Privacy Policy

1Who we are and what this covers

Eminent Concepts Technology Limited (RC 8278868) is the data controller for Game4Pay. Our registered address is Plot 2, Okporo Rumuehienwo Estate, Rukpokwu, Port Harcourt 500102, Rivers State, Nigeria. In this document “we”, “us” and “Game4Pay” mean that company, and “you” means the person using the service.

This policy covers all of it:

• the Game4Pay apps for Android and iOS;
• the web app at app.game4pay.com, including when installed to your home screen;
• this website, game4pay.com; and
• our API and support channels.

It does not cover anything that happens after you follow a link off our service — your bank’s app during a deposit, for example, has its own policy.

2At a glance

The detail is below, but the short version is the part most people want, so it comes first.

3Information you give us

Creating and running your account

• Your first and last name, username, email address and, if you add one, phone number and profile picture.
• Your password. We store a bcrypt hash of it and never the password itself, which is why we cannot tell you what it is — only help you set a new one.
• Your date of birth. Required before you can deposit, withdraw or enter a paid tournament, because Game4Pay is 18+. It is stored as a calendar date and is write-once — correcting it goes through support, so that the age check cannot be re-attempted until it passes.
• Your country, which sets your wallet currencies and determines whether paid play is available to you.
• The time you accepted the Terms and Official Rules.

Security features you switch on

• An app PIN, stored as a bcrypt hash.
• Two-factor authentication: the shared secret is encrypted (AES-256-GCM) at rest, and your backup codes are stored as hashes and destroyed as they are used.
• Biometric sign-in and biometric approval for payments. We never receive your fingerprint or your face. Those stay in your device’s secure hardware. What we store is a device-bound secret that your phone releases only after it has checked your biometric locally, plus the identifier of the device you enrolled — so the credential is worthless anywhere else.

Money

• Your wallet balances, bonus balance and full transaction history.
• Payout accounts you save for withdrawals: for a bank account, the bank name and code, account number and account name; for mobile money in Ghana, the network and mobile number.
• Deposit and withdrawal references from our payment provider.
• For bank-transfer deposits, the sender’s name and bank as reported by the payment provider, so a deposit can be matched to you.

We do not take card payments. Deposits are made by bank transfer, USSD, OPay or mobile money, or to your own Game4Pay account number. We receive a reference, a status, an amount and the sender details the provider reports.

Your own account number (Nigeria)

Only if you ask for a personal Game4Pay account number to deposit into. Nigerian rules require a BVN to open one, so when you ask, and only after you tick the box agreeing to it, we:

• send your BVN to Prembly, our verification partner, which returns the name, date of birth and phone number registered to it. We check that the name in your Profile is on that record. The date of birth and phone are compared as risk signals only. We do not keep what Prembly returns: only whether it matched.
• send your BVN and name to Flutterwave, the payment provider that issues the account number, as the law requires of them.
• keep only the last four digits of your BVN and a keyed one-way hash of it, which lets us stop one BVN being used on two Game4Pay accounts without storing the number itself. We also record when you agreed.

Identity verification (KYC)

Only if you ask to raise your withdrawal limit above the unverified tier. Nobody is required to submit this to play, to deposit or to withdraw within the standard limit. When you do submit it, we collect:

• photographs of an identity document — passport, national ID, driver’s licence, voter card or Ghana Card — and a selfie;
• a one-time challenge code issued when you take the selfie, so an old submission cannot be replayed. (This is not an automated face check: a person on our team compares your selfie with your document.)
• the document type, issuing country and number, your full name, date of birth, and address; and
• where the local scheme requires it, a BVN (Nigeria) or Ghana Card number.

We also compute cryptographic hashes of the images from the copies we store, and perceptual hashes where your app provides them. Those exist to detect the same document being submitted under two different names, which is the fraud this check is for. Your documents are stored privately: they are never publicly viewable and are opened only by our reviewers, each time through a short-lived link that is recorded.

Things you write

• Messages you send in in-app chat, and reactions to them.
• Support tickets and anything you attach to them.
• Your notification preferences.
• On this website only: the email address you type into the waitlist form.

Chat, and who can read it

Game4Pay has four kinds of chat: Community, which is open to every player; group chats; the chat inside each competition; and private messages between two players.

• Community, competition and group chats can be reviewed by our moderators, to keep them safe and fair: scams, harassment, cheating and collusion.
• Private messages are not routinely read. If a message is reported, our moderators see that message and the few messages around it. A senior administrator may open a private conversation to investigate a report, fraud or cheating, or when the law requires it. Each time that happens, the reason is recorded.
• Automatic checks. Software looks for the patterns scammers use — a bank account number, a phone number, a link, a request to pay outside Game4Pay — and puts those messages in front of a moderator. It never removes a message by itself.
• Reports and blocks. When you report a message or a player, we keep the report, your reason and a copy of the message as it was. When you block someone, we keep the fact that you did. We do not tell them.
• Removals and mutes. A moderator may remove a message that breaks the chat rules, or stop an account from sending messages for a time. A removed message is replaced by a note that says why, and its sender can ask for a review.

