Privacy Policy & Data Protection Charter
Flapjack Technologies Ltd. · Effective Date: September 10, 2026 · Version 1.0 · Applies to flapjack.top, mobile apps, and the Chrome extension.
1Data Controller & Scope
This Privacy Policy describes how Flapjack Technologies Ltd. (“Flapjack”, “we”, “our”, or “us”) collects, stores, processes, discloses, and protects your personal data when you use our web platform, mobile applications, Chrome extension, and related services.
Flapjack operates as a Data Controller in compliance with the Nigeria Data Protection Act (NDPA) 2023 and the Nigeria Data Protection Regulation (NDPR) overseen by the Nigeria Data Protection Commission (NDPC).
Flapjack is a skill-based gaming platform where users wager coins on gameplay objectives, submit video recordings as proof, and receive prizes after verification. This policy covers all data processing related to accounts, wallets, bets, recordings, identity verification, and social features.
2Categories of Personal Data Collected
2.1 Identity & Account Data
Full name, email address, profile display name, authentication identifiers, and account preferences. Authentication is managed through our identity provider (Clerk). We do not store your password in plaintext.
2.2 KYC & Age Verification Data
National Identification Number (NIN), date of birth, NIN lookup results (including name, photo, and verification PDF returned by our KYC provider), KYC submission timestamps, verification status, and consent records. KYC is required before creating bets and confirms users are 18 or older.
2.3 Wallet & Financial Data
Coin balance, deposit and withdrawal history, Paystack payment reference tokens, transaction amounts and statuses, bank account name, account number, and bank name (for approved withdrawals). We do not store raw debit or credit card numbers — payments are processed by Paystack.
2.4 Gaming, Bet & Recording Data
Bet codes, game URLs, stake amounts, objectives, multiplayer participation, recording tokens, gameplay video uploads, scores, rankings, admin review notes, prize distributions, and reward history.
2.5 Social & Communication Data
Friend requests, friendships, in-app chat messages, notifications, and activity timestamps (such as last seen).
2.6 Chrome Extension Session Data
When using the Flapjack Chrome extension, your email and recording token are stored locally in your browser during an active recording session to upload gameplay proof. This data is cleared after a successful upload.
3Lawful Bases for Processing
Pursuant to Section 25 of the NDPA 2023, we process personal data only when a lawful basis applies:
- Contractual Necessity: To create and manage your account, process bets, verify gameplay, operate your wallet, facilitate withdrawals, and deliver platform features you request.
- Legal & Regulatory Obligation: To verify age and identity (NIN/KYC), maintain financial records, and respond to lawful regulatory or law enforcement requests.
- Consent: For optional notifications, marketing communications (where offered), and KYC data processing — which you may withdraw at any time.
- Legitimate Interests: To prevent fraud, enforce platform rules, resolve bet disputes, protect user safety, and maintain service integrity.
5International & Cross-Border Data Transfers
In accordance with Sections 41–43 of the NDPA 2023, Flapjack uses international cloud infrastructure (including Neon, Vercel, Clerk, and Paystack service regions) that may process data outside Nigeria.
Adequacy Safeguards Employed:
- Data Processing Agreements (DPAs): Contracts with sub-processors requiring data protection standards equivalent to the NDPA.
- Encryption in transit: TLS 1.2+ for all network transmissions.
- Encryption at rest: Provider-managed encryption for database and stored recordings.
- Data minimization: Only necessary data is shared with each sub-processor for its specific function.
6Technical & Organizational Security Measures
Encryption Standards
TLS encryption in transit; provider-managed encryption at rest for databases and uploaded gameplay recordings.
Access Controls
Role-based admin access for KYC review, bet adjudication, and withdrawal approval. User data is scoped to authenticated sessions.
Authentication Security
Passwords and OAuth credentials are managed by Clerk using industry-standard cryptographic hashing. We never store plaintext passwords.
Recording & KYC Isolation
Gameplay videos and NIN verification data are accessible only to authorized admins for review and dispute resolution.
7Data Retention & Erasure Schedule
Personal data is retained only for as long as necessary to fulfill the purposes in this Policy:
| Data Category | Retention Period | Rationale |
|---|---|---|
| Account profile & contact info | Duration of active account + 12 months after closure | Account management and post-closure support inquiries |
| KYC / NIN verification data | Duration of verified status; purged within 30 days of account deletion | Age verification, fraud prevention, and regulatory compliance |
| Bet history & gameplay recordings | 5 years | Dispute resolution, payout verification, and platform integrity |
| Wallet & Paystack transaction logs | 6 years | Financial audit and payment reconciliation |
| Bank account details (withdrawals) | Until account deletion or bank details are removed by user | Processing approved withdrawal payouts |
| Chat messages between users | Duration of active account + 12 months | User communication and abuse-report investigations |
8Data Subject Rights (NDPA 2023)
Under Part V of the NDPA 2023, you may exercise the following rights free of charge:
1. Right of Access
You may request a copy of the personal data we hold about you.
2. Right to Rectification
You can update inaccurate profile information via Settings or by contacting us.
3. Right to Erasure
You may request deletion of your account and associated personal data, subject to legal retention requirements.
4. Right to Restrict Processing
You can ask us to limit processing while a data accuracy dispute is resolved.
5. Right to Data Portability
You may receive your personal data in a structured, machine-readable format where applicable.
6. Right to Object & Withdraw Consent
You can object to non-essential processing or withdraw consent for optional features at any time.
To exercise any of these rights, contact our Data Protection Officer at privacy@flapjack.top. We will acknowledge and respond within 30 days as required by law.
9Personal Data Breach Management
In accordance with Section 40 of the NDPA 2023, Flapjack maintains an incident response protocol:
- 72-hour regulatory notification: Confirmed breaches likely to affect rights and freedoms will be reported to the NDPC within 72 hours of discovery.
- User notification: Where a breach poses high risk, affected users will be notified without undue delay via email and in-app notice.
- Containment: Immediate steps to revoke compromised access, patch vulnerabilities, and preserve forensic audit trails.
10Regulatory Oversight & Complaints
If you have concerns about how your data is handled, contact our DPO first. You also have the right to escalate complaints to the national supervisory authority:
Nigeria Data Protection Commission (NDPC)
No. 5, Charles de Gaulle Close, Asokoro, Abuja, FCT, Nigeria
11Contact & Policy Updates
We may update this Privacy Policy to reflect product changes, new features, or legal requirements. Material changes will be communicated via email or in-app notification before taking effect.
Flapjack Technologies Ltd.
- Website: www.flapjack.top
- Email: privacy@flapjack.top
For platform rules, wagering terms, and user conduct standards, please review our Terms of Service.