Privacy policy

Last updated: 22 October 2026.

Data controller

Clemente Juan Oliver. Contact: admin@exploitiv.com.

What data we process

• Identity: your email address and, if you log in with Google, your name and the identifier of your Google account.
• Content you send us: the hand histories, the HUD screenshots and the chat messages you upload to the tool.
• Other people’s data that travels inside that content: a hand history includes the screen names of the other players at the table, and a HUD screenshot includes their statistics. They are nicknames from the poker room, not real names, and we process them only to analyse the hand: we do not cross-reference them with other sources, we do not build profiles of those people and we do not publish them. If you are writing to us as one of those players, “Your rights” explains how to ask us to delete them.
• Usage: which tool you use, when, and what it costs to process, so that we can apply the limits of your plan.
• If you write to us from a public form (a demo for poker schools, the creator programme or a heads-up when a plan opens): whatever you fill in, so that we can reply. We do not use it for anything else.
• A trace of your connection, only when you ask for a password link or log in with an access code: we do not store your IP address but an encrypted, irreversible code worked out from it, which we use only to count how many attempts come from the same place and to stop bulk email being sent. It is not tied to your account, it does not let us identify or locate you, and it is deleted after 24 hours.

The public pages also count anonymous gestures —that somebody has pressed a button or sent a form— with no cookies and no identifiers: no IP, no browser, no number that follows you around. They are not personal data and they cannot be tied to you or to your account. It is explained in the cookie policy. Those counters have nothing to do with the connection trace in the point above, which is only worked out on the two sign-in screens named there and never while you browse.

What for, and on what legal basis

To give you the service you have asked for and apply the limits of your plan (performance of a contract), and to keep the service secure and spot abuse (legitimate interest).

Who we share it with

We work with providers that process data on our behalf. All of them operate in the United States, so there is an international transfer of data, covered by the safeguards each provider declares (Data Privacy Framework or standard contractual clauses):

• Vercel — hosting and running the site.
• Neon — database (AWS us-east-1, Northern Virginia).
• OpenRouter and the language model provider — they process the text of your hands and of your messages to produce the analysis.
• Resend — sending the access link by email.
• Google — logging in, if you pick that option.

How long we keep it

Your account and your email, for as long as the account is active. It is worth knowing that we also keep every analysis, with the hand history exactly as you sent it, tied to your account and with no automatic deletion date: it lets us track down bugs, measure how good the coach is and keep count of what we spend. We are working on deleting by age; in the meantime, you can ask us to remove your analyses whenever you like and we do it by hand. The chat conversations listed in the chat sidebar delete themselves after 90 days without use, and at most the 50 most recent are kept; you can also delete any of them from the chat itself. Deleting one removes it from that list: the copy of each message we keep for debugging follows the rule for analyses. The connection trace from the sign-in screens is the exception: it deletes itself after 24 hours.

Your rights

You can access your data, correct it, erase it, object to the processing, restrict it and ask for it to be ported, by writing to the address above. There is still no “delete my account” button on the site: we do it by hand when you write to us, and we confirm once it is done. You can also complain to the Agencia Española de Protección de Datos, the Spanish data protection authority (aepd.es).

This is a translation of the Spanish original. In the event of any discrepancy, the Spanish version prevails.