Privacy policy
Last updated: 12/10/2026
This policy explains what personal data we process when you use the PokerImprove application (“the App”), the website pokerimprove.com (“the Website”) and the related services, why we process them, for how long and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).
1. Data controller
The controller is Antonio Tatarelli, Via Magalotti 112, 00042 Anzio (RM), Italy, VAT no. IT18722711001. For any question or request about your data you can write to privacy@pokerimprove.com or use the Contact us section of the App.
2. What PokerImprove does, in brief
The App reads the hand history files that poker rooms save on your computer, calculates statistics on your game and on that of the opponents you have met, shows those statistics while you play and, if you ask, sends a hand to an artificial intelligence model to obtain an analysis of it. Most of this work takes place on your computer: the sections below distinguish what stays there from what reaches our servers.
3. Data that stay on your computer
The hand history files, the App's local database (imported hands, statistics, notes, bankroll), the history of analyses and the diagnostic files are saved on your computer and are not sent to us, except in the cases described in sections 5, 6 and 7. These data are not encrypted by the App (except for the session credentials and the sign-in email addresses, below): their protection depends on your computer's own security measures, and deleting them is up to you — the App shows the folders where they are.
So that you do not have to retype your address at every sign-in, the App remembers on your computer, in encrypted form, the last email addresses used to sign in from that computer (at most five) and suggests them on the sign-in screen. An address enters the list only after a successful sign-in, leaves it when the account is closed, and is never sent to us.
4. Account and subscription
Data: email address, password (stored only in non-reversible encrypted form), username, status of the account and of the plan, identifier of the active device, IP address and technical information about sign-in sessions, and any sales partner code typed during registration or, before the first purchase, in the App.
Purposes and legal basis: creating and managing your account, authenticating you, providing the plan you subscribed to, preventing abuse and alerting you to security events concerning your account (performance of the contract, Art. 6(1)(b); for security, legitimate interest, Art. 6(1)(f)). The partner code is used to recognise who invited you and to calculate the fee owed to that partner. The partner never receives your name, your email address or your game data. The partner sees an identification code that stands in for your name and, next to that code, the data needed to calculate and check the partner's fee: your registration and trial period, the code you entered, your payments net of VAT and, if a payment is refunded or corrected, the correction, without the reason (legitimate interest, Art. 6(1)(f)). If you received the code directly from the partner, the partner can tell that this identification code is yours.
Provision of data: the email address and the password are needed to use the App; without them, you cannot register.
Where: the data are stored on the Supabase platform, in a data centre in Germany (Frankfurt), on infrastructure provided by Amazon Web Services. Supabase is a company based in Singapore and may access its systems remotely for administration and support: see section 11 on transfers.
Retention: for as long as the account exists. When you ask for deletion (section 13), the data are permanently erased after 30 days. The technical data of sign-in sessions (IP address and information about the program used) are kept by the authentication platform for as long as the session remains valid; the application logs of our servers are kept for 3 days.
Incomplete registrations: if you start registering and never enter the confirmation code, the account remains unusable and you would not be able to ask for its deletion. For this reason we delete it automatically after 7 days.
An exception to deletion: we keep for 10 years the proof that you accepted the Terms of Service — which version and on what date — even after the account is closed. We keep it in pseudonymised form: not your email address, but a code derived from it, which allows us to find that record only if you give us your address. It serves to prove the acceptance if it were disputed (Art. 17(3)(e) GDPR), and it is the same period that the law sets for accounting records.
Another exception: if you withdraw from the contract with the App's function (My account → Withdrawal from the contract), we keep your statement as you sent it — your name, the email address, the contract you are withdrawing from, the date and time — together with the acknowledgement of receipt we send you, and we receive a copy of it in order to carry out the withdrawal. Recording it and confirming its receipt is a legal obligation (Article 54-bis of the Italian Consumer Code; Art. 6(1)(c) GDPR); we keep it for 10 years, even after the account is closed, to be able to prove when and how the withdrawal was exercised (Art. 17(3)(e) GDPR). This also applies to withdrawal from the free registration.
A third exception: we also keep for 10 years the proof of payments and of your consent to the charge — the quote for a plan change that you accepted and the purchase confirmation we sent you — with the amounts and the version of the text you accepted, but without your email address, which is removed. They serve to prove what was shown to you before a charge (Art. 17(3)(e) GDPR).
5. Synchronised statistics and data about opponents
Data: aggregate statistics of your game; for each opponent you have met, the nickname under which they appear in the room, aggregate counters (for example how many times they raised before the flop out of how many opportunities) and the notes that you yourself decide to write about them; your bankroll movements. Complete hands are not synchronised to our servers: they leave your computer only when you ask for an analysis (section 6), and even then we do not store them on our servers: the language model provider keeps them for at most 30 days (section 6).
