EMERGENCY LEGAL ENFORCEMENT & COMPLIANCE FRAMEWORK

Effective Date / Last Modified: June 1, 2026

This comprehensive, tier-one global Privacy Policy defines the structural rules under which Statlyzer SH Studio SRL ("we", "our", "us", "the Company", or "Data Controller") collects, handles, isolates, transfers, and safeguards the data profiles of individual data subjects ("User", "you", or "Operator") interacting with the web asset www.statlyzer-studio.com, the core backend analytics architecture, and the software interface Statlyzer Pro (collectively referred to as "the Service").

The Company acts as a primary Data Controller under the European General Data Protection Regulation (GDPR) (EU Regulation 2016/679), Romanian Law nr. 190/2018, and matching international consumer privacy acts. Our data minimization workflows are strictly engineered to maximize technical security and preserve transparency.

1. Granular Taxonomy of Data Categories Collected

The Company separates processed user architecture records into explicit, compartmentalized sub-structures:

• A. Identity & Authentication Profile Elements: During system authentication executed exclusively via Google OAuth secure loops, our servers request access token validations from Google Identity APIs. We fetch your explicit email address, localized language parameters, full system name, and verified Google unique system identifier. The Company implements absolute separation layers: we never query, handle, read, or host your network passwords.
• B. Corporate Transactional & Fiscal Meta-Data: For premium platform licenses, your payment cycle is delegated natively via secure token framing to our certified PCI-DSS Level 1 payment handler, Stripe Inc. and its global subsidiaries. The Company operates no raw direct view of complete credit card PAN strings, CVV matrices, or expiration dates. Stripe returns non-sensitive ledger indicators to our database: payment state, localized billing country of origin, customer token IDs, subscription renewal counters, and active corporate Tax/VAT IDs needed for compliance verification with Romanian tax networks (ANAF).
• C. Core Infrastructure Forensic & Security Traces: Our automated threat-detection algorithms continuously capture technical network footprints. This category includes absolute IPv4/IPv6 addresses, browser engine configurations (User-Agent metrics), machine timezone identifiers, screen resolution metrics, device hardware fingerprints, and Cloudflare connecting tunnel logs. This data is collected to maintain system stability and block credential stuffing, automated scraping loops, or distributed proxy bypasses.
• D. Continuous Platform Telemetry & Query Auditing: To enforce server compute limits and maintain credit allocations, we write granular usage records to our cloud containers. We track active match queries executed, processing timestamps, subscription tier validations (Free vs PRO), and computational credit balances.

2. Concrete Legal Bases and Explicit Purposes for Data Interrogation

Under GDPR Article 6(1), the Company validates data engineering pipelines using the following explicit frameworks:

1. Contractual Execution & Service Delivery (Art. 6(1)(b) GDPR): Processing authentication elements and credit data is strictly necessary to host your analytics workspace, validate premium access tiers, and run data distribution algorithms.
2. Legitimate Corporate Security Interests (Art. 6(1)(f) GDPR): Retaining forensic telemetry and IP logs is mandatory to protect the cloud database from cyber-attacks, block unauthorized endpoint access, prevent multi-accounting fraud on free tokens, and preserve our software property.
3. Absolute Statutory Legal Obligations (Art. 6(1)(c) GDPR): Storing transaction data, country codes, and billing profiles is legally required under European financial codes and Romanian fiscal accounting laws to generate invoices and submit reports to tax offices (ANAF).

3. Cross-Border Data Transfers & Downstream Processors

The Service scales globally by using optimized cloud networks. Your encrypted technical metrics are shared with our trusted enterprise subprocessors:

• Supabase Inc. (Database Architecture): Encrypted customer entries are managed within isolated cloud databases hosted inside secure European enterprise data zones.
• Cloudflare Inc. (Security & Edge Ingress): Network traffic passes through localized proxy routing shields to defend against malicious traffic and optimize page rendering speeds.
• Stripe Inc. (Financial Infrastructure): Payment tokens are handled directly within secure corporate financial gateways.
• Google LLC (Workspace & OAuth): Google manages account authentication and primary communication handling.

Where processing involves data nodes located outside the European Economic Area (EEA), the Company binds all providers to strict European Commission Standard Contractual Clauses (SCCs), alongside technical verification, ensuring your profile is fully protected.

4. Absolute Profile Retention Protocols

Forensic IP security logs are systematically purged or anonymized after 90 days. Identity profiles, operational query logs, and transaction metadata are retained for as long as your profile remains active in our system. If an account is abandoned or closed, the profile is permanently deleted within 30 days, except for financial accounting ledger invoices, which we are legally required to keep for 10 years to comply with Romanian fiscal regulations.

5. Complete Enumeration of Your Rights as a Data Subject

As a European citizen under GDPR, you possess advanced rights over your data. You can exercise these at any time by emailing us at contact@statlyzer-studio.com:

• The Right of Explicit Access (Art. 15): You can request a clear copy of all personal details saved in our active system logs.
• The Right of Rectification (Art. 16): You can correct incomplete or wrong profile metrics.
• The Right of Absolute Erasure / To Be Forgotten (Art. 17): You can order the immediate, permanent deletion of your system account.
• The Right to Restrict Processing (Art. 18) & Data Portability (Art. 20): You can request a pause on data processing or transfer your data profile to another provider.
• The Right to Object (Art. 21): You can halt data processing that relies on corporate legitimate interests.

