Privacy Policy

Last updated: 26 April 2026 · Version 2026-04

This Privacy Policy explains how NikiFX ("we", "our", "us") collects, uses, retains, shares, and protects your personal information when you use the Service. It is part of and subject to our Terms of Service.

1. What We Collect

1.1 Account & Identity

• First name, last name, email, phone number
• Authentication credential (password — stored only as a one-way bcrypt hash; we never see plaintext)
• Referral code used at signup (if any) and your own affiliate referral code (if you become an affiliate)
• When KYC is required: government-issued ID details, proof of address, source of funds — encrypted at rest

1.2 Broker Connection Data

• cTrader: OAuth access & refresh tokens (encrypted), account ID and trader-login number, broker name (e.g., Pepperstone)
• MT5: server name, login number; the Windows MT5 connector you install on your machine sends back balance, equity, margin, free margin, profit, and position snapshots over an authenticated WebSocket. We never see your MT5 password — it stays on your machine in an encrypted local store

1.3 Trading & Account Activity

• Trade records placed by NikiFX on your behalf (symbol, side, lot size, entry, exit, P&L, broker comment "NIKIFX")
• Broker balance / equity snapshots (every ~60 seconds while the connector is online; on every trade event)
• Profit-share deductions and history
• Affiliate referrals and commissions earned

1.4 Payments & Settlement

• M-Pesa transaction metadata (transaction IDs, amounts, timestamps)
• Pesapal transaction IDs for card payments
• Verified registered phone for payouts
• Payout history including amount, mode (gross/net), M-Pesa fee, amount landed, and any failure reason

1.5 Technical & Security Telemetry

• IP address, browser type, operating system, device fingerprint
• Login events (successful and failed) with timestamp
• Sensitive-action events: deposits, payout requests, phone-change attempts, refund requests, T&Cs acceptance
• OTP delivery and confirmation history (codes themselves are stored ONLY as SHA-256 hashes)

1.6 Communications

• Support emails, chat messages, and call recordings (when applicable) — used for support and audit
• SMS delivery records via Africa's Talking
• If you link Telegram for affiliate notifications: your Telegram chat ID

2. Why We Use It (Purpose & Legal Basis)

3. Who We Share It With

We share personal data only when necessary, and only with these categories:

• Your broker (cTrader brokers including but not limited to Pepperstone, IC Markets; MT5 brokers of your choosing) — to execute trades on your account.
• Payment processors: Safaricom (M-Pesa Daraja), Pesapal — to settle KES <-> USD movements.
• SMS / messaging providers: Africa's Talking (transactional SMS), Telegram (only if you link).
• Cloud infrastructure: AWS (us-east-2 by default) — data hosting, secrets management.
• Regulators & law-enforcement: on lawful request — Central Bank of Kenya, Financial Reporting Centre (FRC), Kenya Revenue Authority (KRA), and equivalent foreign authorities under MLAT.
• Successor entity: in the event of merger, acquisition, or asset sale — your data transfers to the acquirer subject to this Policy.

We do NOT sell data to advertisers, share with third-party analytics platforms, or expose data to NikiFX strategy partners.

4. Security Measures

• Encryption in transit: TLS 1.2+ on every public endpoint.
• Encryption at rest: broker tokens, KYC documents, OTP code hashes, MT5 connector credentials.
• Hashed passwords: bcrypt; we cannot recover your plaintext password.
• Secrets management: production credentials live in AWS Secrets Manager, rotated periodically.
• Role-based access: only on-call operators access production data, and every such access is logged.
• Watermarked dashboards: customer dashboards may be subtly stamped with your masked identifier so leaked screenshots are traceable.
• API hardening: rate-limits, authentication, and CORS lock to nikifx.com.

No system is unbreachable. Maintain the security of your own credentials and never share your NikiFX login or broker password with anyone.

5. Data Breach Notification

If we detect a breach affecting your personal data, we will notify you and, where applicable, the Kenya Office of the Data Protection Commissioner within 72 hours of becoming aware. Notification will describe the nature of the breach, likely consequences, and steps we are taking.

6. How Long We Keep It

• Active account data: for the life of the account.
• Trade and payment records: 7 years after account closure (regulatory retention requirement).
• KYC documents: 7 years after account closure.
• Login & sensitive-action logs: 1 year, then aggregated.
• OTP code hashes: purged 24 hours after expiry.
• Marketing consent log: until you withdraw, plus 1 year for audit.

7. Your Rights

• Access: request a machine-readable export of your account, trade, and payment data.
• Correction: ask us to correct inaccurate personal information.
• Deletion: request deletion of your account. Personal identifiers are anonymized while transaction and trade records are retained for the 7-year regulatory window. We cannot delete records that we are legally required to keep.
• Restriction: ask us to pause processing while a dispute is investigated.
• Objection: object to processing based on legitimate interests; we will weigh your objection against our basis.
• Marketing opt-out: turn off marketing in Settings or unsubscribe via any marketing email.
• Complain: lodge a complaint with the Kenya Office of the Data Protection Commissioner if you believe your rights have been violated.

Exercise rights by emailing privacy@nikifx.com. We respond within 30 days.

8. Cookies & Local Storage

• Authentication: a session cookie / JWT for keeping you logged in.
• Preferences: small UI settings (e.g., dashboard tab order).

No third-party advertising or analytics cookies. No cross-site tracking. No fingerprint cookies for marketing.

9. International Data Transfers

Personal data is hosted on AWS, primarily in the us-east-2 region (Ohio, USA). Transfers outside Kenya are made under appropriate safeguards (standard contractual clauses, AWS-provided protections). Where you are not a Kenyan resident, equivalent local-law protections apply.

10. Children's Privacy

The Service is not directed at, and we do not knowingly collect data from, individuals under 18. If you believe a minor has registered, contact privacy@nikifx.com and we will remove the account.

11. Automated Decision-Making

Trade execution decisions are automated by NikiFX's proprietary algorithms. Account-level automated decisions (fraud flags, AML pattern detection, account suspension) are reviewed by a human before any irreversible action — except in cases requiring immediate protective freezing, in which case a human review follows within 7 business days and you receive a written explanation.

12. Changes to This Policy

We may update this Privacy Policy. Material changes trigger an in-product re-acceptance gate before your next dashboard session. Past versions are retained internally for audit.

13. Contact Us

• Privacy / data subject requests: privacy@nikifx.com
• General support: support@nikifx.com
• Legal & compliance: legal@nikifx.com
• Website: https://nikifx.com