GDPR

Controller: JSB Holdings LLC, a Delaware limited liability company ("JSB Holdings", "we", "us"). We operate the Live Tennis API at livetennisapi.com and its subdomains (the "Service"). This page is the GDPR companion to our Privacy Policy: the same processing, described in the terms the GDPR uses. What we hold, on what lawful basis, for how long, and how to exercise your rights. If the two ever disagree, tell us and we will fix it.

1. Who we are

JSB Holdings LLC is the controller for personal data processed through the Service. That includes the developer portal, the documentation, the API itself and the affiliate portal. We are a small operation: privacy requests are read and actioned by the operator, at hello@livetennisapi.com. We have not appointed a Data Protection Officer, and we do not publish a postal address or phone number. Email is the channel we answer.

2. What we actually hold

This is the concrete list, not a catch-all. If something is not here, we do not store it.

• Your account: your email address, and either a hash of your password or the identifier of the Google or GitHub account you sign in with. Also whether the address is verified, your plan tier, and the account status and its dates.
• Your API key: a label, the first characters of the key, an HMAC digest of it, and an encrypted copy of the full key. We hold no plaintext key. The encrypted copy can only be read with a secret kept outside the database. That is how you can view your own API key again from your account. It is also why a database leak on its own would still expose no usable credential. Keys issued on the free tier carry the email address you signed up with in the key's label.
• How much you call the API: one row per API key per day. Each row holds the date, the tier, the number of calls and the number of errors. There is no per-request log of what you queried.
• Billing: your Stripe customer and subscription identifiers, and the invoice history Stripe keeps for us. Card details go straight to Stripe. We never see or store a card number.
• Break-point Alerts, if you use them: the delivery endpoints you add, whether each is verified, and your alert filters. An endpoint is a Telegram chat, a Discord webhook, an email address, or a phone number for SMS/WhatsApp.
• Webhooks, if you register them: the URL you gave us and the secret that signs deliveries to it.
• Affiliates: name, login email, payout email and method, which tax form is on file (the form itself is collected by Stripe, not by us). Also your Stripe Connect account identifier, your referral code, your commission and payout ledger, and, if you enable two-factor authentication, your TOTP secret. Fraud checks store a hash of the IP address you signed up from, never the address. A click on your referral link records the same hashed form plus the browser's user-agent string.
• Attribution: if you arrive with a referral or advertising parameter (?via=, gclid, utm_* and similar), it goes into a first-party cookie for 30 days. That way a resulting subscription is credited to the right affiliate or campaign. If you arrive from another website without such a parameter, the same cookie records only that website's host name and the page you landed on. It never holds the full referring address. The purpose is the same.
• Site analytics and session replays: as described in Privacy Policy §2. That is pages viewed, approximate location, device and browser, and (outside the EU/EEA) masked session replays and heatmaps.
• Support: the messages you send us and our replies.
• Affiliate outreach: if we consider inviting you to the affiliate programme, we hold the public contact detail we found and where we found it. We also keep our own scoring notes. The detail is an email address, a handle, or a profile URL. Anyone who opts out is recorded on a do-not-contact list so we do not reach out again.

We do not collect special-category data (health, biometrics, religious or political views, and the rest of Article 9). We do not store card numbers or plaintext API keys, and we do not store raw IP addresses in the affiliate tables.

3. Our lawful bases

• Performance of a contract (Art. 6(1)(b)): creating your account, issuing and authenticating your API key, enforcing your plan's limits and taking payment. Also delivering the alerts you configured and answering your support requests.
• Legal obligation (Art. 6(1)(c)): keeping invoice, accounting and tax records, including the records behind affiliate payouts.
• Legitimate interests (Art. 6(1)(f)): keeping the Service running and un-abused (rate limiting, fraud checks, security), metering usage, and measuring our own marketing in aggregate. Also contacting creators about the affiliate programme, and emailing our own registered users about the Service they signed up for. That email covers what has changed and what their own recorded usage suggests they may need. That last one rests on a narrow balance we have set deliberately. The address is the one you gave us to hold this account. The content is about this Service and nothing else. The signal is your own usage, never a profile we have built or bought. And every such message carries a one-click unsubscribe that we honour permanently. We keep the intrusion proportionate deliberately. Hashed IPs instead of raw ones, a daily usage rollup instead of a request log, and cookieless measurement for EU/EEA visitors. You can object at any time (§4), and an objection to direct marketing is absolute.

