PredictArena.ioLast updated: June 8, 2026. Version 1.2.
This Privacy Policy describes how MindMetrics International S.R.L ("we", "us", "our") collects, uses, stores, shares, and protects your personal data when you use PredictArena at predictarena.io. We are committed to processing your personal data lawfully, transparently, and in a manner that respects your rights.
Please read this Policy carefully. By using the Platform, you acknowledge that you have read and understood this Policy. This Policy is incorporated into and forms part of our Terms & Conditions.
The data controller responsible for the processing of your personal data is:
MindMetrics International S.R.L
Incorporated under the laws of the Republic of Costa Rica
Privacy contact: privacy@predictarena.io
General support: support@predictarena.io
Response time: within 5 business days for privacy requests
As MindMetrics International S.R.L is incorporated in Costa Rica, your data is processed under Costa Rican law (Law No. 8968 -- Protection of Persons Against the Processing of Their Personal Data) as the primary framework for processing carried out under our incorporation. For data subjects located in the European Economic Area (EEA) or the United Kingdom, who may access the Platform under our declaration-gated access model, the EU General Data Protection Regulation (GDPR) and/or the UK GDPR apply to the processing of your personal data, and we comply with those frameworks as described in this document.
This Policy applies to all personal data we collect when you:
This Policy does not apply to third-party services you access via links from the Platform. Those services have their own privacy policies.
3.1 Account and Identity Data
3.2 Compliance and Declaration Data
3.3 Platform Activity Data
3.4 Financial Transaction Data
3.5 Technical and Device Data
3.6 KYC Data (where applicable)
For Users whose cumulative deposits exceed USD 9,990, identity verification is performed by a specialist third-party identity verification provider. That provider may process a government-issued identity document (passport, national ID), a live facial recognition check, and address verification. We receive only a verification outcome (verified / not verified). We do not store, process, or have access to your identity document images or biometric data. The verification provider processes this data under its own privacy policy and applicable data protection law.
3.7 Support Communications
3.8 Data We Do Not Collect
We process your personal data under the following legal bases. Where GDPR applies (as described in Section 1), these bases correspond to GDPR Article 6 legal bases:
Contract Performance (Art. 6(1)(b) GDPR equivalent)
Account creation and management; Agent operation and pool allocation execution; deposit crediting and withdrawal processing; settlement calculation and PA wallet balance crediting; subscription access enforcement; support provision.
Legal Obligation (Art. 6(1)(c) GDPR equivalent)
AML/KYC compliance and record-keeping (7-year retention); compliance declaration storage; suspicious transaction reporting; responses to lawful requests from regulatory authorities and law enforcement; identity verification for high-value depositors.
Legitimate Interests (Art. 6(1)(f) GDPR equivalent)
Platform security and fraud prevention; detection and investigation of prohibited conduct; abuse prevention; geographic restriction enforcement; system integrity and performance monitoring; improvements to Agent models and Platform features based on aggregated usage data. Our legitimate interests are proportionate and do not override your fundamental data protection rights.
Consent (Art. 6(1)(a) GDPR equivalent)
Marketing or promotional communications, if you opt in. You may withdraw consent at any time by emailing privacy@predictarena.io or using the unsubscribe link in any marketing email. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.
We do not:
We do not sell, rent, or trade your personal data. We share limited personal data only in the following circumstances:
We do not share your data with advertisers, data brokers, sponsors, or any party for their own marketing purposes.
Your personal data may be transferred to and processed in countries outside your country of residence, including the United States and the European Union, by the service providers we engage to operate the Platform. We ensure that all such transfers are subject to appropriate safeguards, including:
Data subjects located in the European Economic Area and the United Kingdom may access the Platform under our declaration-gated access model. Accordingly, the EU GDPR and the UK GDPR apply to the processing of their personal data, and we comply with these frameworks — including by providing the data-subject rights described in this Policy and by applying appropriate safeguards to international transfers (such as Standard Contractual Clauses where applicable). Costa Rican law (Law No. 8968) remains the primary framework for processing carried out under our incorporation.
For any questions about international transfers or to request details of applicable safeguards, contact privacy@predictarena.io.
We retain personal data only for as long as necessary for the purposes for which it was collected, or as required by applicable law.
Account and identity data
Retention: Duration of account + 2 years after closure
Basis: Contract performance, legitimate interests
Compliance declarations (Layer 5)
Retention: 7 years from date of declaration
Basis: Legal obligation (AML record-keeping)
Pool allocation records
Retention: 5 years from settlement date
Basis: Financial record-keeping, legal obligation
Financial transaction data (deposits/withdrawals)
Retention: 5 years from transaction date
Basis: Financial record-keeping, legal obligation
KYC verification status
Retention: 5 years from end of business relationship
Basis: Legal obligation (AML)
Support communications
Retention: 3 years from resolution
Basis: Legitimate interests
Server and access logs
Retention: 90 days
Basis: Security, fraud prevention
Transaction references
Retention: 7 years
Basis: Financial record-keeping
Anonymised analytics data
Retention: Indefinitely (non-identifiable)
Basis: Platform improvement
When data is no longer required, it is securely deleted or permanently anonymised. Deletion requests are subject to mandatory retention requirements, which override deletion requests for data subject to legal hold obligations.
You have the following rights regarding your personal data. We will respond to all requests within 30 days. Complex requests may take up to 90 days, in which case we will notify you within 30 days of receipt. We may verify your identity before processing your request.
Right of Access (Subject Access Request)
Request a copy of all personal data we hold about you, including the purposes of processing and recipients of sharing.
Right to Rectification
Request correction of inaccurate or incomplete personal data.
