Legal & Compliance Hub

Terms of Service

The terms under which business customers access the oddsfeed real-time data feed and its delivery channels.

1. Scope and agreement

These Terms of Service (the “Terms”) govern access to and use of the oddsfeed data feed, including the REST API, the WebSocket stream, webhooks, the embeddable widget and the customer console (together, the “Service”), by business customers (each, a “Customer”).

Where a Customer has signed an order form or master services agreement with oddsfeed, that document prevails over these Terms to the extent of any conflict.

2. Accounts and API credentials

• API keys and console accounts are issued to the Customer for its own use. They are confidential and may not be shared with, transferred to or resold to third parties.
• API credentials remain the property of oddsfeed and are licensed to the Customer for the duration of its subscription. oddsfeed may rotate or revoke credentials that are compromised or used in breach of these Terms.
• oddsfeed stores only a one-way hash of each API key and cannot recover a lost key; a new key is issued instead.
• The Customer is responsible for all activity under its credentials, for keeping them secure and for restricting them (for example with an IP allow list) where appropriate.

3. Licence to the data

Subject to payment of the applicable fees, oddsfeed grants the Customer a limited, non-exclusive, non-transferable licence to use the data delivered through the Service within the entitlements of its plan (sources, sports, markets, delivery delay, connections and request quotas) for the duration of its subscription.

Redistributing the raw feed, or offering it as a competing data service, is not permitted unless agreed in writing.

Prices originate from third-party bookmakers and exchanges. oddsfeed normalizes and delivers them but does not guarantee their accuracy or availability at source. The data is not betting or financial advice.

4. Service availability (SLA)

oddsfeed commits to a monthly availability of 99.9% for the delivery endpoints of the Service (the REST API and the WebSocket stream), measured as the share of minutes in a calendar month in which those endpoints accept and answer authenticated requests.

The commitment excludes scheduled maintenance announced in advance, events beyond oddsfeed’s reasonable control, and the availability of individual upstream sources, which oddsfeed does not operate. Service credits or other remedies, if any, are set out in the Customer’s order form.

5. Fees and payment

Fees follow the Customer’s plan and are invoiced in advance for the billing period. Payment is made by the methods offered in the console. Access may be suspended for invoices that remain unpaid after their due date and notice to the Customer.

6. Customer obligations

The Customer is solely responsible for ensuring that its use of the data, and any product it builds on it, complies with the laws and licensing requirements of every jurisdiction in which it operates, including gambling regulation, age restrictions and consumer protection rules.

7. Hosted sites, player accounts and custom code

Where the Customer publishes a ready-made site through the Service (on an oddsfeed address or its own domain), the Customer is the operator of that site and of every betting, casino and payment activity on it. The Customer alone is responsible for the required gambling licences, for know-your-customer, anti-money-laundering, age-verification and responsible-gambling obligations, for its terms and privacy notices towards its players, and for players’ balances, deposits, withdrawals and the settlement of their bets. oddsfeed provides the software and does not hold, transmit or guarantee players’ funds.

Results used to settle bets automatically are taken from third-party sources and may be delayed, incomplete or wrong. The Customer must review the results queue and settle or void bets that cannot be settled automatically, and remains responsible towards its players for every settlement.

The Customer may add its own CSS, JavaScript and permitted external script origins (“Custom Code”) to its site. Custom Code runs only on the Customer’s own site, inside its players’ browsers, with the same access as the site itself: it can change anything on the Customer’s pages and read or alter what the Customer’s players see and enter there. The Customer is solely responsible for its Custom Code and for every third-party script it permits, including its security, its effect on the site and its players, and its compliance with applicable law (in particular data protection and cookie-consent rules for analytics, chat or advertising tools).

• Custom Code must not contain malware, cryptocurrency mining, phishing or deceptive content, must not collect players’ credentials or payment details outside the Customer’s lawful processing, and must not attempt to access, probe or interfere with oddsfeed’s systems, other customers’ sites or the Service’s security controls.
• oddsfeed does not review Custom Code before publication and is not liable for any loss, data breach or malfunction caused by it. oddsfeed may disable Custom Code, or suspend the site, without prior notice where it reasonably believes the code is harmful, unlawful or breaches these Terms or the Acceptable Use Policy.
• The site can always be opened without Custom Code by adding ?safe=1 to its address, so that the Customer can correct faulty code.
• Features shown as locked in the console (for example a custom loading animation) are not part of the Customer’s plan until oddsfeed enables them for the Customer.

8. Limitation of liability

To the maximum extent permitted by law, oddsfeed is not liable for indirect, incidental, special or consequential damages, or for loss of profits, revenue, data or goodwill, arising out of or related to the Service.

oddsfeed’s aggregate liability for all claims relating to the Service is limited to the fees paid by the Customer in the twelve (12) months preceding the event giving rise to the claim. Nothing in these Terms limits liability that cannot be limited under applicable law.

9. Suspension and termination

oddsfeed may suspend or terminate access, with notice where practicable, for material breach of these Terms or of the Acceptable Use Policy, for non-payment, or where required by law. The Customer may terminate at the end of any billing period.

10. Changes and governing law

oddsfeed may update these Terms; material changes are announced in advance through the console or by e-mail. Continued use after the effective date constitutes acceptance.

