Privacy Policy

1. Who we are

EdgeTrack Lab is a statistical analysis and integrity platform for casino table games, operated by EdgeTrack Lab. Contact: contact@edgetracklab.com.

2. Data we collect

• Account data: email address and password (managed by Supabase Auth), and optional display name
• Organisation sign-in records: for members of a casino organisation, when each person signed in to the organisation and when that sign-in ended, how it ended, who approved or denied it, the last time the app was in use during it, and the session lengths worked out from those times (see section 4)
• Operational data: game records, statistical results, analytical configurations, and related data you enter while using the platform
• Billing data: payment method and subscription details (held by Stripe — we never see raw card numbers)
• Technical data: server logs (IP address, request timestamps) retained for up to 30 days, plus application error events and performance timings for a sample of page views, sent to Sentry (see section 6)

3. Player and third-party data

EdgeTrack Lab allows you to record identifier codes for casino patrons (players) as part of your operational workflow. These codes are defined by you and typically correspond to your internal patron identification system.

• Player identifier codes are stored in our database as operational data
• Player name fields are optional — the platform is designed to function without personal names or other personally identifiable information
• If you choose to enter player names, you are responsible for ensuring you have the appropriate authority and legal basis to do so under your jurisdiction's privacy laws
• Certain features (such as PDF report export) may allow you to enter player names at the time of export that are included in the generated document but are not stored in our systems

We encourage you to use identifier codes rather than personal names wherever possible to minimise the personal data held on the platform.

4. Organisation and team data

Casino-tier accounts can create organisations and invite team members. When you join an organisation, your email address and display name are visible to other members of that organisation. Organisation owners can manage team membership, assign roles, and configure access permissions.

Sign-in and session history. Each sign-in to an organisation is recorded: sign-in and sign-out times, approval decisions and who made them, how the session ended, the last activity seen, and the resulting session length. The organisation's owner and supervisors can see this history for every member, including the owner, on the organisation's Activity page, where each member appears by display name or, if none is set, account email address. It is a record of signed-in access to EdgeTrack Lab, not of attendance or work.

These records are shown for 90 days. After that they are no longer displayed, and a daily clean-up deletes them, normally within a day. This applies to every organisation, including one that has stopped signing in. Our database backups expire on their own, separate schedule.

EdgeTrack support access. To help investigate access problems (for example, a member who cannot sign in), EdgeTrack Lab support can view an organisation's sign-in and session history, including members' account email addresses, and download it as a CSV file. This is on by default, and the organisation's owner can turn it off at any time under Team → Organisation Settings. While it is off, support cannot view or export that history. Your sign-ins are still recorded and your owner and supervisors still see them. A file support has already downloaded cannot be recalled by turning the setting off. Support views of this history are not added to the organisation's Activity log.

The support setting covers sign-in and session history only. It does not change EdgeTrack Lab's account administration (for example, resetting an organisation's two-factor authentication when asked). It also does not cover administrators' read-only view of an organisation's Integrity Evidence, which they can open to answer support questions.

5. How we use your data

• To provide and improve the EdgeTrack Lab service
• To process payments and manage your subscription
• To send transactional emails (account approval, billing receipts)
• To comply with legal obligations

We do not sell your data or use it for advertising.

6. Third-party processors

We share data only with the following sub-processors:

• Supabase — database and authentication hosting (Sydney region)
• Vercel — application hosting and edge network
• Cloudflare — DNS and network edge for our domain, and inbound email routing. Website and application traffic passes through Cloudflare's network in transit, and email sent to our published contact and privacy addresses is routed by Cloudflare to our mailbox.
• Stripe — payment processing
• Resend — transactional email delivery
• Anthropic — AI processing for the optional in-app help assistant (off by default for organisations; each user must acknowledge a notice before first use). Questions typed into the assistant are processed by Anthropic and may be processed outside Australia; no other platform data is shared with Anthropic.
• Sentry — application error monitoring, performance timings for a sample of about one page view in ten (how long a data-entry page took to become ready, and how long a baccarat hand took to save), and security-policy violation reporting. Error events and timings carry your user id, organisation id, the page path, your browser type and version, and its language and time-zone settings; player codes, names, search terms and analysis data are stripped before transmission. Events may be processed outside Australia.

The public website also emits browser security-policy violation reports to Sentry: if a page load violates our content-security policy, the visitor's browser sends a report containing its IP address and the page URL directly to Sentry. Application error events are relayed through our own domain rather than sent directly from your browser.

7. Data retention

Organisation sign-in and session records are shown for 90 days and then deleted by a daily clean-up (see section 4). Your account data is retained for as long as your account is active. If you request deletion of your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or tax purposes.

8. Your rights

You may request access to, correction of, or deletion of your personal data at any time by emailing privacy@edgetracklab.com. We will respond within 30 days.

9. Cookies

EdgeTrack Lab uses only essential session cookies required for authentication. We do not use tracking or advertising cookies.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you by email before material changes take effect.

11. Contact

Privacy questions: privacy@edgetracklab.com.