Right to Erasure ("Right to be Forgotten")
Request deletion of your personal data. Note: this right is subject to legal retention obligations. Data held under AML/KYC legal requirements (declarations, transaction records) cannot be deleted until the mandatory retention period expires.
Right to Restriction of Processing
Request that we restrict processing of your data in certain circumstances (e.g. while accuracy is disputed, or where processing is unlawful and you prefer restriction to deletion).
Right to Data Portability
Request your personal data in a structured, commonly used, machine-readable format (JSON or CSV) for transfer to another controller, where processing is based on consent or contract.
Right to Object
Object to processing based on legitimate interests. We will cease processing unless we have compelling legitimate grounds that override your interests, or the processing is for legal claims.
Right to Withdraw Consent
Where processing is based on consent, withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Right to Lodge a Complaint
Lodge a complaint with your local data protection supervisory authority. For Costa Rica, this is PRODHAB (Agencia de Proteccion de Datos de los Habitantes). For reference only: EEA residents may approach their national DPA; UK residents may approach the ICO (ico.org.uk).
To exercise any of these rights, contact privacy@predictarena.io with the subject line "Data Rights Request -- [Right Type]" and your registered email address.
The Platform uses automated rules-based Agent systems to make Pool allocation decisions on behalf of users. These are algorithmic decisions based on pre-defined scoring formulas. They do not constitute automated decision-making with legal or similarly significant effects on individuals (within the meaning of GDPR Article 22), as the User retains full control over Agent selection, funding levels, and deactivation at all times. No Agent decision affects the User's legal rights, employment, credit, insurance, healthcare, or similar status.
Geographic access restrictions are enforced automatically based on IP-derived country data. This is a compliance measure, not a profiling decision. Users who believe their access has been incorrectly restricted may contact support@predictarena.io for manual review.
KYC verification thresholds are triggered automatically by cumulative deposit totals. This triggers a process conducted by a specialist third-party provider -- it does not itself make a decision about your eligibility. The KYC outcome from the specialist provider determines whether you may continue depositing.
We do not use your personal data for behavioural profiling, credit scoring, insurance assessment, employment screening, or any other high-stakes automated decision-making.
The Platform operates on the Base blockchain, a public decentralised ledger. Certain data related to your Platform activity is inherently public:
Blockchain transactions are immutable and permanent. We cannot delete or modify on-chain data. Your deposit wallet address, while public on-chain, is not linked to your name or identity in any publicly available Platform data. The Platform does not publish any mapping of wallet addresses to user identities.
If you are concerned about blockchain privacy, consider using a fresh wallet address for Platform deposits that is not publicly associated with your identity elsewhere.
We use strictly necessary cookies and browser storage only. No non-essential, tracking, advertising, analytics, or third-party cookies are used.
Authentication session cookie
Type: httpOnly, Secure, SameSite=Strict
Purpose: Maintains your authenticated session. Required for account access.
Expiry: Session end or 7 days (whichever is sooner)
Strictly necessary -- cannot be disabled
Admin session cookie
Type: httpOnly, Secure
Purpose: Used only for platform administrator access. Not set for regular users.
Expiry: 24 hours
Strictly necessary -- cannot be disabled
We do not use Google Analytics, Meta Pixel, Hotjar, Mixpanel, or any other client-side analytics or tracking tool. No cookie consent banner is shown because we use only strictly necessary cookies, which are exempt from consent requirements under ePrivacy Directive Article 5(3) and equivalent national legislation.
The Platform may use browser localStorage or sessionStorage to temporarily store UI state (e.g. agent setup progress). This data is local to your browser, not transmitted to our servers, and cleared when you clear your browser data.
We implement the following technical and organisational security measures to protect your personal data:
Technical measures
Organisational measures
Despite these measures, no system is completely immune to security risks. In the event of a personal data breach that poses a risk to your rights and freedoms, we will: notify relevant supervisory authorities within 72 hours of becoming aware (where required by applicable law); notify affected Users without undue delay where the breach is likely to result in a high risk to their rights; provide details of the breach, its likely consequences, and the measures taken or proposed.
PredictArena is not directed at or intended for use by individuals under the age of 18. We do not knowingly collect personal data from anyone under 18. Age confirmation is a mandatory eligibility declaration at registration.
If we become aware that we have inadvertently collected personal data from an individual under 18, we will delete that Account and all associated personal data promptly. If you are a parent or guardian and believe a minor has registered on the Platform, please contact privacy@predictarena.io immediately.
We send transactional communications as part of Platform operation (settlement notifications, withdrawal confirmations, trial expiry reminders). These are not marketing communications and are not subject to marketing opt-out.
If we introduce marketing or promotional communications in future (tournament updates, new feature announcements), we will request your explicit consent before sending them. You may withdraw consent at any time by using the unsubscribe link in any marketing email or by emailing privacy@predictarena.io.
We will never sell your email address or personal data to any third party for marketing purposes.
We may update this Privacy Policy from time to time to reflect changes in our data processing practices, Platform features, or applicable law. The current version will always be available at predictarena.io/privacy with the version number and date of last update.
For material changes (changes that affect your rights or how we use your data), we will provide at least 7 days' advance notice via email and in-platform notification. For non-material changes (clarifications, third-party additions), we will update the Policy with an updated date.
Continued use of the Platform after the effective date of any update constitutes your acceptance of the updated Policy. If you do not agree to a material change, you should cease using the Platform and may request deletion of your data subject to applicable retention obligations.
For all privacy-related enquiries, data rights requests, or complaints:
privacy@predictarena.io
Subject line format: "Privacy -- [Request Type]" e.g. "Privacy -- Subject Access Request"
If you are not satisfied with our response to your privacy concern, you have the right to lodge a complaint with the relevant data protection supervisory authority: