Privacy Policy

2. Categories of Data We Collect

We collect only information strictly necessary to provide automated trading software services:

• Identity & Contact Information: Full name, verified email address, and optional avatar image.
• Authentication Credentials: Securely hashed passwords (via bcrypt) and time-bound One-Time Passwords (OTPs).
• Trading Account Credentials: MT5 broker account login, server name, and password. (Broker passwords are encrypted using AES-256 at rest and decrypted strictly in volatile server memory when synchronizing with the execution daemon).
• Transaction Records: Paystack transaction references, currency, amount paid, license duration, and promo codes. (We NEVER store or collect raw credit/debit card numbers, CVVs, or bank account PINs).
• Technical & Consent Logs: IP address, browser user-agent, legal acceptance timestamps in UTC, and system audit trails.

3. Lawful Bases for Processing (NDPA 2023)

Under Section 25 of the Nigeria Data Protection Act 2023, we process your data under the following lawful bases:

• Performance of a Contract: Processing necessary to license the software, execute automated trading instructions on your MT5 terminal, and provision subscription entitlements.
• Legal & Regulatory Compliance: Retaining financial transaction records and audit logs to satisfy corporate, tax, and anti-fraud regulations.
• Legitimate Interests: Hardening system security, preventing unauthorized account access, and debugging technical execution errors.
• Explicit Consent: Affirmative user consent obtained at registration for the Terms and Conditions, Risk Disclosure, and Privacy Policy.

4. Third-Party Service Providers

We share minimal data with trusted third-party service providers bound by strict confidentiality and data protection obligations:

• Payment Processing: Paystack Payments Limited (PCI-DSS Level 1 compliant checkout).
• Email Delivery: Resend Inc. / Brevo SAS (for transactional verification PINs).
• Cloud Infrastructure: Hardened cloud VPS servers and database instances.

We NEVER sell, rent, or monetize your personal or trading information to advertisers or external brokers.

5. Technical & Organizational Security

• Encryption at Rest: Sensitive MT5 credentials are encrypted using AES-256 via Laravel's encryption envelope.
• Encryption in Transit: All HTTP communications require HTTPS TLS 1.3 with HSTS.
• Execution Isolation: Execution worker communication is secured over private networks and authenticated by high-entropy tokens.
• Access Controls: Role-based access control (RBAC) restricts administrative database access exclusively to authorized personnel.

6. Your Rights Under the NDPA 2023

As a data subject in Nigeria, you possess statutory rights under the NDPA 2023:

• Right of Access: You may request confirmation and a copy of personal data we hold about you.
• Right to Rectification: You may update or correct inaccurate profile details at any time.
• Right to Erasure ("Right to be Forgotten"): You may request the deletion of your account and credentials, subject to statutory record-retention requirements.
• Right to Restrict or Object: You may object to specific processing operations where applicable.
• Right to Data Portability: You may request your account history in a structured, commonly used format.
• Right to Lodge a Complaint: You have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these rights, email our compliance desk at support@vertexcore.store.

7. Data Retention Policy

We retain personal data only for as long as your account remains active or as required by applicable Nigerian commercial, tax, and anti-money laundering laws. Upon verified account closure, trading account credentials are deleted permanently from our database.