Privacy Policy

This Privacy Policy is published by KellyIQ LLC (“KellyIQ,” “we,” “us,” or “our”), a Massachusetts limited liability company located at 361 Newbury Street, 5th Floor, Boston, MA 02115. KellyIQ operates the KellyIQ platform, website at kellyiq.com, and all related tools, features, and services (collectively, the “Service”).

This Policy describes: (a) what personal information we collect and how we collect it; (b) the purposes for which we use that information; (c) the parties with whom we share it; (d) how long we keep it; (e) the security measures we apply; and (f) your rights and choices. It applies to all users of the Service, including visitors to our marketing site and registered account holders.

This Policy is incorporated by reference into our Terms of Service. Capitalized terms used but not defined in this Policy have the meanings given in our Terms of Service. In the event of a conflict between this Policy and our Terms of Service on a privacy matter, this Policy governs.

The Service is operated from and intended for users in the United States. We do not intentionally target or market the Service to individuals outside the United States. If you access the Service from outside the United States, you do so at your own risk, and your personal information will be transferred to and processed in the United States.

Account Information. When you register, we collect your email address and name. We use these to create and authenticate your account, communicate with you, and identify your subscription tier.

Payment Information. When you subscribe to a paid tier, your payment is processed directly by Stripe, Inc. Stripe collects your payment card details through its own interface. KellyIQ receives limited payment and subscription metadata from Stripe, such as subscription status, transaction identifiers, invoice details, and limited card information (such as card brand and last four digits). KellyIQ does not collect, receive, process, or store your full card number, CVV, or raw cardholder data.

Saved Scenarios and Associated Analytical Data. The Service allows you to voluntarily save your work. Saved data may include: bankroll amounts, odds, estimated win probabilities and edges, market identifiers, Kelly fraction allocations, and quantitative simulation summaries (including Monte Carlo, VaR, and CVaR outputs). This data is generated by you from your own inputs and stored only when you actively choose to save it. See Terms of Service §7.4. We do not generate, infer, or enrich this data from any external source.

Support and Communications. If you contact us by email or another channel, we retain records of that correspondence, including your email address and the content of your message.

We collect usage data about how you interact with the Service, including: number of optimization runs per session, features accessed, feature usage statistics, tier and subscription status, and other functional usage metrics. We use this data to enforce tier-based usage limits, improve the Service, and detect abuse.

When you access the Service, our infrastructure and third-party service providers automatically collect the following:

Technical Identifiers. IP address, browser type and version, operating system, device type, referring URL, and pages visited.

Session and Log Data. Timestamps of access, session duration, HTTP request logs, error logs, and standard server access logs. These are retained for security and diagnostic purposes.

Analytics Data. We use a third-party analytics provider to collect product usage data, including page view events and feature interactions. Analytics events are associated with your account only after you authenticate. Anonymous visitors are not intentionally identified or profiled. Analytics data is processed in the United States. See Section 6.3 and Section 9.5.

Cookies and Similar Technologies. The Service uses cookies and similar client-side storage mechanisms to maintain your authenticated session, remember preferences, and support our analytics provider. You can manage cookies through your browser settings. Disabling session cookies will prevent you from logging in. Disabling analytics cookies will stop analytics collection but will not affect the core functionality of the Service.

For clarity, KellyIQ does not collect:

• date of birth or age verification data;
• precise physical location (we receive only what is inferred from your IP address);
• sportsbook login credentials, account numbers, session tokens, or access keys;
• actual wager history, bet outcomes, or realized gambling profit or loss;
• financial account numbers, Social Security numbers, or government-issued identification;
• full payment card numbers, CVV codes, or billing addresses (Stripe handles these directly); or
• any data from third-party sportsbooks, betting exchanges, or gambling platforms.

We share personal information with the service providers listed in Section 6 solely to the extent necessary for them to perform services on our behalf. These providers are contractually prohibited from using your information for their own independent commercial purposes.

We review requests from law enforcement and government agencies to confirm they are legally valid before disclosing personal information. We may disclose personal information if required by law or in response to valid legal process, including subpoenas, court orders, search warrants, or regulatory demands. Where legally permitted and practicable, we will notify affected users before complying.

We may disclose information where we believe disclosure is necessary to: prevent fraud or abuse of the Service; protect the rights, property, or safety of KellyIQ, our users, or the public; or enforce our Terms of Service.

If KellyIQ is involved in a merger, acquisition, asset sale, or similar corporate transaction, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service at least 30 days before your personal information becomes subject to a materially different privacy policy, and you will have the right to delete your account before the transfer takes effect.

KellyIQ does not sell, rent, lease, or trade your personal information to any third party for any consideration.

We may use and share aggregate, anonymized, or de-identified data (such as overall platform usage statistics) that cannot reasonably be used to identify any individual. This data is not personal information and is not subject to this Policy.

AWS provides our cloud computing infrastructure, including database hosting, application hosting, storage, compute, logging, and related cloud services. All data stored on AWS under this Service is processed within the United States. AWS processes personal information only as directed by KellyIQ and pursuant to AWS’s Data Processing Addendum. AWS maintains SOC 2, ISO 27001, and other security certifications applicable to its infrastructure.

