Version 1 · Effective 25 Aug 2026
Draft under legal review
This is a working draft prepared for review by qualified counsel. It is not the published ApexPredict policy and it does not yet take legal effect. We publish drafts openly so they can be checked before they are finalised; this page is replaced by the reviewed version, at a new version number, once that review completes.
This policy covers personal data processed by the ApexPredict service. The contracting entity, its registration details and its registered address are stated on this page once verified against the company record; until then this document remains a draft and is not the published policy.
Account data: email address, username, display name, and an optional avatar. Credential data: a hashed password, and — if you sign in with Google — the identifier Google returns to us. We never hold your Google password. Session data: session records, their creation and last-active times, and their expiry. Technical and security data: IP address and, derived from it, approximate country, region and city, network operator and autonomous system number, and whether the address is associated with a VPN, proxy, hosting provider or Tor. Product data: fixtures you follow, notification preferences, and product settings. Billing data: your plan, subscription status, renewal dates and Paystack transaction references. We do not receive or store your full card number. Records data: audit entries for security-relevant actions, and a record of the legal documents you accepted with their versions.
ApexPredict does not ask for and does not hold your date of birth, government identity documents, financial account details, location beyond the approximate area derived from your IP address, or any special-category data. Customers do not submit predictions, so we hold no record of anything you might wager.
To provide the service you asked for — creating your account, authenticating you, publishing predictions to you, and taking payment — we process data because it is necessary to perform our contract with you. To keep the service secure — detecting credential stuffing, unusual access and abuse — and to keep accurate business records, we process data because we have a legitimate interest in operating a service that is not trivially attackable, balanced against your interests. To send optional product news, and to run analytics that are not strictly necessary, we rely on your consent, which you can withdraw at any time. Where a law requires us to keep or disclose something, we process on the basis of that legal obligation.
Almost all of it comes from you, or from your use of the service. Two exceptions: if you sign in with Google, Google supplies your email address and basic profile; and Paystack supplies the payment and subscription status of your transactions. Approximate location and network characteristics are derived by us from the IP address your connection presents.
We use processors who act on our instructions and not for their own purposes: a hosting and content-delivery provider for the application, a managed PostgreSQL and Redis provider for storage and rate limiting, Paystack for payment and subscription management, an email delivery provider for account and notification email, and Google where you choose to sign in with Google. Separately, some background video on our pages is served directly from the stock-media libraries Pixabay and Pexels; because your browser fetches those files itself, those services see your IP address and browser details for that request. They are not our processors and we send them nothing about you. We do not sell personal data, and we do not share it for cross-context behavioural advertising. We disclose data to a public authority only where we are legally required to and, where we are permitted to say so, we will tell you.
Our processors operate outside Nigeria, including in the European Union and the United States. Where personal data moves between countries we rely on the transfer mechanisms available under the applicable law — standard contractual clauses, an adequacy decision, or the equivalent instrument recognised under the Nigeria Data Protection Act. The current list of processors and the mechanism relied on for each is available on request from apex@webforxtech.com.
Account and profile data is kept while your account exists. Session records expire on their own schedule and are cleared automatically afterwards. Security and access records, including IP-derived data, are kept for a limited security window and then deleted or aggregated. Billing records are kept for as long as tax and accounting law requires, which is generally longer than the account itself. Records of which legal document version you accepted are kept for as long as we may need to evidence the agreement. Published predictions and their evaluations are platform records, are not attributed to your profile, and are retained for audit.
When we approve a deletion request, or when you delete your account, we erase or irreversibly anonymise the associated personal data within 90 days. Data may survive that window only where a law requires us to keep it, where we need it to investigate fraud or a security incident, where it is required to preserve or defend a legal claim, where tax or accounting rules require it, or while it rotates out of encrypted backups on their normal schedule. This 90-day figure is our operational purge window. It is not our response deadline: where the law sets a deadline for answering your request — one month under the UK and EU GDPR, extendable in limited circumstances — we answer within that deadline and complete the erasure within the purge window.
Subject to the law that applies to you, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or provide it in a portable form. Where we rely on consent you can withdraw it at any time without affecting what we did before you withdrew it. If the UK or EU GDPR applies to you, those rights come from it. If you are a California resident and the CCPA as amended applies, you additionally have the right to know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information, and not to be discriminated against for exercising a right — and we honour a Global Privacy Control signal as an opt-out. If the Nigeria Data Protection Act applies to you, your rights under it apply. You can start most requests in Settings → Privacy, or write to apex@webforxtech.com.
If you are unhappy with how we handled a privacy request, reply to our response and ask for it to be reviewed; we will have someone who did not make the original decision look at it again. You can also complain to a supervisory authority: the Nigeria Data Protection Commission, the Information Commissioner's Office in the United Kingdom, or the data-protection authority of your country of residence in the European Economic Area.
Our prediction model analyses football fixtures, not people. We do not use automated processing to make decisions about you that produce legal effects or that similarly significantly affect you. Automated security controls may temporarily challenge or slow a sign-in attempt that looks like an attack; where such a control affects your access you can ask a person to review it.
ApexPredict is for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, write to apex@webforxtech.com and we will close it and delete the data.
Access to the service is authenticated server-side and authorised per request. Passwords are stored only as hashes. Traffic is encrypted in transit. Access to production data is limited to the people who need it, and security-relevant actions are logged. No service can promise that it will never be breached; if a breach affects your data and the law requires us to tell you, we will.
This policy is versioned. When we make a material change we will tell you and, where the change requires it, ask you to review the new version. The version and effective date at the top of this page always describe the text you are reading.
Privacy questions and requests: apex@webforxtech.com.