AlphaGrab · Version 2.32 · Last updated 29 September 2026
This Privacy Policy explains how AlphaGrab (“we”, “us”), the operator of alphagrab.de, collects, uses, shares and protects your personal data, and the rights you have. It applies to our website and services (the “Service”).
The data controller is MUDr. Ľubomír Polaščín - Nephroctor (IČO 57 646 856), established at Kvetná 944/2I, 900 41 Rovinka, Slovakia, which operates AlphaGrab at alphagrab.de. For privacy questions or to exercise your rights, contact alphagrab@nephroctor.com. You also have the right to lodge a complaint with your local data-protection authority; our lead supervisory authority is the Úrad na ochranu osobných údajov Slovenskej republiky (dataprotection.gov.sk).
| Category | Examples |
|---|---|
| Account data | Email address, hashed password, display name, optional bio. |
| Contact & verification | Phone number and verification status (only if you add one). |
| Service data | Watched events, price alerts and thresholds, team follows, and any auto-buy rules and purchase orders you create. |
| Billing data | Subscription plan/status and Stripe customer/subscription IDs. Card details are handled by Stripe — we never see or store them. |
| Technical & security | IP address and login attempts (for rate-limiting and fraud prevention), basic device/browser info. |
| Communications | Emails/SMS we send you and your support messages. |
We collect data you provide (e.g. at sign-up), data generated as you use the Service, and limited technical data collected automatically. We do not knowingly collect special-category data.
For users in the EEA, Switzerland and the UK, we rely on the following legal bases (GDPR / UK GDPR):
| Purpose | Legal basis |
|---|---|
| Create and operate your account | Performance of a contract — GDPR Art. 6(1)(b) |
| Deliver the price-drop alerts and auto-buy notifications you configure (email) | Performance of a contract — Art. 6(1)(b) |
| Send SMS alerts and verify your phone | Consent — Art. 6(1)(a) (you enable SMS; withdraw anytime) |
| Process paid Pro and Agent subscriptions and keep tax/accounting records | Contract — Art. 6(1)(b); legal obligation — Art. 6(1)(c) |
| Generate AI Resale Advisor and AI Market Prognosis assessments for Agent users (event and price signals only; no account credentials) | Performance of a contract — Art. 6(1)(b) (Agent subscription) |
| Affiliate referral attribution and click-fraud prevention: when you follow a partner's referral link we record the click with your IP address and browser user agent; both are erased after 90 days, the anonymous click count is kept | Legitimate interests — Art. 6(1)(f) |
| Secure the service: rate-limiting, fraud and abuse prevention | Legitimate interests — Art. 6(1)(f) |
| Optional analytics to improve the product | Consent — Art. 6(1)(a) (via the cookie banner) |
| Marketing & conversion measurement via advertising pixels (Meta, TikTok) | Consent — Art. 6(1)(a) (via the cookie banner; marketing category) |
We do not sell your personal data for money. We share data only with the service providers (sub-processors) needed to run the Service, when required by law, or in a business transfer. Each provider is bound by a data-processing agreement.
| Provider | Purpose | Transfer |
|---|---|---|
| Stripe | Payments & subscription billing | EU + US (DPF / SCCs) |
| Resend | Transactional email delivery | US (SCCs) |
| Twilio SendGrid | Email delivery (fallback) | US (SCCs) |
| Twilio | SMS alerts & phone verification | US (SCCs) |
| Anthropic | AI Resale Advisor and AI Market Prognosis — event and price signals are sent to Claude to produce structured ticket-resale and market assessments (Agent feature only) | US (SCCs) |
| Tavily | Event discovery & search — real-time web search for live event and ticket information | US (SCCs) |
| Discord | User-configured webhook price drop alerts | US |
| Telegram | User-configured bot price drop alerts | US/EU |
| X (Twitter) | Publication of public deal announcements on our own channel (no personal data) | US |
| Ticketmaster | Event & ticket price data source | US/EU |
| SeatGeek | Event & ticket price data source | US |
| TickPick | Event & ticket price data source | US |
| StubHub | Event & ticket price data source | US |
| Viagogo | Event & ticket price data source | Switzerland/US |
| Eventim DE | Event & ticket price data source | EU |
| Eventim UK | Event & ticket price data source | UK |
| Ticketcorner | Event & ticket price data source | Switzerland |
| Eventbrite | Event & ticket price data source | US/EU |
| TicketOne IT | Event & ticket price data source | EU (Italy) |
| Entradas ES | Event & ticket price data source | EU (Spain) |
| AXS | Event & ticket price data source | US/UK |
| VividSeats | Event & ticket price data source | US |
| Official football club websites | Event & ticket price data source — home-fixture listings published directly by football clubs (e.g. Premier League, Scottish & League of Ireland clubs such as Manchester United) | UK/EU |
| Official darts tournament websites (PDC) | Event & ticket price data source — televised-major listings published directly by the Professional Darts Corporation (e.g. World Championship, Premier League, World Matchplay) | UK/EU |
| football-data.org | Live match data | EU/UK |
