Privacy policy
What personal data Dupin holds, why, who helps us handle it, and the controls you have. Short version: we keep only what the site needs, we never sell it, and you can download or delete your account yourself.
Last updated 5 November 2026
Who we are
Dupin is run by a sole trader based in Scotland, United Kingdom, who is the controller of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).
For anything about your data, use our contact form and choose “Privacy or your data”. We reply within one month.
What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Email address, password (stored only as a one-way hash), first and last name, optional username | To create and run your account, sign you in and email you about it | Contract |
| Date of birth | To confirm you're 18 or over | Legal obligation and legitimate interests |
| Plan, trial and subscription status, Stripe customer reference | To give you the right access and manage billing | Contract; legal obligation for tax records |
| Starred markets, alert settings, teams and competitions you follow, alert devices | To show your Favourites and send the match alerts you asked for | Contract |
| How you found us, referral and promo or gift codes used, last sign-in time | To apply offers and gifts, and understand which channels bring people in | Contract and legitimate interests |
| Messages you send us (name, email, message, the page you came from) | To answer you and fix reported data issues | Legitimate interests |
| Page views, clicks, load speed and errors (see the cookie policy) | To see what's used and fix what breaks | Consent: off until you agree |
| Sign-in attempts and request counts, stored as one-way codes, not raw IP or email | To protect accounts from password guessing and abuse | Legitimate interests |
Card details go straight to Stripe and never reach us. We don't collect special category data, and we don't make decisions about you by automated means: Dupin's probabilities are about matches, not people.
Emails
We send emails you need: confirming your address, password resets, account and subscription notices. Product news or offers only go to you if you've opted in, and you can switch that off in Settings or from any such email.
Who we share it with
We don't sell your data or share it with advertisers. These companies process it for us, only on our instructions and under contracts that require them to protect it:
| Company | What they do | Where |
|---|---|---|
| Vercel | Hosts the website | Servers in London; US company |
| Neon | Hosts the database | London |
| Stripe | Takes payments and manages subscriptions | UK, EU and US |
| Resend | Sends account emails | US |
| Render | Runs background jobs such as match alerts | Frankfurt, Germany |
| Your browser's push service (Google, Apple or Mozilla) | Delivers match alerts to your device, if you turn them on | Varies |
Where data leaves the UK, it's protected by UK-approved safeguards: the UK Extension to the EU–US Data Privacy Framework, or the UK's International Data Transfer Addendum to standard contractual clauses. We may also share data where the law requires it, for example with HMRC or the police.
How long we keep it
| What | Kept for |
|---|---|
| Your account, settings and favourites | Until you delete your account |
| Payment and invoice records | 6 years after the payment, as UK tax law requires |
| Analytics events | 13 months; on account deletion they're no longer linked to you |
| Record of your cookie choice | 2 years |
| Messages you send us | Up to 2 years after we've dealt with them |
| Sign-in protection counters | About a day |
| Alert devices | Until you turn alerts off, the device stops accepting them, or you delete your account |
Your rights
You can, at any time:
- Get a copy of your data: Settings → Your data → Download gives you everything on your account in a portable file.
- Correct it: edit your profile in Settings, or ask us.
- Delete it: Settings → Your data deletes your account and cancels any subscription straight away. Payment records we must keep for tax are the only exception.
- Withdraw consent: change or turn off marketing emails. This doesn't affect anything done before.
- Object to or restrict how we use your data, where we rely on legitimate interests.
For anything you can't do yourself, contact us. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd like the chance to put it right first.
Keeping it safe
Everything travels over HTTPS. Passwords are stored as one-way hashes, sign-in uses a cookie page scripts can't read, repeated failed sign-ins are blocked, and only the person who runs Dupin can reach the database. If a breach ever put you at risk, we'd tell you and the ICO as the law requires.
Age
Dupin is for adults: you must be 18 or over to create an account. We don't knowingly collect data from anyone younger, and we'll delete it if we find we have.
Cookies
See our cookie policy for what's stored on your device, and to change your choice.
Changes
We'll update the date at the top whenever this policy changes, and email account holders before any change that affects them in a significant way.