Privacy notice
ESKape Sportsbook Feed · how we process personal data · version 1.1, 22 October 2026
Who we are
ESKape Sportsbook Feed (the Service) is provided by Evgeni Stefanov Krastev, a freelancer registered in Bulgaria in the BULSTAT Register under UIC 180745014, VAT number BG180745014, with address for service and correspondence at 4 Galiley Street, 4018 Plovdiv, Bulgaria, trading as ESKape (we, us), who is the controller of your personal data. ESKape is in the process of incorporating a Bulgarian single-member limited liability company (EOOD); once the company is registered, it will become the controller, and we will notify you and update this notice. We have not appointed a data protection officer, as the Regulation does not require one for activities such as ours (art. 37). Please send any question or request about your data to management@eskape.pro.
This notice covers the individuals whose personal data the Service and the eskape.pro website process: Free Plan subscribers, website visitors and the business contacts we reach out to. We do not process data about the customers or players of any business that uses the Service (section 7).
1. In short
| Data subjects | Data | Purpose | Legal basis (art. 6(1)) | Retention |
|---|---|---|---|---|
| Free Plan subscribers (businesses and the individuals who register on their behalf) | company name, country and registration or VAT number, betting licence number (if any) and, when Bulgaria is chosen, the declaration of a Bulgarian gambling licence, email address, password (stored as a hash only), the country selected, the time and IP address of registration, the version of the terms accepted, the API key (stored as a hash and its first characters only), the plan and its dates, the requests made with the key (counts per day and endpoint; where enabled, per hour, status and competition), the plans you asked to be notified about, the emails we sent you | to operate the Free Plan: your key, quota, competitions and sign-in, and the emails described in the terms | performance of our agreement with you (b), where the Subscriber is you as a freelancer or sole trader; for the representatives of a legal entity, our legitimate interest in performing our agreement with it (f); our legitimate interest in keeping the Service secure and fair (f); records required by law (c) | the term of the Free Plan plus five years; unconfirmed registrations: 30 days; detailed statistics: 92 days; password-reset tokens: 60 minutes (section 3) |
| Visitors to eskape.pro | IP address, page requested, time, browser type | to operate the website and protect it from overload | legitimate interest (f) | the IP address is held in memory for about a minute after your last request; a server log entry is created only when a request fails and is kept for up to 30 days |
| Business contacts we reach out to | name, role, employer, business email and phone number, LinkedIn profile, country, how and when we contacted you, and your reply | to offer the Service to the businesses it is designed for | legitimate interest (f), recital 47 | up to 12 months after the last contact; a "do not contact" record (name and email) for as long as we operate the business |
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22). Quotas and sign-in limits are technical limits, not decisions about you.
2. What we process about subscribers, and why
At registration you provide your company's name, country and registration or VAT number, its betting licence number (if it has one), an email address, a password (or you sign in with Google or Microsoft) and the country whose competitions you want to receive, and you declare that you are registering for your business and not as a consumer. We record the time of registration, the IP address it came from, your declaration and the version of the terms you accepted (the terms, section 1.3), and we issue your API key. The Service is for businesses only; we do not accept registrations from consumers.
What we never store in plain text. Passwords are stored only as salted PBKDF2-SHA256 hashes; keys only as SHA-256 hashes plus their first characters; confirmation and password-reset tokens only as hashes. No one at ESKape can read your password or your key; a lost key is replaced, not recovered.
No payment data. On the Free Plan we do not collect, require or store any debit card, credit card or bank account details.
While you use the Service we record the requests made with your key — per day and per endpoint for the quota and, where detailed statistics are enabled, per hour, method, response status, competition and fixture. Odds you submit for a fixture are held in memory for no more than 60 minutes and are never written to disk (the terms, sections 5.3 and 8.2). We also record the emails we send you (the confirmation link, key rotations, plan expiry, password resets) and the plans you asked to be notified about.
Purposes and legal bases. Registration, the key, the quota, competitions, sign-in and the emails are necessary to perform our agreement with the Subscriber (the terms): art. 6(1)(b) where the Subscriber is you as a freelancer or sole trader, and our legitimate interest in performing the agreement (art. 6(1)(f)) where you register for or represent a legal entity. Limits on failed password attempts, on registrations and on requests from a single IP address, and the record of the IP address a registration came from, serve our legitimate interest in a secure and fair Service (art. 6(1)(f)). Registration and usage records are kept after the plan ends because Bulgarian law requires us to keep business records (art. 6(1)(c); the Accountancy Act) and so that we can respond to any dispute within the limitation period.
Are you required to provide this data? Your company's name, country and registration or VAT number, an email address, a password (unless you sign in with Google or Microsoft) and the chosen country are required to register; without them we cannot provide the Free Plan. All other data results from your use of the Service.
