Privacy Policy

This policy explains what personal data Winraff collects and how we use it, in line with Ghana's Data Protection Act, 2012 (Act 843).

Who is responsible for your data

The data controller's company details and Data Protection Commission registration will be published here before Winraff accepts real money.

What we collect

• Account details: name, email address, Mobile Money number (confirmed with a code we email you) and password (stored only as a secure hash).
• Money: deposits, withdrawals, MoMo numbers used for payouts and payment references from our payment partners.
• Play: slips, picks, results, points, league memberships, promo codes used and daily-spin results.
• Technical: device and browser information, sign-in attempts, and notification subscriptions if you turn them on.

Why we use it

• To run your account, settle slips and pay winnings to your own Mobile Money number.
• To keep the game fair and prevent fraud, account takeovers, money laundering and underage play — for example by allowing one account per person and one MoMo number per account.
• To send security messages (such as a password change) and messages you've asked for (SMS and app notifications) — you can switch the optional ones off in your account.
• To meet legal and regulatory duties, including record keeping required by the Gaming Commission.

Who we share it with

• Payment partners (e.g. Paystack and Mobile Money operators) to process deposits and payouts.
• SMS and hosting providers that run the service for us.
• Regulators, law enforcement or courts when the law requires it.

We do not sell your personal data. On leaderboards and shared slips we show only your first name and last initial.

How long we keep it

Account and transaction records are kept for as long as the law requires after your account closes; other data is deleted or anonymised when no longer needed.

Your rights

You can ask to see, correct or delete your personal data, or object to how we use it, by contacting us or through Help & support. Some records must be kept by law. You can also complain to the Data Protection Commission.

Security

Passwords are hashed, connections are encrypted, sign-in attempts are rate-limited, you get a text if someone keeps trying your password, and staff access is restricted to what their role needs.