Privacy Policy
Last updated 30 October 2026
This policy explains what personal data Statwell collects, why, who receives it, how long it is kept and what your rights are. In short: an email address and the details of your account and subscription, no advertising, analytics cookies only with your consent, payments handled by Paddle.
Who is responsible for your data
შპს სტატუელ, a limited liability company (LLC) registered in Georgia under company number 405858852, 10A Aleksandre Kazbegi Ave., Apt. 52, Saburtalo District, Tbilisi 0160, Georgia, operates Statwell and is the controller of the personal data described in this policy. For anything about your data, write to contact@statwell.io.
Paddle.com is the Merchant of Record for all our orders. When you buy a subscription, Paddle collects and processes your payment details as an independent controller under its own Privacy Notice. We never see or store your card details.
What we collect, why, and on what basis
We collect only what we need to run Statwell. The legal basis is given for each use, as required by the GDPR and similar laws.
| Data | Why we use it | Legal basis |
|---|---|---|
| Account: email address, password (stored only as a one-way hash), the sign-in method, and the date you joined. With Google sign-in: the name, email address and profile identifier Google shares with us. | Why we use it:To create your account, sign you in and send the emails the account needs (address confirmation, password reset, email change). | Legal basis:Contract |
| Preferences you set in your account. | Why we use it:To show you what you asked for. | Legal basis:Contract |
| Subscription: plan, status, billing period, renewal and cancellation dates, and the identifiers Paddle sends us for your customer record, subscription and transactions, with the email address and country attached to them. | Why we use it:To give you Statwell Intel while you pay for it, handle cancellations and refunds, and keep records. | Legal basis:Contract; legal obligation (accounting) |
| Security: sign-in, sign-up and password-reset attempts (the email address or network address used, and whether it succeeded); technical logs kept by our hosting provider (IP address, browser, pages requested). | Why we use it:To protect accounts against guessing and abuse, and to keep the service working. | Legal basis:Legitimate interests (security) |
| Audience measurement: pages viewed, referring site, browser, operating system, device type, approximate country, and clicks on a few of our buttons. No name, email, account identifier or cookie. | Why we use it:To understand which pages are useful, in aggregate only. | Legal basis:Legitimate interests (improving the service) |
| Product analytics, only if you accept them in the cookie banner: the pages you view, the steps of the sign-up and subscription journey (for example opening the plans or the checkout), referring site and campaign, browser, device type and approximate country, and recordings of your visits in which everything you type and the text of the Intel analysis are hidden. When you are signed in, these are linked to your account identifier, never to your email address. If you decline, nothing is sent to PostHog. | Why we use it:To understand how people find and use Statwell, and where the sign-up and subscription journey loses them. | Legal basis:Consent |
| Account and subscription milestones, only if you accepted analytics in the cookie banner: an account created, a sign-in completed, a subscription started, cancelled or ended, a complimentary plan given or withdrawn, recorded against your account identifier with the plan and its price. Your answer is kept with your account so that these follow it; if you decline or change your mind, they stop. | Why we use it:To measure how many visitors become members and subscribers. | Legal basis:Consent |
| Offers and news by email, only if you ask for them (the box at sign-up, the one-time question on your Statwell home page, or Account → Offers by email): your answer, where and when you gave it, the emails we sent you, whether each was delivered, whether you followed its link, and whether you subscribed afterwards. We do not track whether an email was opened. Addresses that unsubscribed, bounced or complained are kept on a do-not-email list. | Why we use it:To send you occasional Statwell offers and news, and to know whether they are useful. Unsubscribe with the link in any of them or in your account. | Legal basis:Consent |
| Messages you send us, with your email address. | Why we use it:To answer you. | Legal basis:Legitimate interests; contract when it is about your account |
We do not sell personal data, show advertising, build advertising profiles, or make decisions about you by automated means that have legal or similarly significant effects.
We send offers and news by email only to people who asked for them. Every such email has an unsubscribe link, and you can turn them off in your account at any time; account emails (sign-in links, receipts) are not affected.
Who receives your data
We share personal data only with the providers that run Statwell for us, under contracts that limit their use of it to providing their service to us, and with Paddle:
| Recipient | Role | Where |
|---|---|---|
| Supabase | Role:Database and account sign-in | Where:European Union (Ireland) |
| Vercel | Role:Hosting, content delivery and audience measurement | Where:United States and a global network |
| PostHog | Role:Product analytics and session recordings | Where:European Union (Germany) |
| Resend | Role:Delivery of account emails, and of offers if you asked for them | Where:United States |
| Role:Only if you choose to sign in with Google | Where:Under Google's own terms | |
| ESPN's image servers | Role:Fighter portraits are loaded by your browser directly from them, which shares your IP address and browser details with them. No cookies are set. | Where:United States |
| Paddle | Role:Merchant of Record: checkout, payment, tax, receipts, refunds (independent controller) | Where:Under Paddle's Privacy Notice |
We may also disclose data to professional advisers (lawyers, accountants) under confidentiality, to a buyer of the business if Statwell is sold, or to authorities where the law requires it.
International transfers
Statwell is operated from Georgia, and some of our providers process data in the United States. Where data protected by the GDPR or UK law leaves the European Economic Area or the United Kingdom, we rely on an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified under it) or on the Standard Contractual Clauses (and the UK addendum) in our providers’ data processing terms. You can ask us for more information about these safeguards.
How long we keep it
- Account data and preferences: as long as your account exists. When you ask us to delete your account, we delete them within one month of the request.
- Subscription and transaction records: as long as your account exists, then for as long as accounting and tax law require and to deal with any dispute.
- Sign-in, sign-up and password-reset attempts: 30 days.
- Hosting provider logs: a limited period set by the provider.
- Audience measurement: kept by Vercel in aggregate under its own retention period.
- Product analytics: kept by PostHog under the retention period of our plan; session recordings are deleted after 30 days.
- Messages you send us: as long as needed to deal with your request and any follow-up, then deleted.
Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and get a copy
- have inaccurate data corrected
- have your data erased, including by deleting your account
- restrict or object to some uses of it, including any use based on our legitimate interests
- receive the data you gave us in a portable format
- withdraw consent at any time, where we rely on it
- complain to a data protection authority: in Georgia, the Personal Data Protection Service; in the EU or the UK, the authority where you live or work
To use any of these rights, including deleting your account, write to contact@statwell.io from the address of your account. We answer within one month, and may ask you to confirm your identity first. If you have an active subscription, we cancel it before deleting the account. Records we must keep by law are kept for that purpose only.
You can correct your email address and password yourself in your account.
Security
Statwell is served only over encrypted connections (HTTPS). Passwords are stored as one-way hashes. Sign-in sessions are kept in cookies that page scripts cannot read. Access to the database and to the editorial tool is limited to the people who need it, the accounts that administer our infrastructure use two-factor authentication, and backups are encrypted.
No method is perfect
If a breach affecting your data occurs, we will inform you and the competent authorities where the law requires it.
Age
Statwell is not intended for children. You must be at least 16 to create an account and at least 18 to buy a subscription. If you believe a child under 16 has given us personal data, contact us and we will delete it.
Changes to this policy
We update this policy when what we do with personal data changes. The date at the top shows the latest version; for a material change we also email subscribers at the address on their account.
Contact
შპს სტატუელ, a limited liability company (LLC) registered in Georgia under company number 405858852, 10A Aleksandre Kazbegi Ave., Apt. 52, Saburtalo District, Tbilisi 0160, Georgia. Privacy questions and requests: contact@statwell.io.