4Information we collect automatically

• A device identifier that we generate. It is ours, not the phone’s — not your advertising ID, not your IMEI, not a hardware serial. It ties a session to a device so we can show you where you are signed in, end a session you do not recognise, and bind biometric approval to one handset.
• Your IP address and the country our network provider reports for it. Used for security, for fraud checks, and to determine whether paid play is available where your account is registered.
• Device and app information: model, operating system version, app version and platform.
• How you found us, when you create an account. On the web app: the campaign tags in the link that brought you (such as utm_source), the name of the website that linked to us (the site’s address only, never the page you were on), the first page you opened, and whether you used the installed web app. If you joined through a friend’s invite, the invite code. We use this to see which of our campaigns and partners bring new players.
• Request and error logs from our servers, including timestamps and the endpoints called.
• Crash and performance data, so we can find out why the app broke rather than waiting to be told.
• Gameplay records: your entries, scores, board state, results, skill rating and level progress. These are also how a disputed result is settled.

Analytics. This website and the web app use Google Analytics. Until you press Accept on the cookie banner it sets no cookies, but Google still receives a cookieless record of each page view: the page, the site that linked to it, your browser, device type and screen size, and an approximate region worked out from your IP address, which Google then discards. If you accept, Google Analytics also sets cookies so a return visit can be recognised. The Android app reports the same kind of usage through Firebase Analytics, which is part of Google Analytics, using an identifier for the app installation. We never send Google your name, email address or phone number; once you are signed in, the only identifier we send is our own internal account number.

5Information from Google, Apple and Facebook sign-in

If you choose to sign in with a social account, that provider tells us who you are so we can create or find your Game4Pay account. Exactly what we receive:

Signing in this way does not post anything to those accounts, and we never receive your password for them. You can disconnect at any time from the provider’s own security settings — the deletion page explains what that does and does not do to your Game4Pay account.

Google user data and Limited Use

Game4Pay’s use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically: we use Google account data only to authenticate you and to provide the features you can see; we do not transfer it to others except as needed for those features, for security, or to comply with law; we do not use it for advertising of any kind; and no human at Game4Pay reads it except with your explicit consent, for a security investigation, to comply with law, or on data that has been aggregated and made anonymous.

6What we do not collect, and will not start collecting quietly

These are commitments, not omissions. Each one is a thing the product genuinely does not do, and any of them changing would require this page to change first.

• No advertising, ever. No ad SDKs, no ad identifiers (IDFA or Google Advertising ID), no offer walls, no rewarded video, no retargeting pixels.
• No sale or sharing of personal data — including no “sharing” for cross-context behavioural advertising, as those terms are defined under US state privacy laws.
• No precise location. The app does not request location permission and cannot read GPS. Country comes from your IP address alone.
• No access to your contacts, calendar, SMS, call log or microphone.
• No access to your photo library beyond the individual file you choose when setting an avatar or submitting a KYC document.
• No card data. See section 3.
• No biometric templates. See section 3.
• No special-category data. We do not ask for and do not want your race, ethnicity, religion, politics, health, sexual orientation or trade union membership.
• No data from data brokers. We do not buy or enrich profiles from public databases, marketing partners or affiliate networks.

7Why we process it, and our legal basis

We process personal data under the Nigeria Data Protection Act 2023 and, where it applies to you, the UK and EU GDPR. Every purpose has a basis:

Where the basis is legitimate interests, we have weighed those interests against your rights and can explain the reasoning if you ask.

8Automated decisions

Two things happen automatically and are worth naming plainly.

• Skill matching. A rating is calculated from your settled results and used to group you with players of similar ability. It affects who you play, never how much you win, and it is not a judgement about you as a person.
• Fraud and integrity checks. Automated rules can flag a score, a payment or an account — for example an impossible score, or one device submitting identity documents for two different people. A flag can restrict an account or a withdrawal pending review.

A restriction that affects your money is reviewed by a person before it becomes permanent, and you can contest it. Email [email protected] and ask for a human review — that is a right, not a favour.

9Who processes your data on our behalf

Everyone below works under contract for us, may use your data only for the purpose named, and may not use it for their own. This is the complete list.

Identity-verification providers (such as Smile ID or Persona) are built into the product but are not switched on. Today every KYC submission is reviewed by a person on our team. If we enable an automated verifier, this page will name it before it processes anyone’s documents.

Beyond those processors, we disclose personal data only:

• when a law, court order or regulator with jurisdiction requires it;
• where it is necessary to establish, exercise or defend a legal claim, or to investigate fraud or a threat to someone’s safety; and
• if the business is ever sold or merged — in which case the buyer is bound by this policy, and we will tell you before your data moves.

