Privacy policy
Last updated: October 13, 2026
This policy explains what personal data Unagi Poker (“we”) processes, why, for how long, and what rights you have over it. It applies to the Unagi Poker website and app.
1. Data controller
The data controller is Marc Pont Casadevall, owner of Unagi Poker. For any privacy question, or to exercise your rights, write to support@unagipoker.com.
2. What data we process
- Account data: your email address, your password (stored only as a bcrypt hash, never in plain text), your preferred language, your sign-up date, the date you confirmed your email and your plan.
- Hand histories you upload: the text of the PokerStars hands you import and the data extracted from it (date, blinds, cards, actions, amounts and the screen names of the players at the table).
- Content you add: notes and HUD stats about opponents that you enter on a hand.
- Analyses and usage: the analyses generated for your hands and a record of each analysis run, which we use to calculate your monthly quota.
- Plan requests: the plan you ask for when you request an upgrade.
- Email confirmation and password reset: single-use links, stored as a hash, that expire.
- Technical data: the IP address and request details that the servers log when serving your visit.
We do not ask for or process special categories of data.
3. Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Create and maintain your account, store your hands and show them to you | Performance of a contract (Art. 6(1)(b)) |
| Analyse your hands with AI when you ask us to | Performance of a contract (Art. 6(1)(b)) |
| Send you service emails (welcome with email confirmation, password reset) | Performance of a contract (Art. 6(1)(b)) |
| Track your analysis quota and handle plan requests | Performance of a contract (Art. 6(1)(b)) |
| Keep the service secure and prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Aggregated, anonymous visit statistics to improve the site | Legitimate interests (Art. 6(1)(f)) |
We do not send advertising, we do not sell your data and we do not use it to build marketing profiles.
Other players’ screen names. Hand histories include the screen names of the other players at the table. They are processed only because they are part of the hand you are analysing, on the basis of legitimate interests, and we make no attempt to identify the people behind them. If you are one of those players, you can contact us at the address above.
Automated analysis. The analysis is produced by an AI model. It is an indicative assessment of your play; no decision producing legal effects on you, or similarly significantly affecting you, is made with it.
4. Who we share it with
Only with the providers we need to run the service, acting as processors and solely on our instructions:
- Hosting provider (European Union): the server and database where your account and hands are stored.
- Google (Gemini API): receives the hand text, your notes and your language to generate the analysis. We use the paid tier of the API, under which Google does not use that data to train or improve its models; it may keep it for a limited period solely to detect abuse.
- Resend: sends the service emails, so it processes your email address and the message content.
- Vercel: hosts the website and provides visit statistics, which are aggregated and cookie-free.
We do not disclose your data to anyone else unless required by law.
5. International transfers
Google, Resend and Vercel may process data in the United States. These transfers rely on appropriate safeguards: the EU-US Data Privacy Framework where the provider is certified, or the Standard Contractual Clauses approved by the European Commission.
6. How long we keep it
- Your account, hands, notes and analyses are kept for as long as your account is active.
- If you delete your account, it is erased immediately from our database together with everything linked to it: hands, analyses, usage records, plan requests and reset tokens.
- Email confirmation links expire after 24 hours, and password reset links after one hour.
- Server logs are kept only as long as needed for security and troubleshooting.
7. Storage in your browser
We do not use cookies. The app stores your session token, a copy of your basic
account details and your preferred language in your browser’s local storage
(localStorage). These are strictly necessary for the app to work and are
cleared when you log out (except the language).
8. Your rights
You can exercise your rights of access, rectification, erasure, objection, restriction of processing and data portability at any time by writing to support@unagipoker.com. We will reply within one month.
You can delete your account and all your data yourself from your profile, without writing to us.
If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es) or with the supervisory authority where you live.
9. Security
Traffic is encrypted (HTTPS), passwords are stored hashed and each user can only access their own hands. No system is completely secure, but we take reasonable measures to protect your data.
10. Minors
Unagi Poker is intended only for people aged 18 or over. We do not knowingly process data from minors; if we find an account belonging to a minor, we will delete it.
11. Changes to this policy
If we change this policy, we will update the date on this page and, if the change is significant, let you know by email or in the app.