Why: to make your statistics and your notes available on all the devices on which you use the App (performance of the contract). As regards the opponents' nicknames, which are third-party data, the processing is based on our and your legitimate interest (Art. 6(1)(f)) in offering and using a tool for studying one's own game based on the hands that the room has lawfully delivered to you: the data are pseudonymous (only the nickname), aggregated, visible exclusively to you and never combined with those of other users, and they produce no effect on the players they refer to. The balancing of these interests is documented and available on request. Opponents can object: see the Notice to players.
The notes: they are your own private content. We do not read them. The Terms of Service forbid including in them data about the health, opinions or private life of other people, offensive content or identifying data other than the nickname. Each note has a limit of 400 characters: it is meant to record a style of play, not to collect information about a person.
Retention: for as long as the account exists; the lines concerning a player who has objected are deleted.
6. Artificial intelligence analysis
When you ask for the analysis of a hand, the App sends to our servers the text of that hand (cards, actions, amounts, nicknames of the players at the table) and the statistics available on them. Our servers (located in Germany) reconstruct the hand and send it to a language model provider (currently OpenAI), which produces the text of the analysis. This provider's processing takes place in the United States: see section 11 on transfers. The nicknames are sent as they appear in the room's hand history: before sending, they undergo only a technical clean-up (spaces, control characters and truncation to 20 characters) which serves the security of the system and does not make them any less recognisable. Under its contract, the provider does not use the data to train its models and keeps them for at most 30 days for abuse monitoring only. The text of the analysis stays on our servers until the App confirms it has received it, and in any case no longer than 30 days; then it is deleted. The technical data of the request (hand identifier, table level, outcome) are kept for 30 days and then deleted. The accounting record of the credits charged, on the other hand, is kept for as long as the account exists: it is what allows your balance to be reconstructed, and it is deleted with the account.
Legal basis: performance of the contract (it is the function you requested by starting the analysis); for the opponents' data, legitimate interest as in section 5.
Warning: the analysis is generated by an artificial intelligence system and may contain errors; it is not financial advice or a guarantee of results.
7. Support (“Contact us” form)
When you write to us from the App, we receive your message, the account's email address, the App version, the operating system and — only if you tick the box, which is unticked by default — the diagnostic log. The App describes to you what it contains before sending: technical information about recent activity and errors, which may include your computer's username and nicknames present in file paths. If you send us hand history files to help us support a new room, those files contain other players' nicknames: we use them only to adapt the program and delete them within 90 days.
Messages pass through the Resend email service and arrive in our support mailbox, hosted by Aruba S.p.A. (Italy). The content of the diagnostic log does not travel by email: it stays on our servers, and the notification we receive contains only the reference needed to consult it. We keep messages for 24 months and the diagnostic log for 30 days, after which it is deleted and the message remains without the attachment.
Legal basis: performance of the contract (support); for the files sent, legitimate interest in improving the service.
8. Automatic error reports (optional)
If you consent at first start-up or in Settings, when an error occurs the App sends a technical report to the Sentry service (an organisation with its data stored in Germany): the type of error, data about the operating system and the version, and a random identifier of the installation, which lets us understand whether several errors come from the same computer. File paths and messages are cleaned before sending; the report contains no hands, no nicknames and not your name. The service also receives the IP address from which the report is sent. You can withdraw your consent at any time from Settings: reports already sent are kept for 30 days.
Who is asked: the choice belongs to your account, on that computer: every account is asked the first time it signs in on a machine, and every account can change it from Settings. Before sign-in, when no account is open, the App applies the last choice made on that computer, so that an error at start-up can also be reported.
Legal basis: consent (Art. 6(1)(a)). Withdrawing consent does not affect the lawfulness of the reports sent before.
9. Website and update channel
Legal basis: legitimate interest in the security and operation of the service.
10. Payments
Subscriptions and analysis packs are purchased through Stripe (Stripe Payments Europe Ltd, Ireland). The first payment takes place on a Stripe page, which keeps the card for renewals and plan changes: card data do not pass through our systems. Stripe processes them on our behalf to carry out the payment, and as an independent controller, according to its own privacy policy, to prevent fraud and comply with its own legal obligations. If you choose to pay with Apple Pay or Google Pay, you also use Apple's or Google's service, which process the data of your digital wallet under their own terms and privacy policies; no additional data reaches us. The billing address and the email entered on that page are processed by Stripe on our behalf, to issue the accounting documents and determine the applicable VAT. We keep, for as long as the account exists, the identifier that Stripe assigns to your payment profile and to your subscriptions, the active plan and any scheduled plan, the history of plans and a technical log of the events received from Stripe (type and outcome, without payment data), deleted after 90 days. Invoices are kept for 10 years to comply with tax obligations. Before each automatic renewal we send you a notice at your account's email address, with the date by which you can cancel (for an annual subscription 30 days before it expires, for a monthly one right after the previous renewal): this is required by Article 65-bis of the Italian Consumer Code, and for this processing the basis is the legal obligation (Art. 6(1)(c)). Of that notice we keep the proof — which subscription, when it was sent and in which language, without the text and without your address — for as long as the account exists. When the account is deleted, the subscriptions are cancelled and the payment profile at Stripe deleted.
