LEGAL
Data & Compliance
Last updated: 3 July 2026 · Applies to app.nullcorp.eu and every tool hosted under it
This page is a detailed operational companion to our Privacy Policy — it explains exactly how we handle GDPR and CCPA rights requests, how long each type of data is kept, and how to actually delete or export your data (not just what the policy promises).
1. GDPR
What we collect & why
Account credentials to provide the service (contract basis), IP addresses for abuse prevention (legitimate interest), and tool-specific data described per-tool in the Privacy Policy §4. Where a tool asks for extra consent (e.g. connecting a social media account in Overlay Maker), that processing is consent-based and can be withdrawn at any time by disconnecting it.
Legal basis
| Processing | Basis |
|---|---|
| Providing the account/service you signed up for | Contract (Art. 6(1)(b)) |
| Rate-limiting, abuse/security logs | Legitimate interest (Art. 6(1)(f)) |
| Connected social accounts, non-essential cookies | Consent (Art. 6(1)(a)) — withdrawable any time |
Your rights
- Access — request a copy of what we hold on you. See Section 5.
- Correct — most fields (username, password) are self-service in Account Settings; anything else, contact us.
- Delete — request account deletion. See Section 4.
- Export — request your data in a portable format. See Section 5.
- Restrict / object — contact us and tell us which processing you want restricted or object to.
- Withdraw consent — disconnect a connected social account any time, or change your cookie preferences from any page footer.
Contact for any GDPR request: contact@nullcorp.eu. We respond within 30 days as required by GDPR Art. 12(3).
2. CCPA
- Categories collected: identifiers (username, email), account credentials, and tool-specific data as described in the Privacy Policy.
- Purpose: providing the service you signed up for — never for advertising.
- Sale/sharing: we do not sell or share personal information with third parties for cross-context behavioral advertising. See third parties we use as processors.
- Consumer rights: the same access, deletion, and correction process below applies to any user, California resident or not.
3. Data retention
| Data type | Retention period | Status |
|---|---|---|
| Account data (username, email, password hash) | While account is active; 14-day deactivation grace period after a deletion request, then permanently deleted automatically | Fully automated (deactivation, reminder email, deletion sweep) |
| Session tokens | 30 days | Enforced automatically (expiry column, DB-checked on every request) |
| Email verify / reset tokens | 24 hours, single-use | Enforced automatically |
| Uploaded files (eSports game-asset images) | While in active use by the team; removed within 30 days of a deletion request | Manual, admin-processed |
| Connected social OAuth tokens (Overlay Maker) | Until disconnected | Enforced automatically on disconnect |
| Direct messages (eSports) | Until deleted by sender or removed on request | Sender-side delete is automatic; full removal is manual on request |
| Career stats — XP/currency/reputation/win-loss (Verdict¡) | While account is active | Fully automated — deleted as part of the account-deletion sweep |
| Match & event history (Verdict¡) | Indefinite | By design — see Privacy Policy §4. Only numeric ids are stored, so it stops identifying you once your account is gone rather than needing separate erasure |
| IP rate-limiting counter | 1 hour | Automated — purged on every login/registration attempt |
| Security/audit log (login/registration attempts) | 1 year | Automated — purged daily by the same maintenance job that runs account deletions |
| Backups | Target: 30 days rolling | Not yet automated — tracked as a technical follow-up |
| Analytics | N/A | No analytics currently collected |
4. Data deletion
To delete your account and its associated data:
- Open Account Settings (gear icon in the header) → Account Details.
- Under Privacy & Data, click Delete My Account and confirm by typing your username.
- Your account is deactivated and signed out on every device immediately, and you'll get an email confirming the date it will be permanently deleted.
- You have 14 days to change your mind — just log back in and click Cancel Deletion to fully restore your account. We also send a reminder email about 4 days before the deletion date if you haven't cancelled.
- If you don't cancel, your account and its data are automatically and permanently deleted on that date — no manual step required on our end.
You can also email contact@nullcorp.eu directly to request deletion of specific data (e.g. an eSports direct message, an uploaded game asset) without deleting your whole account.
5. Data access & export
To request a copy of your data:
- Open Account Settings → Account Details → Privacy & Data → Request My Data.
- Your export is generated immediately — you'll get a download link right away (both shown on screen and emailed to you), valid for 48 hours.
To request a correction to data we hold that you can't edit yourself in Account Settings (e.g. an incorrect entry in a team record), email contact@nullcorp.eu describing what needs to change — we aim to respond within 30 days, as required under GDPR.
6. AI-generated content
NULL Predictions' "AI Leaderboard" feature shows World Cup score predictions from several publicly available AI chatbots (ChatGPT, Claude, Gemini, Grok, Copilot, Perplexity). These are genuine answers we collected by asking each chatbot directly and manually recording what it said — this tool does not call any AI provider's API itself, and no NULL TOOLS user data is ever sent to any AI company through this feature.
These predictions can be wrong. AI chatbots regularly make factual mistakes, and a prediction shown here reflects what one of these systems said at one point in time — not a verified forecast, not professional or betting advice, and not something we guarantee the accuracy of. Treat the AI Leaderboard as entertainment alongside the rest of NULL Predictions, and verify anything important (like an actual match result) against an authoritative source rather than this feature.
7. Email communications
We only send transactional emails — messages triggered directly by an action you took, needed to operate your account or fulfil a request you made. We do not send newsletters, marketing emails, or promotional campaigns of any kind, and there is nowhere on NULL TOOLS to sign up for one.
The transactional emails we send:
- Account verification — sent once, when you register.
- Password reset — sent only when you request one.
- Username or email address changed — a confirmation link when you request an email change, sent to the new address, plus a notice to your old address once it's applied, and a notice whenever your username changes — so you have visibility even if a change wasn't made from a device you recognize.
- Account deletion — scheduled, reminder, cancelled, and completed notices tied to the deletion process described in Section 4.
- Data requests — your export download link, or confirmation that a correction request was received.
Because every one of these is necessary to run your account or fulfil something you specifically asked for, they don't require separate marketing consent under GDPR (Recital 47) and there's no unsubscribe link on them — there's nothing to opt out of without also opting out of the feature that sent it (e.g. you can't opt out of a password-reset email while still being able to reset your password by email). If we ever add a genuine marketing/newsletter feature in the future, it will be opt-in and carry its own unsubscribe option, and this section will be updated to reflect it.