/HTTPS. Nevertheless, no system is 100% secure; if a breach is detected, we fulfil the notification obligations required by the applicable legislation.

7. Your Rights (KVKK / GDPR)

Under Article 11 of the KVKK and Articles 15-22 of the GDPR, you have the right to access your personal data, to rectification, to erasure/to be forgotten, to restrict processing, to data portability, to object to processing, and to withdraw any explicit consent you have given at any time. You may submit your requests to [email protected]; we respond within the maximum period set by the legislation. If you believe your request has not been fulfilled, you retain the right to lodge a complaint with the Personal Data Protection Board in Turkey and with the competent supervisory authority in the EU.

8. Children's Privacy

The platform is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18; if we discover that such data has been processed, we delete it.

9. Cookies

We use only essential cookies/local storage for session and preference purposes; we do not use advertising/tracking cookies. For details, see the Cookie Policy.

10. Changes

We may update this policy from time to time; the current version takes effect on the date it is published on this page.

This text is for informational purposes; the final practice is updated in line with the applicable legislation. Questions and KVKK/GDPR applications: [email protected]

Governing Language

This English translation is provided for convenience only. The Turkish-language version of this Privacy Policy is the legally binding original; in the event of any discrepancy or dispute, the Turkish text prevails.