Privacy Policy

Last updated: October 6, 2026

This policy explains what personal data Oracle (betverdick.com) collects, why, with whom it is shared, how long it is kept and how you can exercise your rights. It applies to all users worldwide, including in the European Union, the United Kingdom, the United States (including California) and Cameroon.

1. Who is responsible

• Controller: Cortex Africa SAS, [À COMPLÉTER PAR LE FONDATEUR], RCCM [À COMPLÉTER PAR LE FONDATEUR].
• Privacy contact: [À COMPLÉTER PAR LE FONDATEUR]. We have not appointed a data protection officer. [À VALIDER : avocat — désignation d’un DPO obligatoire ou non]
• Representative in the European Union (Article 27 GDPR): [À DÉSIGNER].
• Representative in the United Kingdom (Article 27 UK GDPR): [À DÉSIGNER].
• Cameroon — reference of our filing with the Personal Data Protection Authority (Law No. 2024/017): [À COMPLÉTER PAR LE FONDATEUR].

2. Data we collect

Account. Your email address; the one-time sign-in codes sent to it; your secret code if you set one (stored only in hashed form by our authentication provider — we never see it); if you choose to sign in with Google, the email address and basic profile information Google shares with us.

Use of the Service. The analyses you request (match, sport, date, language), their results and verdicts, your history, your credit balance and credit movements, your plan and renewal date, vouchers redeemed, and your account status (including any suspension).

Payments. For card payments, our payment provider sends us the payment status, amount, offer, date and a transaction reference — never your card number. For Mobile Money payments, we record the offer, amount, a payment reference and its status, and we see what your operator shows the recipient of a transfer (usually your phone number and registered name), which we use only to match your payment. Payment and credit records keep a copy of the email address of the account, so that they remain traceable for accounting purposes even after your account is deleted.

Technical data and approximate location. Your IP address is processed by our hosting provider to deliver the site and by our providers for security (sign-in, abuse prevention). We do not record it in our own application tables. [À VALIDER : confirmer : aucune colonne IP dans la base Oracle] From your IP address, our host derives an approximate location (country, city, approximate coordinates — never GPS). We use it to:

• show prices in your currency and the payment methods available in your region;
• record one anonymous visit point per browsing session (country, city, approximate coordinates, and whether the visitor is signed in) — without IP address or account identifier — displayed on an internal traffic map; automated traffic is filtered out using your browser type, which we do not store;
• if you are signed in, save on your profile the country and city of your last visit and its time, visible to our administration team on your member record.

Error reports. When the app crashes or slows down, an error report (page, browser, technical details of the error) is sent to our monitoring provider, which also measures the performance of a sample of page loads. It is configured not to send personal identifiers by default.

Messages. The emails you send us and our replies.

We do not collect card numbers, precise (GPS) location, contacts, advertising identifiers, or special categories of data (health, beliefs, etc.).

3. Artificial intelligence providers

To write analyses and run web research, we send AI providers the description of the match (teams, competition, date, sport), public data about it and the language of the analysis. We do not send them your email address, name, account identifier or payment data. Please do not type personal information in the match field. [À VALIDER : audit des requêtes envoyées aux modèles (aucun identifiant)]

4. Why we use your data (purposes and legal bases)

• Provide your account, analyses, credits and history — performance of our contract with you.
• Process payments and keep accounting records — contract and legal obligation.
• Show prices in your currency — legitimate interest (a relevant offer).
• Security, fraud and abuse prevention (one active device per account, duplicate accounts, usage limits, suspensions) — legitimate interest (protecting the Service and its users).
• Anonymous traffic map and last location on your member record — legitimate interest (understanding our audience, supporting members, detecting account sharing). You can object. [À VALIDER : avocat — mise en balance de l’intérêt légitime pour la dernière ville visible au pilotage]
• Error monitoring — legitimate interest (keeping the Service working).
• Public track record — legitimate interest (transparency and integrity of our results); it shows no personal data.
• Audience measurement (coming soon) — your consent, which you can withdraw at any time.
• Service emails (sign-in codes, receipts, renewal reminders) — contract and legal obligation. We send no marketing emails without your consent.
• Complying with the law and defending legal claims — legal obligation and legitimate interest.

5. Who receives your data

We do not sell your personal data. We share it only with the service providers below, which process it on our behalf and under our instructions, or which act independently where stated.

• Supabase — database and authentication (including sign-in emails). [À VALIDER : région d’hébergement du projet Supabase « oracle »]
• Vercel — hosting, content delivery and approximate IP geolocation (United States, global network).
• Sentry — error monitoring. [À VALIDER : région US ou UE de l’organisation Sentry]
• Trigger.dev — background jobs (data refresh, settling of bets). [À VALIDER : données personnelles traitées par les tâches de fond]
• Upstash — usage limits (rate limiting). [À VALIDER : identifiant utilisé : adresse IP ou identifiant de compte]
• Whop (and later Stripe) — card payments (United States). For payment processing they also act under their own privacy policies.
• MTN and Orange — Mobile Money operators, acting independently for your transfers.
• DeepSeek (China), Perplexity, Anthropic and Google Gemini (United States) — AI models and web research; they receive match data only, not personal data (section 3).
• The Odds API and API-Sports — odds and sports data; they receive match queries only, not personal data.
• Google — sign-in, only if you choose “Sign in with Google”.
• Coming soon: PostHog (audience measurement, only with your consent) [À VALIDER : choisir l’hébergement UE de PostHog] and Resend (service emails, United States).

