Legal and privacy
Data Export and Subject Access Requests
- Last updated:
- 11 July 2026
- Effective:
- 21 June 2026
- Version:
- 2026-06-21
1. Product exports
Signed-in users can go to You / Account and use Download product export, regardless of their league plan. Product exports include the account and prediction-related data currently supported by the product and are scoped to the organisation being viewed.
Product exports are not a complete statutory subject access response unless confirmed in writing for a specific request.
2. Subject access requests
To request a wider copy of personal data held about you, email admin@scoresocial.app with the subject Subject access request. Include your username, organisation or league, recovery email if used, and enough information to identify your account.
We may verify your identity before responding. We respond within one month unless the law permits an extension of up to two further months for complex or multiple requests.
3. Data sources checked for rights requests
| Source | Examples |
|---|---|
| Core database | Account, organisation, membership, invite, access request, prediction, entry, score, standing, event, pool, notification, billing, legal acceptance, and audit tables. |
| Storage | Organisation logos, uploaded assets, bug screenshots, and signed URL records where applicable. |
| Authentication and sessions | Session records, token versioning, user agent, and IP address where retained. |
| Email provider | Recovery and OTP delivery metadata. |
| Billing provider | Stripe customer, subscription, invoice, checkout, portal, and webhook records where applicable. |
| Diagnostics providers | Sentry errors, performance traces, logs, and replay data only if replay collection is separately enabled. |
| Hosting/log providers | Request logs and deployment/application logs where retained. |
| Issue tracker/support | Bug reports, support notes, screenshots, and issue metadata. |
| Local/mobile storage | Device/browser unsent prediction choices, queues, cached branding, tokens, and push-token records accessible to the user on their device. |
4. Format and deletion relationship
Product exports and rights responses may be provided in JSON, CSV, PDF, or another structured format. Some provider records may be supplied in the format made available by that provider.
If you plan to delete your account, request or download any export you need first. See Data Deletion and Account Closure.