For every payment we issue an electronic invoice. To address it, at your first purchase the App asks for the first name and surname of the invoice holder, the country of residence and, if you live in Italy, the Italian tax code (codice fiscale), which the law requires on an invoice to a consumer; the address is requested by the payment page. Name, country of residence and tax code are kept by Stripe in your payment profile, on our behalf: they pass through our systems only to reach Stripe, we do not store them on our servers, and the App shows only part of the tax code. The invoice is prepared with our invoicing software (Aruba PEC S.p.A., on our behalf), transmitted to the exchange system of the Italian Revenue Agency (Sistema di Interscambio) as required by law and kept for 10 years; our accountant receives a copy of it, to keep the accounts. Without the tax code we cannot issue invoices: purchases remain blocked until you enter it, and if a subscription turns out to have been paid without it, access to the service remains suspended until you add it. Legal basis: performance of the contract for the payment profile, the plans and the event log; legal obligation for invoices and taxes, including the tax code and the invoice holder's details.
11. Recipients and transfers outside the European Union
Your data are processed, on our behalf and under contracts compliant with Art. 28 GDPR, by the providers listed above. Where they are based, and where the data are:
- Supabase (database and authentication): a Singapore company; the data are stored in Germany, on Amazon Web Services infrastructure (United States). Possible remote access from Singapore is covered by the standard contractual clauses;
- Stripe (payments and invoicing; for fraud prevention and its own legal obligations it is an independent controller, section 10): Stripe Payments Europe Ltd, Ireland; payments may also be processed by group companies in the United States, covered by the Data Privacy Framework and by the standard contractual clauses;
- Fly.io (analysis servers): United States; the servers are in Germany;
- OpenAI (language model): processing takes place in the United States, on the basis of the standard contractual clauses;
- Cloudflare (network and delivery), Resend (email sending) and Sentry (error reports, with data stored in Germany): United States;
- Aruba PEC S.p.A. (electronic invoicing): Italy;
- Aruba S.p.A. (support and privacy mailboxes): Italy.
In addition, some data are received by others, not on our behalf:
- Our accountant, who processes the invoice data as an independent controller, for bookkeeping and tax obligations: Italy;
- Our sales partners, who see an identification code for the people they invited and the data needed to calculate and check their fee, never the name, the email address or the game data (section 4): European Union.
Electronic invoices are transmitted to the Italian Revenue Agency as required by law.
For the US providers that participate in it, transfers take place on the basis of the adequacy decision for the EU-US Data Privacy Framework; in the other cases, and in any case towards Singapore and towards OpenAI, on the basis of the standard contractual clauses approved by the European Commission, a copy of which you can obtain by writing to us. We do not disclose your data to anyone other than those listed, unless required by law.
12. No automated decision-making
We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you. Statistics and analyses are tools that you use: they neither determine nor limit the service you receive.
The counters on how opponents play (section 5) are profiling within the meaning of Art. 4(4) GDPR, as we tell the players themselves in the Notice to players: they describe playing tendencies. No automated decision within the meaning of Art. 22 derives from them: their only use is in your own choices at the table.
13. Your rights
You have the right to object, at any time, to processing based on our legitimate interest — which this policy identifies as such case by case, currently in sections 4, 5, 6, 7 and 9 — on grounds relating to your particular situation. If you object, we will stop that processing unless there are compelling legitimate grounds that override your interests. To exercise it, just write to the address given below.
You also have the right to obtain access to your data and a copy of them, rectification, erasure, restriction of processing and portability of the data you provided to us in a machine-readable format.
You can download the copy yourself: in Settings → Privacy and data, the Export my data button produces a file with the data that our servers hold for your account, in a format readable by any program; it does not include the technical logs of sign-in sessions and of server activity, which you can request at the address given below. The button has a technical limit of one request per day; a written request to the address below is always possible.
You can withdraw your consent to automatic error reports at any time from Settings, without affecting the lawfulness of the reports already sent. You can delete the account directly from the App (My account → Delete account): the account is closed immediately and the data on our servers are erased after 30 days, with the exceptions given in section 4; the data on your computer remain at your disposal. To exercise the other rights, write to privacy@pokerimprove.com: we reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the EU country where you live, work or where the infringement took place (Art. 77 GDPR).
14. Security
We adopt technical and organisational measures appropriate to the risk: encryption of communications, isolation of data by account, encryption of data on the servers, encryption of the session credentials on your computer, clean-up of diagnostic data, signed and verified App updates, limited retention. No system is free of risk: in the event of a breach likely to result in a high risk to your rights, we will inform you without undue delay.
15. Changes
We will update this policy when the service changes. The date at the top indicates the latest version; material changes are communicated to you at your account's email address.