We do not ask EU/EEA visitors for analytics or advertising consent, because we do not set analytics or advertising cookies for them (see §5).

4. Your rights

• Access (Art. 15): a copy of the personal data we hold about you.
• Rectification (Art. 16): correction of anything wrong, such as a mistyped payout email.
• Erasure (Art. 17): deletion of your account and its data. We keep what the law requires us to keep (invoice and tax records). We also keep a minimal do-not-contact entry so that an opt-out is not undone by a later import.
• Restriction (Art. 18): pausing processing while an inaccuracy or objection is worked out.
• Portability (Art. 20): your account details, API key metadata, usage rollups and affiliate ledger in a machine-readable file.
• Objection (Art. 21): to processing we base on legitimate interests, including affiliate outreach. An objection to direct marketing is absolute: we stop, without asking why.
• Withdraw consent (Art. 7(3)): where we relied on consent, withdrawal is as easy as giving it and applies from that point forward.
• Complain (Art. 77): to the supervisory authority where you live or work. We would rather you came to us first, but that is your right, not our permission.

Automated decisions. We make no decision about you by automated means alone that produces legal or similarly significant effects. Automated checks can place an affiliate account on hold, but a person reviews it before anything is refused. You can ask us to explain a hold.

6. How to exercise them

Email hello@livetennisapi.com from the address on your account and say what you want. If we cannot tell that the request is yours, we will ask you to confirm control of the account email. We ask for no more identification than that. We answer within one month, and tell you if a complex request needs the extension Article 12(3) allows. It is free unless a request is manifestly unfounded or excessive.

There is no self-service delete button in the portal today: deletion is done by hand when you ask, and we confirm when it is finished.

7. Cookies

Cookies we set ourselves: the session cookie that keeps you signed in to the portal, and the 30-day first-party attribution cookie described in §2. Also the lt_vid first-party visitor-measurement cookie: a random identifier, 13-month lifetime, used only for our own audience measurement and never shared with third parties. Outside the EU/EEA, third-party analytics and advertising cookies are also set (Google Analytics 4, Microsoft Clarity, Google Ads). EU/EEA visitors never receive those. The tool-by-tool detail is in Privacy Policy §4 and §5.

8. Processors

We share the minimum necessary with providers who process on our instructions. Stripe handles payments, subscriptions, affiliate payouts and their tax forms. For payments it processes on our instructions. For affiliate payouts through Stripe Connect, and for its own fraud, anti-money-laundering and identity checks, Stripe is an independent controller under its own privacy policy. Cloudflare provides content delivery, security, cookieless web analytics and tag loading. Google runs Analytics 4 and Google Ads, and Microsoft runs Clarity session replays and heatmaps. PostHog runs cookieless product analytics, served first-party through our own domain. Resend sends transactional and alert email. Twilio sends SMS and WhatsApp alerts, only if you add such a channel. The last is our hosting provider. If you choose a Telegram or Discord alert channel, delivery goes through those platforms under their own terms.

9. International transfers

We and most of these providers operate in the United States. Transfers there of personal data of people in the EU/EEA or the UK rely on the safeguards in each provider's data-processing terms. Chiefly that is the European Commission's standard contractual clauses.

10. Retention

• Account, API key and usage rollups: for as long as the account exists. Then deleted or anonymized once any legal, accounting or security need has passed.
• The checkout API key reveal: the plaintext API key shown on the checkout confirmation page lives in a buffer for seconds to minutes. It is deleted the moment it is displayed. The encrypted copy that lets you view the API key again from your account lasts as long as the key, and is destroyed with it.
• Billing, commission and payout records: kept for the period tax and accounting law requires.
• Support email: for as long as it is useful to the thread it belongs to.
• Analytics: per each provider's standard retention window.

11. Children

The Service is a developer product, not directed to children, and we do not knowingly collect personal data from anyone under 16.

12. Changes

We may update this page. Material changes are reflected in the date below and, where it matters, by notice to subscribers.

12. Contact

Data-protection questions and rights requests: hello@livetennisapi.com (JSB Holdings LLC). See also our Privacy Policy and California privacy notice.

Last updated: 25 July 2026.