Stripe processes subscription payments. When you subscribe to a paid tier, your payment credentials are transmitted directly to and stored by Stripe. Stripe is a PCI DSS Level 1 certified payment processor. KellyIQ does not receive, store, or process your full card details. Payment processing is subject to Stripe’s own Privacy Policy, available at stripe.com/privacy.

We use PostHog to collect product usage data, including page view events and feature interactions. Analytics events are associated with your account only after you authenticate; anonymous visitors are not intentionally identified or profiled. Analytics data is processed in the United States and is not used for advertising or shared with third parties for their own purposes. PostHog’s privacy practices are available at posthog.com/privacy. You may opt out as described in Section 9.5.

We do not share personal information with advertising networks, data brokers, affiliate marketing platforms, or sportsbook operators. We do not use your data to serve you targeted advertising on the Service or on third-party platforms.

We retain personal information only as long as necessary to provide the Service, maintain our contractual relationship, comply with applicable legal obligations (including Massachusetts 201 CMR 17.00), and defend against legal claims.

Account information (email address, name): retained for the life of your account and deleted within 90 days of a confirmed account deletion request, subject to legal hold requirements.

Payment records: Stripe retains your payment credentials per its own schedule. KellyIQ retains transaction metadata (amount, date, subscription tier, Stripe customer ID) for seven (7) years to comply with financial recordkeeping obligations.

Saved scenarios and analytical data: retained for the life of your account. Individually deleted scenarios are removed from active storage promptly. Upon account deletion, all saved scenarios are deleted within 90 days, subject to backup cycle timing described in Section 7.3.

Server logs and technical data: retained for up to 30 days for security and diagnostic purposes, then deleted or anonymized.

Support correspondence: retained for up to 3 years following resolution, unless a longer period is required for dispute documentation.

Personal information deleted from active systems may persist in encrypted database backups for up to 7 additional days before the backup cycle overwrites it. We do not restore personal information from backup for any purpose other than disaster recovery, and deleted records are not restored except under legal compulsion.

KellyIQ maintains a written information security program designed to satisfy the requirements of Massachusetts 201 CMR 17.00 (“Standards for the Protection of Personal Information of Residents of the Commonwealth”). Our program addresses the following areas:

• Encryption of personal information in transit using industry-standard TLS.
• Encryption of personal information at rest in our database and storage systems.
• Access controls limiting access to personal information to personnel or systems with a demonstrated business need.
• Monitoring and logging of access to systems containing personal information.
• Vendor oversight requiring service providers who handle personal information on our behalf to maintain appropriate security measures.
• Incident response procedures for detecting, containing, and remediating security events.

No security system is impenetrable. Despite our reasonable safeguards, we cannot guarantee that unauthorized parties will never be able to defeat our security measures. You are also responsible for maintaining the confidentiality of your account credentials and for notifying us promptly at security@kellyiq.com if you become aware of any unauthorized access to your account. See Terms of Service §4.3.

In the event of a security breach that triggers notification obligations under Massachusetts law (M.G.L. c. 93H) or other applicable law, we will notify affected individuals and the Massachusetts Attorney General as required by law. We will provide notice by email to the address associated with your account as promptly as practicable under the circumstances.

You may access and update most of your account information — including your email address and display name — directly through your account settings. If you need assistance accessing or correcting information that is not editable through the interface, contact us at privacy@kellyiq.com.

You may request deletion of your account and associated personal information by using the account deletion feature in your account settings or by contacting privacy@kellyiq.com. Upon a confirmed deletion request, we will delete your personal information from active systems within 90 days, subject to the backup schedule in Section 7.3 and the following exceptions: we retain information that (a) we are legally required to keep, such as transaction records; (b) is necessary to complete pending transactions or resolve open disputes; or (c) is needed to enforce our agreements. Deletion of your account does not entitle you to a refund of fees already paid.

You may export your saved scenarios at any time through the export feature in your account. Exports are provided in a machine-readable format. Consistent with Terms of Service §13.4, you retain the right to use the outputs generated from your inputs.

Transactional emails — including account confirmations, subscription receipts, security alerts, and material policy change notices — are an essential part of the Service and cannot be opted out of while your account is active. These communications are required under our Terms of Service §17.6. If we send non-transactional promotional emails, each such email will include an unsubscribe mechanism and we will honor opt-out requests promptly.

You may limit analytics data collection by blocking analytics cookies through your browser settings or using a privacy-focused browser extension. Opting out of analytics does not affect your ability to use any feature of the Service.

Regardless of your location or residence, KellyIQ extends to all users the right to know what personal information we hold about you, the right to request access to or correction of that information, and the right to request deletion. To exercise any of these rights, contact us at privacy@kellyiq.com. We may need to verify your identity before fulfilling a request. We will respond to verified requests within a reasonable time and will not discriminate against you for exercising these rights.

KellyIQ is not subject to the California Consumer Privacy Act (CCPA) at its current scale and does not sell personal information. Nonetheless, as a matter of practice: we do not sell or share your personal information for cross-context behavioral advertising; we do not use sensitive personal information for purposes beyond providing the Service; and we will respond to access and deletion requests from California residents on the same basis as described above. Contact privacy@kellyiq.com to submit a request.