Privacy Policy

1. What we collect

Deliberately little. Here is the complete list.

Data	Where it comes from
Phone number	You, at sign-up. It's your login.
Display name	You, optionally.
Preferred voice and language	Your settings.
Your logged predictions	You, each time you tap Home/Draw/Away.
Bets you manually log in My Bets	You, optionally. We never see your bookmaker account.
Subscription status and Paystack reference	Paystack, on payment.
Device type, browser, coarse location (country)	Automatically, for security and analytics.

What we never collect: your card number (Paystack handles that), your bookmaker credentials, your bank details, your contacts, your precise GPS location, or your messages.

2. Why we collect it

• To run the service — sign you in, show your predictions, settle your Margin Ledger. Lawful basis: performance of a contract.
• To keep accounts secure — rate limiting, fraud detection, abuse prevention. Lawful basis: legitimate interest.
• To improve the models and the product — always on aggregated, de-identified data. Lawful basis: legitimate interest.
• To message you — the weekly digest and product updates on WhatsApp or push. Lawful basis: consent, withdrawable at any time.

We do not sell personal data. We do not sell or rent your phone number. We do not run third-party advertising trackers.

3. Who we share it with

Only the processors we need to operate, each bound by contract:

• Paystack — payment processing (Nigeria)
• Google Cloud Platform — hosting and database
• WhatsApp Business API / Firebase — notifications you've opted into
• Sentry — error monitoring (scrubbed of personal data)

We will disclose data to a public authority only where legally compelled, and we will tell you unless prohibited from doing so.

4. How long we keep it

• Account data — while your account is open, then 90 days after deletion.
• Prediction history — while your account is open; you can wipe it separately at any time without closing the account.
• Payment records — 6 years, because Nigerian tax law requires it.
• Security logs — 12 months.

5. Your rights

Under the Nigeria Data Protection Act 2023 you have the right to:

• Access — get a copy of everything we hold about you;
• Correct — fix anything inaccurate;
• Delete — close your account and have your data erased, subject to the payment-record retention above;
• Port — receive your prediction history in a machine-readable format;
• Object — to processing based on legitimate interest;
• Withdraw consent — turn off messaging at any time, without losing access to the product.

Account deletion and data export are both self-service in your settings, and both take effect immediately. If you'd rather ask a person, email privacy@sharpcut.ng and we'll respond within 30 days. You may also complain to the Nigeria Data Protection Commission.

6. How we protect it

TLS 1.3 in transit, encryption at rest, one-time-code authentication with rate limiting, a strict Content Security Policy, role-scoped and time-boxed production access, and automated dependency scanning. Full detail is on the security page.

If a breach occurs that is likely to affect your rights, we will notify the Commission within 72 hours and tell you directly without undue delay.

7. Cookies

We use a session cookie to keep you signed in, and a preferences cookie to remember your chosen voice and currency. That's it — both are strictly necessary and neither tracks you across other websites. We do not use advertising cookies or third-party trackers, so there is no consent banner to dismiss.

8. Children

SharpCut is strictly for adults aged 18 and over. We do not knowingly collect data from anyone under 18, and we do not market to them. If you believe a minor is using the service, tell us at privacy@sharpcut.ng and we will close the account and delete the data.

9. Contact

Data controller: SharpCut Technologies Limited, Lagos, Nigeria.
Data protection contact: privacy@sharpcut.ng