Privacy Policy

1. Introduction

This Privacy Policy explains how FxHomeLab ("we", "us", "our"), operator of fxhomelab.com and its related applications ("Platform"), collects, uses, shares, and protects your personal data.

FxHomeLab is the data controller for the personal data described here. We are operated by [REGISTERED ENTITY NAME], [RC Number [RC NUMBER]], of [REGISTERED ADDRESS], Nigeria.

We process personal data in line with the Nigeria Data Protection Act 2023 ("NDPA") and the regulations and directives of the Nigeria Data Protection Commission ("NDPC"). Where we serve users in the European Economic Area, the United Kingdom, or other regions, we also apply the standards of the applicable data-protection laws (such as the GDPR) to those users.

By using the Platform, you acknowledge this Policy. Where the law requires consent, we ask for it separately.

2. Who this Policy applies to

This Policy applies to visitors, registered users, and subscribers of the Platform, wherever you are located, including users in Nigeria and in the international diaspora.

3. The personal data we collect

You give us:

• Account data: name or username, email address, password (stored hashed, never in plain text), country/region, and preferences.
• Profile & learning data: your progress through lessons, comprehension answers, chart annotations, simulated trades and journal entries, scores, calibration results, challenge attempts, badges, and cool-down/behavioral events generated by your practice.
• Payment data: we do not store full card numbers. Our payment processors handle card and crypto payment details; we receive a transaction reference, amount, currency, status, plan, and (for crypto) wallet/transaction identifiers.
• Communications: messages you send us (support, feedback), and waitlist/marketing entries including any stated willingness-to-pay.

We collect automatically:

• Device & usage data: IP address, browser and device type, operating system, pages viewed, actions taken, timestamps, and referring URLs.
• Cookies & similar technologies: see our Cookie Policy.

We receive from third parties:

• Payment status from Paystack and our crypto payment processor.
• Market data from providers such as Deriv (this is market, not personal, data).
• Analytics aggregated by our analytics tools.

We do not intentionally collect special-category data (e.g. health, biometrics, political views). Please do not send it to us.

4. Why we process your data, and our lawful basis

Where we rely on legitimate interest, we have balanced it against your rights. Where we rely on consent, you may withdraw it at any time without affecting prior processing.

5. How we share your data

We share personal data only as needed, with:

• Payment processors — Paystack and our crypto payment processor — to take and verify payments.
• Infrastructure & hosting providers — to run the Platform (e.g. cloud hosting, database).
• Analytics and communication providers — to understand usage and to email you.
• Professional advisers — lawyers, accountants, auditors — under confidentiality.
• Authorities — where required by law, court order, or to protect our rights, users, or the public.
• A successor — in a merger, acquisition, or asset sale, subject to this Policy.

We do not sell your personal data. We require our processors to protect your data and to use it only for the services they provide to us.

6. International transfers

We operate from Nigeria and serve users internationally, so your data may be processed in countries other than your own, including where our hosting, payment, and analytics providers operate. Where we transfer personal data across borders, we do so in line with the NDPA's cross-border transfer rules and, for GDPR-covered users, under an approved transfer mechanism (such as adequacy or standard contractual clauses). By using the Platform, you understand your data may be transferred and processed outside your country.

7. How long we keep your data

We keep personal data only as long as necessary for the purposes above:

• Account & learning data: for as long as your account is active, and for a reasonable period afterwards.
• Payment & transaction records: for the period required by Nigerian tax and financial-record law (typically six (6) years).
• Support communications: for a reasonable period to handle follow-ups.

When data is no longer needed, we delete or anonymise it. Aggregated or anonymised data (which cannot identify you) may be kept indefinitely.

8. Your rights

Subject to the NDPA (and, where applicable, GDPR), you have the right to:

• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten"), where the law allows;
• restrict or object to certain processing;
• data portability — receive your data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with the NDPC (or your local data-protection authority).

To exercise any right, contact [PRIVACY/DPO EMAIL]. We will respond within the time required by law (generally within 30 days). We may need to verify your identity first. These rights are free to exercise, though we may charge a reasonable fee or decline manifestly unfounded or excessive requests, as the law allows.

9. Security

We use reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS), hashed passwords, access controls, and secrets held outside the codebase. No system is perfectly secure; we cannot guarantee absolute security, but we work to protect your data and will notify you and the NDPC of a reportable breach as required by law.

10. Children

The Platform is for users 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has given us data, contact [PRIVACY/DPO EMAIL] and we will delete it.

11. Cookies

We use cookies and similar technologies as described in our Cookie Policy.

12. Data Protection Officer / contact

For any privacy question or to exercise your rights:

[DPO NAME or "Privacy Team"]
Email: [PRIVACY/DPO EMAIL]
Address: [REGISTERED ADDRESS], Nigeria

You may also contact the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng.

13. Changes to this Policy

We may update this Policy. Material changes will be notified (e.g. by email or in-Platform notice) and the "Last updated" date will change. Continued use after the effective date means you acknowledge the update.