We may also disclose data when required by law or by a competent authority, or to a successor in the event of a merger or sale of the business (you would be informed).

6. International transfers

Cortex Africa SAS is established in Cameroon and our providers are mainly located in the United States, so your data is processed outside your country. For users in the EU, the UK and Switzerland, transfers rely on adequacy decisions (including the EU-US Data Privacy Framework for certified providers) or on the Standard Contractual Clauses included in our providers’ data processing agreements. You can ask us for a copy of these safeguards. [À VALIDER : fondateur — accepter/signer le DPA de chaque prestataire ; avocat — régime des transferts hors du Cameroun (loi n° 2024/017)]

7. How long we keep data

• Account data: while your account is active. You can delete your account at any time in Settings; deletion is immediate. Inactive accounts are deleted after [À VALIDER : durée d’inactivité].
• Analyses: deleted with your account, except bets already settled in the public track record, which are kept detached from your account.
• Payment and credit records: kept after account deletion, with the email copy mentioned above, for [À VALIDER : comptable — durée légale de conservation (OHADA : 10 ans ?)] to meet accounting and tax obligations.
• Proof of your consent to automatic renewal: at least 3 years, or one year after the end of the subscription if longer.
• Last location on your profile: replaced at each visit, deleted with your account.
• Anonymous visit points: [À VALIDER : durée].
• Error reports and hosting logs: for the limited period set by these providers [À VALIDER : durées Sentry / Vercel].
• Support emails: [À VALIDER : durée].

8. Your rights

Wherever you live, you can ask us to access your data, correct it, delete it (or do it yourself: Settings → Delete my account), receive a copy in a portable format, object to processing based on our legitimate interest (for example the last-location record), restrict processing, and withdraw your consent at any time. Write to [À COMPLÉTER PAR LE FONDATEUR] from the email address of your account so we can verify your identity. We reply within one month (GDPR) or 45 days (CCPA), extendable where the law allows.

• EU / UK: you may lodge a complaint with your supervisory authority (for example the CNIL in France or the ICO in the UK).
• Cameroon: you have the rights provided by Law No. 2024/017 and may refer a matter to the Personal Data Protection Authority.
• California (CCPA/CPRA): you have the right to know what personal information we collect, use and disclose, and to delete and correct it. In the last 12 months we collected: identifiers (email, account ID, IP address), commercial information (purchases, credits), internet activity (analyses requested, use of the Service) and approximate (city-level) geolocation — from you, your device and our payment providers, for the purposes in section 4, and disclosed them only to the service providers in section 5. We do not sell or share personal information (for cross-context behavioural advertising) and have not done so in the last 12 months; Global Privacy Control signals are honoured as an opt-out request. We use sensitive personal information (your login credentials) only to provide and secure the Service. We will not discriminate against you for exercising your rights. You may use an authorised agent.
• Other US states: residents of states with a privacy law can exercise equivalent rights. If we decline your request, you can appeal by replying to our decision; if the appeal is refused, you may contact your state Attorney General.

[À VALIDER : fondateur — accorder ces droits à tous, que la CCPA s’applique ou non (seuils probablement non atteints)]

9. Cookies and local storage

Essential (always active, no consent required):

• sign-in session (browser storage of our authentication provider) — keeps you signed in;
• olang cookie (1 year) and language setting — displays pages in your language;
• theme setting (light/dark) and a local cache of your recent analyses — display;
• a per-session marker (deleted when the browser session ends) — ensures only one visit point is recorded per session;
• oconsent cookie and the matching local setting (about 6 months) — remembers your cookie choice.

Audience measurement (coming soon): only if you accept it. We use no advertising or cross-site tracking cookies. Payment pages operated by our payment providers may set their own cookies under their own policies.

10. Minors

The Service is not intended for, and may not be used by, anyone under 21 (or under 18 where the law sets the legal betting age at 18 — see our Terms). We do not knowingly collect data from minors; if we learn that a minor has an account, we delete it. Contact us if you believe this is the case.

11. Security

Data is encrypted in transit (HTTPS), access to the database is restricted account by account, administrative access is limited, and an account can only stay signed in on one device at a time. No system is perfectly secure; in the event of a data breach, we will notify the authorities and affected users as required by law. [À VALIDER : vérifier que la sécurité au niveau des lignes (RLS) est active sur toutes les tables Supabase]

12. Automated decisions

Analyses are automated but concern sporting events, not you. We make no decision producing legal or similarly significant effects about you based solely on automated processing. [À VALIDER : confirmer qu’aucune suspension de compte n’est automatique]

13. Changes

We may update this policy; the date at the top shows the current version. For material changes, we will inform you in the app or by email before they apply.

14. Contact

Cortex Africa SAS — [À COMPLÉTER PAR LE FONDATEUR]
Privacy: [À COMPLÉTER PAR LE FONDATEUR]