Other players see only what you make public: your username, your avatar, your results and anything you write in chat. They never see your email address, phone number, date of birth, wallet balance or identity documents.

10Where your data goes

Game4Pay is operated from Nigeria. Our servers and primary database are hosted in the United States, and some of the other processors in section 9 are outside Nigeria too. Where data leaves Nigeria, the transfer is covered by the recipient’s contractual commitments — standard contractual clauses or equivalent — and by our agreement with them limiting what they may do with it.

The practical protections matter as much as the legal ones: data is encrypted in transit everywhere, credentials and secrets are encrypted at rest, and no processor receives more than the specific data its job requires.

11How long we keep it

Financial records are the one category we cannot erase on request. If you close your account, the transaction history behind it survives — that is a legal requirement on us, not a preference, and it is the honest answer to “delete everything”.

12How we protect it

• Everything travels over TLS. Nothing is sent in the clear.
• Passwords, PINs, backup codes and the biometric credential are stored as bcrypt hashes; two-factor secrets are encrypted with AES-256-GCM.
• Sessions are short-lived and device-bound, and you can end any of them from your account.
• Money actions require a separate step-up — biometric or PIN — beyond being signed in.
• On the web, your session lives in a signed, httpOnly cookie, so no script on the page can read it.
• Rate limits and velocity checks sit in front of authentication, deposits and withdrawals.
• Access to production data is restricted to the staff who need it and is logged.

No system is perfect, and we will not claim otherwise. If a breach occurs that is likely to put you at risk, we will tell you and the relevant regulator without undue delay, and the notice will say what happened rather than that we “take security seriously”.

13Your rights

Whatever country you are in, we apply the following to everyone rather than only to the people who can insist on them:

• Access — get a copy of what we hold about you.
• Correction — have inaccurate details fixed. Date of birth and country go through support, because both are eligibility claims.
• Deletion — have your data erased, within the limits in section 11.
• Portability — receive your data in a structured, machine-readable format.
• Objection and restriction — object to processing based on legitimate interests, or ask us to pause it while a dispute is resolved.
• Withdraw consent — for anything based on consent, such as marketing, at any time and without affecting what came before.
• Human review — of any automated decision that materially affects you.

Email [email protected] from the address on your account. We answer within 30 days; if a request is genuinely complex we will tell you before that deadline, not after it, and explain why. There is no charge.

We may need to confirm it is really you before acting — that check protects your account from someone requesting your data while pretending to be you, and we ask for the minimum that establishes it.

14Children

Game4Pay is for adults. You must be 18 or over to hold an account, and a date of birth is required before any paid feature will work. We do not knowingly collect data from anyone under 18.

If you believe a child has created an account, email [email protected] and we will close it and erase the data, keeping only what a legal obligation forces us to keep.

15Cookies and similar technologies

We use as few as the product can function with, and none for advertising.

• The web app sets one essential cookie: a signed, httpOnly session cookie that keeps you signed in. It carries no profile data and cannot be read by JavaScript. It stores nothing else on your device except local game state and your display preferences.
• Analytics cookies (Google Analytics, on the web app and this website) are set only if you press Accept on the cookie banner. Declining changes nothing about how the product works.
• The mobile apps use no cookies at all. Session credentials live in the operating system’s secure storage. The Android app measures usage through Firebase Analytics (section 4).
• This website sets no cookie of its own; the only ones are the Google Analytics cookies, and only after you accept them.

We use no advertising cookies and do not sell or share your data for advertising. Your choice on the banner is remembered in your browser; clearing this site’s data shows the banner again so you can choose differently.

16Emails and push notifications

Service messages — a deposit confirmation, a withdrawal status, a tournament result, a security alert — are part of the service and cannot be turned off while your account is open. You need them to know what happened to your money.

Everything else is optional. Marketing email carries an unsubscribe link in every message, push categories can be switched off individually in the app under Notifications, and you can revoke push permission entirely from your device or browser settings. Turning off marketing never affects service messages, and never affects your ability to play or withdraw.

17Changes to this policy

When this policy changes, the date at the top changes with it. For a change that materially affects how we use your data, we will tell you in the app or by email before it takes effect — not afterwards.

There is nothing in this document that reserves a right to broaden collection quietly. If a new processor, data category or purpose is added, it appears here first.

18Contact and complaints

Eminent Concepts Technology Limited (RC 8278868)
Plot 2, Okporo Rumuehienwo Estate, Rukpokwu, Port Harcourt 500102, Rivers State, Nigeria
Email: [email protected]
Phone: +234 707 534 7519

If we have not resolved a privacy complaint to your satisfaction, you may complain to the Nigeria Data Protection Commission, or to the data protection authority for your country if you are outside Nigeria. We would rather you came to us first, but you are not required to.