| Ticket Evolution | Event & ticket price data source — resale marketplace aggregating inventory from professional ticket brokers | US/global (SCCs) |
| TheSportsDB | Event schedule data source — multi-sport fixtures for clubs outside the football-data.org coverage | UK/EU |
| OpenLigaDB | Event schedule data source — German football (Bundesliga) fixtures | Germany (EU) |
| Browser push services (Google, Mozilla, Apple, Microsoft) | Delivery of browser push notifications you enable — the price-alert text is relayed through your browser vendor's push service | US/EU (SCCs / EU-US DPF where applicable) |
| ExchangeRate-API | Currency exchange rates — converts ticket prices into your chosen display currency | US/global (no personal data sent) |
| Google Analytics (GA4) | Optional usage analytics (only with your analytics consent) | US (SCCs / Google Consent Mode) |
| Meta Platforms | Optional marketing/conversion measurement — Meta Pixel (only with your marketing consent) | US (SCCs) |
| TikTok | Optional marketing/conversion measurement — TikTok Pixel (only with your marketing consent) | US/EEA (SCCs) |
| Neon | Managed PostgreSQL database | EU region |
| Hetzner | Application/backend hosting | Germany (EU) |
| Vercel | Frontend hosting & CDN | US/global (SCCs) |
Some providers are located outside your country. Where we transfer data internationally we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK Addendum, and the EU-US Data Privacy Framework where applicable.
We keep account data while your account is active and delete or anonymise it after closure, except where we must retain records (e.g. tax/accounting for billing) or to resolve disputes. Security logs such as login attempts are purged on a rolling 24-hour basis. Your cookie consent record is kept for up to 180 days.
Passwords are hashed with bcrypt, transport is encrypted with TLS, access is restricted, and we apply rate-limiting and other safeguards. No method of transmission or storage is 100% secure, but we work to protect your data and notify you of incidents where required.
European Economic Area, Switzerland & United Kingdom
GDPR / UK GDPR / Swiss FADP
Access, rectification, erasure, restriction, data portability, objection, and the right to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority. We rely on the legal bases listed above; where processing is based on legitimate interests you may object at any time.
United States (CA/CPRA, VA, CO, CT, UT, TX, OR, MT, MD, MN, DE, IA, NE, NH, NJ, TN, IN, KY, RI and other state laws)
CCPA/CPRA, VCDPA, CPA, CTDPA, UCPA, TDPSA, MODPA, MCDPA and other state privacy statutes effective 2025–2026
Right to know/access, delete, correct, and to opt out of the “sale” or “sharing” of personal information and of targeted advertising. We do not sell your data for money; we honour the Global Privacy Control (GPC) signal and the “Reject / Do Not Sell or Share” control. You may appeal a denied request and will not be discriminated against for exercising your rights. To exercise rights, use the in-app controls or email us; we verify requests against your account.
Brazil
LGPD (Lei Geral de Proteção de Dados)
AlphaGrab is the data controller (controlador) for your personal data. You may confirm processing, access, correct, anonymise, port or delete your data, obtain information about sharing, and revoke consent. Requests can be made to our privacy contact and, where unresolved, to the ANPD.
Latin America (Argentina, Mexico, Colombia, Chile, Peru)
National data-protection laws
Access, rectification, cancellation/deletion and objection (ARCO-type) rights, and withdrawal of consent for optional processing.
Canada
PIPEDA / Québec Law 25
Meaningful consent for optional processing, access and correction rights, and the ability to withdraw consent.
Asia (China, South Korea, Japan, India, Singapore, Thailand)
PIPL, PIPA, APPI, DPDP, PDPA
Optional processing relies on consent (separate/explicit where required). You may access, correct, delete and port your data and withdraw consent. Cross-border transfers are made under the safeguards each law requires.
Australia & New Zealand
Privacy Act 1988 (AU) / Privacy Act 2020 (NZ)
We collect only what is reasonably necessary, are transparent about optional tracking, and provide access and correction rights.
If you are a US resident, you may request to know, access, delete and correct your personal information, and opt out of any “sale” or “sharing” and of targeted advertising. Use the in-app cookie controls (which include “Reject / Do Not Sell or Share”), or email alphagrab@nephroctor.com. We honour Global Privacy Control (GPC) browser signals automatically, do not discriminate against you for exercising rights, and you may appeal a denied request by replying to our decision.
We use strictly necessary storage by default and optional cookies only with your consent. See the Cookie Policy for details and to manage your choices.
The Service is not directed to children under 16 (or the age set by your local law) and we do not knowingly collect their data. If you believe a child has provided us data, contact alphagrab@nephroctor.com.
We may update this policy; material changes will be highlighted in the “Summary of recent updates” above and the “Last updated” date will change. Continued use after an update means you accept the revised policy.
Privacy: alphagrab@nephroctor.com · See also our User Agreement.