These Terms are governed by the law and subject to the venue stated in the Customer’s order form. Questions about these Terms may be sent to the legal contact below.

Privacy & Data Security Policy

What data oddsfeed processes, why, how it is protected, and the rights of the people it concerns.

1. Roles

oddsfeed acts as data controller for the account, billing and security data described below. Where a Customer uses the Service to process data about its own users, the Customer is responsible for that processing.

2. Data we process

• Account and contact data: company name, contact names, e-mail addresses and console user names.
• Credentials: argon2id password hashes and SHA-256 hashes of API keys and session tokens — never the secrets themselves.
• Tenant configuration (tenant_configs): domains, branding, layout, product settings and margins, together with uploaded media such as logos and banners.
• Billing records: invoices, plan and period, payment amounts, receiving wallet addresses and transaction references.
• Usage and security data: request counts per minute, stream connections, IP addresses, and an audit trail of configuration changes recording who made each change and from which IP address.

3. Purposes and legal bases

Data is processed to provide and bill the Service (performance of a contract), to secure it and prevent abuse (legitimate interest), and to keep records required by tax and commercial law (legal obligation) — within the meaning of Article 5 of KVKK and Article 6 of the GDPR.

4. How data is protected

• Transport: all traffic is served over HTTPS (TLS) with HTTP Strict Transport Security.
• Passwords: hashed with argon2id using OWASP-recommended parameters.
• API keys and session tokens: stored only as SHA-256 hashes, so a database disclosure does not reveal usable credentials. Browsers open the live stream with single-use tickets, so API keys never appear in URLs or access logs.
• Administration: the admin console requires two-factor authentication (TOTP), is served on a non-public path and can be restricted to an IP allow list.
• Isolation: each tenant’s configuration, assets and margins are accessible only with that tenant’s own credentials; configuration changes are recorded in an audit trail.
• Application hardening: a strict Content Security Policy that allows no inline or third-party scripts and styles; services run with minimal privileges and the processing engine is not reachable from the internet.

5. Cookies and browser storage

The console uses one strictly necessary cookie, __Host-oddsfeed_session, set with the HttpOnly, Secure and SameSite=Strict attributes; it holds an opaque session token and expires at sign-out or when the session lifetime ends (12 hours by default). oddsfeed uses no advertising or analytics cookies and loads no third-party trackers.

The browser’s local storage keeps interface preferences (language, collapsed menu). The customer console keeps an entered API key in session storage for the current tab only.

6. Retention

Account and configuration data is kept for as long as the account is active. Billing records are kept for the period required by tax and commercial law. Security and usage logs are kept for a limited period proportionate to their purpose and then deleted or anonymized.

7. Sharing and international transfers

Data is shared only with service providers that host or operate the Service on oddsfeed’s behalf, under confidentiality and data processing obligations, or where required by law. Where data is transferred outside Türkiye or the European Economic Area, the safeguards required by KVKK and the GDPR are applied.

8. Your rights

Data subjects may request access to, rectification or erasure of their personal data, restriction of or objection to processing, and data portability, as provided by Article 11 of KVKK and Articles 15–22 of the GDPR, and may lodge a complaint with the competent supervisory authority. Requests may be sent to the legal contact below.

9. Compliance statement

oddsfeed processes personal data in accordance with the Turkish Personal Data Protection Law No. 6698 (KVKK) and Regulation (EU) 2016/679 (GDPR). This policy is reviewed whenever the Service’s processing changes.

Acceptable Use Policy

The rules that keep the shared delivery infrastructure fast, fair and secure for every tenant.

1. Quotas and fair use

• Each plan sets a request quota (requests_per_minute) and a number of concurrent stream connections. Requests above the quota are rejected with HTTP 429 and a Retry-After header; clients must honour it.
• Quotas may not be circumvented, for example by spreading traffic across several keys or accounts, or by sharing credentials.
• For continuous data, use the WebSocket stream or webhooks rather than high-frequency polling.

2. Prohibited activities

• Sharing, selling or publishing API keys, stream tickets or console access.
• Redistributing the raw feed beyond the entitlements of your plan.
• Attempting to access another tenant’s data, configuration or assets, or the admin console.
• Probing, scanning or load-testing the Service without written consent; reverse engineering it, except where the law expressly permits.
• Attempting to discover, use or interfere with oddsfeed’s upstream network infrastructure, including its proxy pool and collection endpoints.
• Uploading malicious, unlawful or infringing content as tenant assets or configuration, or using the widget on domains you are not authorized to operate.
• Publishing custom code on a hosted site that is malicious, deceptive or unlawful, that mines cryptocurrency, harvests players’ credentials or payment details, or that targets oddsfeed’s systems or other customers’ sites.

3. Security research

Good-faith security research is welcome when it respects other tenants’ data, avoids service disruption, and is reported privately to the security contact below with reasonable time to remediate before any disclosure.

4. Enforcement

Breaches may lead to throttling, credential revocation, suspension or termination of the account. Attacks on the Service — including unauthorized access, denial of service and interference with its systems — are reported to the competent authorities and may give rise to civil liability and criminal prosecution under applicable law, including Articles 243 and 244 of the Turkish Criminal Code and equivalent laws elsewhere.

5. Changes

oddsfeed may update this policy to address new risks; material changes are announced in advance through the console or by e-mail.