Vague cross-border disclosures are now a known NDPC fine trigger (MultiChoice paid ₦766.2M in July 2025). Your primary personal data — accounts, payout-account hash, session recordings, payout records — is held on hardware Ranked Technologies Ltd owns and controls. That hardware is located in Türkiye, not in Nigeria, which makes it an international transfer under the NDP Act 2023; the basis relied on is section 43(1)(b). Below is the live list of the few third-party sub-processors that touch data, in which region, handling which data, under which legal basis.
Last reviewed 1 August 2026 · Material changes published here at least 30 days before they take effect · [email protected]
Primary data residency
Self-hosted · Türkiye
Hardware the company owns and controls, not a third-party cloud. Located in Türkiye, not Nigeria · nightly encrypted DB snapshots, ~14-day retention, on the same company-controlled hardware
Cross-border position
International transfer
Primary storage is outside Nigeria, under NDP Act 2023 s.43(1)(b). Transient third-party touchpoints: Cloudflare edge routing + Mailtrap email. Payments are processed in Nigeria by Flutterwave
Change-notice window
30 days
Posted here + emailed to Enterprise customers
We run our core stack on hardware owned and operated by Ranked Technologies Ltd — not AWS, not Google Cloud, not Azure, not any other hyperscaler. The systems listed below are not third-party sub-processors; they are operated by 9jatesters. Where that hardware is physically located, and the legal basis for it, are set out in the section immediately below.
The payout bank-account number is HMAC-SHA256 hashed and never stored in plaintext; only the hash is persisted. TLS 1.3 with HSTS is enforced in transit. Two third-party touchpoints are transient (Cloudflare edge routing and Mailtrap email delivery). The physical location of this hardware, and the NDP Act basis for it, are set out immediately below.
Ranked Technologies Ltd (RC 9522220) is a Nigerian company registered in Lagos. The server holding primary personal data — the database, session recordings and the encrypted backups — is hardware the company owns and controls, and that hardware is physically located in Türkiye. It is not located in Nigeria. Holding personal data on it, and administering it from there, constitute an international transfer under the NDP Act 2023.
Data categories handled
Client billing details handled for payment processing: billing contact, transaction amount and reference.
Legal basis (NDPA)
Contract performance (NDPA s.25(c)) + CBN regulatory obligation. Processed in Nigeria by a CBN-licensed Nigerian processor.
Data categories handled
In-flight request metadata transiting the edge — IP address, request headers, URL — used for CDN, DDoS protection, and the secure tunnel that exposes the app. Does not persistently store our users' data.
Legal basis (NDPA)
Legitimate interests (NDPA s.25(f)) for security + delivery. Terminates TLS at its global edge and proxies requests to our own origin server; Cloudflare's own processing is limited to transient edge routing, not storage.
Data categories handled
Transactional email delivery: recipient email address + message content (login one-time codes / OTP, receipts).
Legal basis (NDPA)
Contract performance (NDPA s.25(c)) for account access + transactional notices. A cross-border touchpoint limited to email delivery, not primary storage.
Data categories handled
IP-to-country lookup for display only. The request IP is used transiently to compute a country code; we do not persist the raw IP.
Legal basis (NDPA)
Legitimate interests (NDPA s.25(f)) for localised display. Transient use only — no persistent storage of personal data by us.
Data categories handled
Advertising measurement on PUBLIC marketing pages only, and only for visitors who accept it: page views and key button clicks (e.g. starting signup) with browser metadata and Meta cookies, so we can measure whether our Facebook/Instagram ads work. Blocked outright on the logged-in dashboard, account pages and admin area regardless of consent; not used to profile registered testers.
Legal basis (NDPA)
Consent (NDPA s.25(1)(a)), collected on the cookie banner and withdrawable at any time via "Cookie settings" in the site footer (s.35(2)). Nothing loads unless consent is given — no answer means no pixel. Corrected 1 Aug 2026: this previously claimed legitimate interest and loaded without asking.
Data categories handled
Error monitoring: technical crash reports (stack trace, page URL, browser info, and the request IP) when something breaks, so we can fix bugs. No session recordings or form contents.
Legal basis (NDPA)
Legitimate interests (NDPA s.25(f)) for service reliability. Error data only — not analytics or advertising.
Primary personal data is held on hardware we own and control, located in Türkiye, relying on section 43(1)(b) of the NDP Act 2023 — set out in full above. Enterprise customers can request a written statement of that position for their procurement file, dedicated database isolation, or a custom Data Processing Agreement aligned with their internal procurement gates. Standard turnaround is 2 business days.
Email a residency brief