Privacy Policy

Last updated: April 6, 2026

BetRelay ("we", "us", "our") operates the website at https://betrelay.com.ng. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our Service.

1. Information We Collect

1.1 Account Information

When you register, we collect:

• Name — for display and communication
• Email address — for authentication, OTP verification, and notifications
• Password — stored as a bcrypt hash (we never store plaintext passwords)
• Google account data — name, email, and profile picture (if you sign in with Google)

1.2 Usage Data

We automatically collect:

• IP address — for rate limiting and security
• Browser and device information — User-Agent, screen size, language (for device fingerprinting)
• Conversion data — bet codes submitted, source/target bookmakers, timestamps, response times
• API usage — requests per key, endpoints accessed

1.3 Guest Data

For users without an account, we collect:

• IP address — primary identifier for rate limiting
• Canvas fingerprint — a hash derived from browser properties (not biometric data). Used to supplement IP-based rate limiting on shared networks.

2. How We Use Your Information

Purpose	Data Used	Legal Basis
Account authentication	Email, password, Google ID	Contract
Device verification (OTP)	Email, IP, User-Agent	Legitimate interest (security)
Bet code conversion	Bet codes, bookmaker selections	Contract
Rate limiting	IP, fingerprint, usage counters	Legitimate interest
Subscription management	Plan, payment dates	Contract
Email notifications	Email, name	Contract / Consent
Analytics & improvement	Aggregated usage data	Legitimate interest
Security & fraud prevention	IP, device info, login history	Legitimate interest

3. Data Storage & Retention

Data	Storage	Retention
User accounts	PostgreSQL	Until account deletion
Conversion logs	PostgreSQL	12 months
Guest usage	PostgreSQL	30 days
OTP codes	PostgreSQL	10 minutes (auto-expire)
Trusted devices	PostgreSQL	90 days of inactivity
Password history	PostgreSQL	Last 5 hashes per user
Sessions	Redis	Session duration
Blog images	Cloudinary	Until deleted by admin

4. Third-Party Services

We use the following third-party services that may process your data:

Service	Purpose	Data Shared
Google OAuth	Social login	Name, email, profile picture
Cloudinary	Image hosting	Blog cover images only
Brevo (Sendinblue)	Transactional email	Email address, email content
Bookmaker APIs	Bet code conversion	Bet codes (no personal data)

We do not sell, rent, or share your personal data with advertisers or data brokers.

5. Cookies & Tracking

• Session cookie — required for authentication (httpOnly, secure in production)
• CSRF token — required for form security
• We do not use third-party tracking cookies, Google Analytics, or advertising pixels.

6. Security Measures

• Passwords hashed with bcrypt
• CSRF protection on all forms
• Rate limiting on authentication endpoints (5 attempts/minute)
• OTP-based device verification for new device logins
• Password history check (prevents reuse of last 5 passwords)
• Input validation and sanitization on all user inputs
• HTTPS encryption in transit (production)
• Redis-backed sessions with server-side storage

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate data
• Deletion — request deletion of your account and data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Restriction — request limited processing of your data

To exercise any of these rights, contact us at betrelay.app@gmail.com. We will respond within 30 days.

8. Children's Privacy

BetRelay is not intended for anyone under 18 years of age. We do not knowingly collect data from minors. If we discover that a minor has created an account, we will delete it immediately.

9. International Data Transfers

Your data may be processed in countries outside your jurisdiction (e.g., cloud hosting providers). We ensure appropriate safeguards are in place for such transfers.

10. Data Breach Notification

In the event of a data breach that affects your personal data, we will notify affected users via email within 72 hours of discovery and take immediate steps to mitigate the breach.

11. Changes to This Policy

We may update this Privacy Policy at any time. Changes will be posted on this page with an updated date. Continued use of the Service after changes constitutes acceptance.

12. Compliance

This policy is designed to comply with:

• NDPR — Nigeria Data Protection Regulation
• GDPR — General Data Protection Regulation (EU users)

13. Contact

For privacy-related questions or data requests:

• Email: betrelay.app@gmail.com
• WhatsApp: +234 708 711 0468