Skip to content
XCELWIZARD
MENU
Download demo

Legal

Privacy Policy

Effective: 27 May 2026 · Last updated: 27 May 2026

This Privacy Policy explains how Bigtoria Informatika Limited ("Bigtoria", "we", "us", "our"), a company registered in Nigeria, collects, uses, stores, and protects your personal data when you visit xcelwizard.com and use the XCELWIZARD demo and related services (the "Service").

We are the data controller of the personal data described below. The Service is operated from Nigeria and intended for users aged 13 and over.

1. The data we collect

We collect only what we need to run the Service.

a. From Google when you sign in

  • Your Google account email address.
  • Your display name as shown in Google.
  • Your profile image URL (avatar).
  • A persistent, opaque Google user ID we use to identify you.

b. From you, at first sign-in

  • A username you choose to represent you in the academy.
  • Your age (we require players to be at least 13).
  • Your country, so we can prioritise regional improvements.

c. Automatically, for security

  • Your IP address and a User-Agent string at sign-in, kept in short-lived auth logs to detect abuse.
  • A session token stored in your browser's local storage to keep you signed in.

We do not currently use any advertising or analytics cookies, fingerprinting, or third-party trackers.

2. Lawful basis under the NDPA

Under the Nigeria Data Protection Act 2023 (NDPA), we rely on:

  • Performance of a contract: to deliver the demo download and keep you signed in.
  • Legitimate interests: to protect the Service from abuse and to plan future development, balanced against your rights.
  • Consent: for any optional product update emails (you can withdraw consent at any time).

3. How we use your data

  • To authenticate you so only signed-in players can access the demo download.
  • To remember your username, age and country between visits.
  • To notify you about meaningful Service updates and launch news.
  • To investigate abuse, secure the Service, and comply with legal obligations.

We do not sell, rent, or trade your personal data, and we do not share it with third parties for advertising.

4. Sub-processors we rely on

To operate the Service, your data may be processed by the following providers:

  • Google LLC, for the Sign-in with Google authentication flow.
  • Supabase, Inc., hosted Postgres and authentication. Database region: Asia-Pacific (Singapore) at the time of writing.
  • Cloudflare, Inc., to host the downloadable demo file via Cloudflare R2.
  • Our hosting provider for xcelwizard.com (Cloudflare Pages or Vercel; updated when finalised).

These providers act as processors on our behalf. Each is bound by their own privacy commitments and a Data Processing Agreement.

5. International transfers

Because Supabase, Google and Cloudflare operate globally, your data may be transferred to and stored in countries outside Nigeria (notably the United States and Singapore). Where this happens, we rely on the cross-border transfer safeguards permitted under the Nigeria Data Protection Act 2023 — including transfers to jurisdictions with adequate protection and contractual data-protection commitments with our providers.

6. How long we keep your data

  • Account record (email, username, age, country): kept while your account exists. Deleted within 30 days of an account deletion request.
  • Sign-in logs: typically kept for up to 90 days for abuse prevention.
  • Session tokens: expire automatically, usually within an hour, and are refreshed only while you are using the Service.

7. Children

The Service is not intended for children under 13. We do not knowingly collect personal data from anyone under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it.

8. Your rights

Under the Nigeria Data Protection Act 2023, you have the right to:

  • Access the personal data we hold about you.
  • Have inaccurate data corrected.
  • Have your data erased ("right to be forgotten").
  • Restrict or object to how we use your data.
  • Receive your data in a portable format.
  • Withdraw any consent you previously gave.
  • Lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

To exercise any of these rights, write to us via the contact page. We aim to respond within 30 days.

9. Cookies and local storage

We use strictly necessary browser storage for the sign-in session (managed by Supabase). We do not currently set any analytics, advertising, or cross-site tracking cookies. If that ever changes, we will update this Policy and request your consent where required.

10. Security

We use industry-standard security practices, including TLS in transit, encryption at rest by our providers, row-level security on our database, and the principle of least privilege for staff access. No system is perfectly secure: if you believe your account has been compromised, contact us immediately.

11. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by email to signed-in players and noted at the top of this page. Continued use of the Service after a change indicates acceptance of the updated Policy.

12. Contact us

For privacy questions or to exercise any of your rights, contact us via the contact page. Letters may also be addressed to Bigtoria Informatika Limited, Nigeria.