If you believe the Company has violated your privacy rights, you have the right to lodge a formal complaint with the National Supervisory Authority for Personal Data Processing: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, București, Romania.

LEGAL CONTRACT & STRICT INDEMNITY BINDING PROTOCOL

Last Revised & Enforced: June 1, 2026

This document constitutes a binding, enforceable legal contract between Statlyzer SH Studio SRL (referred to as "the Company", "we", "us", or "our") and any person or corporate entity ("User", "Operator", or "you") accessing or interacting with the sports simulation application Statlyzer Pro and the domain website www.statlyzer-studio.com (collectively, "the Service").

By entering the platform, completing Google OAuth authorization loops, or initiating transaction streams, you explicitly declare that you have read, understood, and agreed to be legally bound by these terms. If you do not accept these terms in full, you are prohibited from using this platform.

1. Absolute Age Gate & Verification

The Service is designed exclusively for professional quantitative researchers, developers, and adult data analysts. You must be at least 18 years of age to use this platform. By authenticating your account, you officially warrant that you meet this requirement. The Company denies account access to anyone under 18 and will instantly delete any profile suspected of violating this age limit.

2. Ironclad Data Analytics Disclaimer & Exclusion of Financial/Wagering Liability

CRITICAL COMPLIANCE NOTICE: Statlyzer Pro operates strictly as an independent data engine. The Company does not host, provide, or facilitate online sports betting, bookmaking, gambling services, or wagering mechanisms. All metrics, Poisson algorithms, Dixon-Coles calculations, Expected Goals (xG) matrix projections, and "Neural Consensus" data indicators represent independent mathematical simulations intended solely for educational, historical research, and quantitative analysis purposes.

The platform does not provide financial advice, speculative investment advice, or betting recommendations. Sports outcomes are chaotic and non-deterministic; historical performance data cannot guarantee future statistical consistency. Any actions you take based on the data generated by this platform are taken strictly at your own choice and risk.

The Company, its corporate directors, founders, and employees reject all liability for capital losses, financial damages, psychological injuries, or wagering deficits incurred by a user. You agree to completely indemnify and hold Statlyzer SH Studio SRL harmless from any legal claims, losses, or costs arising from your interpretation or use of the analytics suite.

3. Premium Subscription Protocols, Automated Stripe Cycles & Absolute Non-Refundability

Access to expanded server query pipelines requires an active premium license ("PRO"), processed on a recurring subscription basis (Monthly or Annual options) via Stripe. All billing actions are drawn in advance. Prices are clearly displayed inside the application interface and are subject to European reverse-charge tax mechanisms for companies, or standard legal taxation rules for individual consumers.

• Automated Renewal Cycles: Your billing profile explicitly authorizes Stripe to charge your linked payment method (e.g., Revolut Business card) at the start of each billing period. Charges continue until you cancel your subscription.
• Immediate Cancellation: You can cancel your subscription plan at any time through the Account Billing panel. Your PRO access will remain active until the end of your current paid billing period, and no further charges will apply.
• Absolute Non-Refundability Policy (EU Digital Directive Exception): In accordance with Article 16(m) of the EU Consumer Rights Directive (2011/83/EU) and Romanian Emergency Ordinance OUG 34/2014, the right of withdrawal from a contract does not apply to the supply of digital content that is not supplied on a tangible medium, once performance has begun with the consumer's prior express consent. By purchasing a PRO subscription, you acknowledge that you gain instant access to our proprietary data pipelines. As a result, all transactions are final and non-refundable. The Company does not offer pro-rated refunds or credit rollbacks for partially used billing periods.

4. Prohibited Systems Activity, Scraping Protections & Account Forfeiture

The Company protects its data infrastructure aggressively. The following activities will result in immediate account termination, data access bans, and potential legal action:

• Using automated scripts, bots, spiders, scrapers, or mirrors to extract predictive data rows from our frontend layouts or backend APIs.
• Attempting to read, reverse-engineer, or decompile the proprietary mathematical scripts that process our statistical models.
• Sharing user accounts with other networks or using automated testing to bypass credit limit systems.

In the event of a system breach, the Company reserves the right to terminate your account immediately, without prior notice, refunds, or legal liability.

5. Proprietary Intellectual Property Rights

The Service, the design of its interface, its mathematical code structures, logo marks, and all data distribution layouts are the exclusive intellectual property of Statlyzer SH Studio SRL. They are protected by international copyright laws, trade secrets, and software patents. No corporate ownership or usage rights are transferred to you when using this platform.

6. Force Majeure & Service Availability

While we strive to maximize uptime, the Company offers no guarantee of continuous service. We are not liable for system delays or data delivery failures caused by internet failures, hosting infrastructure outrages (such as Supabase or Cloudflare service disruptions), or events beyond our control (Force Majeure).

7. Statutory Governing Law & Exclusive Jurisdiction Venue

This legal contract is governed by and construed in accordance with the laws of Romania, without regard to conflict of law principles. Any legal dispute arising from this agreement that cannot be resolved amicably shall be submitted to the exclusive jurisdiction of the competent judicial courts in Bistrița-Năsăud, Romania.