Privacy Policy
Draft v0.1 · 1 November 2026
This policy explains what personal data [Company legal name] (“Flexa”, “we”) collects, why, who we share it with, and the choices you have. It applies to our website and apps.
1. Who is responsible
[Company legal name] is the controller of your personal data. Registered address: [address]. Contact for privacy questions: [privacy email]. [Data protection officer, if appointed: name and contact.]
2. What we collect
- Account data: email address, password (stored only as a salted hash), country, language, security settings.
- Identity data: name, date of birth, identity document images and a selfie or liveness check. This can include biometric data, which we treat as sensitive.
- Financial data: wallet addresses, deposits, withdrawals, transfers, swaps, investments, savings, bot activity, fees and balances.
- Network data: referral relationships and the activity that qualifies for commissions and ranks.
- Device and usage data: IP address, device and browser details, sign-in history, and actions in the app, used for security and to run the service.
- Communications: messages you send to support and your notification choices.
- Information from others: results from identity, sanctions and fraud checks.
We do not knowingly collect data from anyone under 18.
3. Why we use it, and our basis
- To create and run your account and provide the services you ask for (performance of a contract).
- To verify identity, prevent fraud and money laundering, and meet legal and regulatory duties (legal obligation).
- To keep the platform secure, detect abuse, improve the product and run analytics (legitimate interests).
- To send marketing, only where you have chosen to receive it (consent). You can turn it off in Settings.
- To process sensitive data such as biometric checks, where the law requires it, on your explicit consent or another lawful basis.
[Counsel to confirm the lawful bases for each country we serve.]
4. Automated checks
We use automated risk screening, for example on withdrawals and sign-ins, to spot fraud and abuse. Some withdrawals are held for review. A person can review these decisions. If you think a decision was wrong, contact us.
6. International transfers
Our providers and systems may be in countries other than yours. Where we transfer data across borders, we use safeguards the law accepts, such as contractual clauses. [Counsel to confirm the mechanisms for each region.]
7. How long we keep it
We keep data only as long as needed for the purposes above. Anti-money-laundering and tax laws can require us to keep identity and transaction records for several years after an account closes: [period per jurisdiction]. After that we delete or anonymise them.
8. How we protect it
We use encryption in transit and at rest, access controls, two-person approval for sensitive actions, audit logs, and separate storage for signing keys. No system is perfectly secure. If a breach affects you, we will tell you and the authorities as the law requires.
9. Your rights
Depending on where you live, you may have the right to access your data, correct it, delete it, restrict or object to its use, receive a copy in a portable form, withdraw consent, and complain to your data protection authority. These rights come from laws such as the GDPR and the data protection laws of Nigeria, Ghana, Kenya and South Africa. [Counsel to list the laws that apply.]
To use a right, contact [privacy email]. We may need to confirm your identity first. Some data we must keep by law, even after you ask us to delete it.
11. Changes
We may update this policy. We will tell you about material changes in the app or by email before they take effect.
12. Contact
Questions or requests: [privacy email]. Complaints about how we handle your data can also go to your local data protection authority.