California Privacy Notice

Business: JSB Holdings LLC, a Delaware limited liability company ("JSB Holdings", "we", "us"), operator of the Live Tennis API at livetennisapi.com (the "Service"). This notice is for California residents under the California Consumer Privacy Act as amended by the CPRA. It is the California companion to our Privacy Policy, and it says plainly where we do and do not have a clean answer.

1. Categories of personal information we collect

Using the CCPA's own category names, over the last 12 months we have collected:

• Identifiers: your email address, and the identifier of your Google or GitHub account if you sign in that way. Account, API-key and Stripe customer/subscription identifiers. For affiliates, a name and a payout email. Cookie and device identifiers set by our analytics and advertising tags. Affiliate fraud checks and referral-click records store a hashed IP address, not the address itself.
• Customer records (Cal. Civ. Code §1798.80(e)): payment and payout details, held by Stripe. We keep the identifiers that point at them, and which tax form an affiliate has on file.
• Commercial information: the plan you bought, your subscription history, and the affiliate commission ledger. Also how many API calls and errors your API key made each day.
• Internet or other electronic network activity: pages viewed, referrer, device and browser, and the browser's user-agent string on a referral click. Also session replays and heatmaps (Microsoft Clarity, as described in Privacy Policy §2).
• Geolocation data: approximate, country- or region-level location inferred from your IP address by our CDN and analytics. We do not collect precise geolocation.
• Sensitive personal information: one item only, your account log-in credentials (your email address together with a hashed password, or your linked Google/GitHub identifier). We use them to authenticate you and for nothing else, which is a purpose §1798.121 permits without a further opt-out. We do not collect Social Security or government-ID numbers, precise geolocation, or biometric or health data. Nor racial or ethnic origin, religious beliefs, union membership, or the contents of your mail or messages.

We do not collect professional or employment information, education records, or biometric information, and we do not generate our own inferences or profiles about you.

2. Where it comes from

• From you: when you create an account, subscribe, configure alerts, join the affiliate programme, or email us.
• Automatically from your device: through our own site analytics, the CDN, and (outside the EU/EEA) the analytics and advertising tags described in §5.
• From our service providers: chiefly Stripe, for the billing and payout events that keep your subscription in step.
• From public sources: only for affiliate recruitment, the public contact detail of a creator we consider inviting.

3. Why we use it

We use it to provide, secure, meter and bill the Service, to deliver the alerts you asked for, and to prevent abuse and fraud. We also use it to answer support, and to pay affiliates and meet the tax obligations that come with it. And to measure our own marketing and to comply with law. We do not use your personal information to train models about you, and we do not build cross-site profiles of our own.

4. Who we disclose it to

To service providers and contractors who process it for us under contract. Stripe handles payments and payouts. It processes payment data on our behalf, and is an independent controller of the data it needs for its own fraud, anti-money-laundering and identity checks, under its own privacy policy. Cloudflare provides delivery, security and cookieless analytics. Google runs Analytics 4 and Google Ads, Microsoft runs Clarity, and PostHog runs cookieless product analytics. Resend sends email, and Twilio sends SMS and WhatsApp alerts if you add such a channel. The last is our hosting provider. We also disclose personal information where the law requires it.

6. Selling and sharing: the honest answer

We do not sell personal information. No one pays us for your data and we run no data-broker arrangement.

We do, however, "share" it as the CPRA defines that word. For visitors outside the EU/EEA (which includes California), our pages load Google Ads conversion and remarketing tags and Microsoft Clarity. Passing identifiers and browsing activity to Google so that it can build remarketing audiences is cross-context behavioural advertising. The honest label for it is sharing, not an exemption. So: we share identifiers and internet or other electronic network activity with Google (and Microsoft, for Clarity) for advertising and measurement. We do not share your account credentials, your billing details, your API usage, your alert endpoints, or anything else in §1.

We do not knowingly collect, sell or share the personal information of consumers under 16.

7. Your California rights

• Right to know: the categories and specific pieces of personal information we hold about you. Also where we got them, why we have them, and who we disclosed them to.
• Right to delete: deletion of what we hold, except what an exception in §1798.105(d) lets us keep. Chiefly that is billing and tax records, and security records.
• Right to correct: correction of inaccurate personal information.
• Right to opt out of sharing: see §7 for what that means here in practice.
• Right to limit the use of sensitive personal information: the only sensitive information we hold is your log-in credential, used solely to sign you in. So there is no additional use to limit. Ask anyway if you want that confirmed in writing.
• Right to non-discrimination: exercising any of these changes nothing about your price, your plan, your rate limits or the support you get. Nothing in our systems treats a request as a signal.
• Authorized agents: you may use one. We will ask for written permission signed by you, and may still ask you to confirm the request directly.

8. How to exercise them, and what an opt-out really does

Email hello@livetennisapi.com with "California privacy request" in the subject and tell us which right you are exercising. We verify by matching the request to the email on the account, or by sending a confirmation email to it. For a right-to-know request about specific pieces of information we may ask you to confirm a detail only the account holder would know. We acknowledge within 10 business days and respond within 45 days, extendable once by a further 45 with notice. There is no charge, and you may make a free right-to-know request twice in any 12-month period.

On an opt-out request we stop using your information for advertising. That includes sending any conversion tied to your subscription to Google Ads. We confirm when it is done. Be aware of what we cannot do from our side. The advertising and analytics tags run in your browser, and we do not currently detect a Global Privacy Control signal. So we will not pretend that an email switches them off in your browser. To stop the tags themselves, block third-party and advertising cookies for this site. Or use Google's own My Ad Center controls, or Microsoft's privacy controls for Clarity. We say this plainly instead of claiming an opt-out mechanism we have not built.

9. How long we keep it

Account, API-key and daily usage records last as long as the account. Then they are deleted or anonymized once any legal, accounting or security need has passed. Billing, commission and payout records are kept for the period tax law requires. The plaintext API key shown on the checkout confirmation page is deleted the moment it is displayed. The encrypted copy that lets you view your API key again from your account is destroyed with the key. Analytics data follows each provider's standard retention window. Support email is kept while the thread is useful.

10. Contact

California privacy requests and questions: hello@livetennisapi.com (JSB Holdings LLC). See also our Privacy Policy and our GDPR notice.

Last updated: 25 July 2026.