No profiling, no marketing lists. We use usage records to apply your quota, to show you your own statistics and to analyse how the Service is used in aggregate. We do not sell data or use subscriber data for advertising.
3. How long we keep your data
| Record | Retention |
|---|---|
| The registration (company details, email, country, time, IP address, terms accepted), the plan and its changes, the key's hash and prefix | the term of the Free Plan plus five years (the Accountancy Act), then deleted |
| A registration whose confirmation link was never opened | 30 days, then deleted |
| The password hash | for as long as the registration exists; deleted with it, or immediately when you ask us to close the registration |
| A password-reset token (its hash) | 60 minutes, or until used |
| Usage per day and endpoint (the quota; the basis for resolving any dispute) | as long as the registration |
| Detailed statistics (hour, status, competition, fixture) | 92 days, then deleted automatically |
| Odds you submit for a fixture | in memory only, no more than 60 minutes, never written to disk |
| The sign-in cookie | 7 days from last use, on your device only |
4. Cookies and the data your browser sends
The site sets a single cookie, and only when you sign in on the developer page: feed_account, which keeps you signed in for 7 days. It is strictly necessary for signing in, is sent only to /api/account/… on eskape.pro, cannot be read by scripts and is not used for tracking. There are no analytics, advertising or third-party cookies and no third-party scripts; the page loads scripts, images and styles from eskape.pro only. When you follow a link from our site, your browser does not tell the other site where you came from.
Every request to the site reaches our server with your IP address, the page requested, the time and your browser type. We hold the IP address in the server's memory to limit requests and sign-in attempts from a single address, and keep it for about a minute after your last request; we do not keep a log of visits. When a request fails, the server's own log may record the address and the request; such entries are kept for up to 30 days and then deleted automatically.
5. Where the data is stored, and who receives it
The Service runs on servers in the European Union (currently an OVHcloud data centre in Gravelines, France); subscriber records and their backups remain in the European Union. The hosting contract is with OVH Hosting Inc. (Canada), whose group companies outside the United States may maintain the service remotely; the European Commission has recognised Canada as providing an adequate level of protection for organisations subject to PIPEDA. Our emails (the confirmation and the other emails described in the terms) are sent through OVHcloud's email service in the European Union.
Signing in with Google or Microsoft. If you choose to sign in with a Google or Microsoft account, that provider sends us your email address, your name and an identifier of your account. We keep the identifier, to recognise you when you sign in again, and the email address as the email of the registration; the name is only shown on the page that completes the sign-in and is not stored. The sign-in at the provider is governed by its own privacy policy.
No one else receives subscriber data. We disclose data to an authority, a court or a regulator only where required by law, and to our professional advisers, who are bound by confidentiality, where needed for a dispute. We do not sell data.
6. Business contacts we reach out to, and people who contact us
We contact people whose role at a betting operator, a platform or a data provider is relevant to the Service — using business details from public sources (company websites, LinkedIn, public registers of licensed operators, trade-show exhibitor lists) — to offer them the Service. The legal basis is our legitimate interest (art. 6(1)(f), recital 47). We send no more than three messages and stop if you do not reply. Reply "no" or "stop", or write to management@eskape.pro, and we will stop immediately; we then keep only your name and email address on a "do not contact" list so that we do not contact you again by mistake. Otherwise we delete your data no later than 12 months after the last contact. When you contact us, we keep the correspondence for the same period; if a contract follows, for its term plus five years. The full notice for these contacts, in Bulgarian, is available from management@eskape.pro. A Bulgarian version of this notice is published at https://eskape.pro/privacy-bg.
7. Data about your customers or players: none
The Service requires no data about the people who may use what you build with it: no bet, player or device data passes through the API, and the odds you submit contain none. The terms prohibit you from sending us any such data (section 9.2). If we receive such data in breach of the terms, we do not use it and delete it as soon as we become aware of it.
8. Your rights
Under the conditions of arts 15–21, you have the right to access your data, to have it corrected or erased, to restrict its processing and to receive a copy of the data you provided in a machine-readable format, and you may object to processing based on our legitimate interest; the right to object to direct marketing is unconditional (art. 21(2) and (3)). Write to management@eskape.pro from the email address you registered with; we will reply free of charge within one month. Deleting your registration ends the Free Plan; records the law requires us to keep are retained for the period stated in section 3, restricted to that purpose.
You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (2 Prof. Tsvetan Lazarov Blvd., 1592 Sofia, Bulgaria; kzld@cpdp.bg; +359 2 91 53 519; www.cpdp.bg) or with the supervisory authority of the EU member state where you live or work.
9. Changes to this notice
We publish each version here with its date. Changes that matter to subscribers are also announced by email to the registered address, as the terms describe for changes (section 14).
← Back to the developer page