Privacy Policy — Candexai

⚠️ DRAFT TEMPLATE — NOT LEGAL ADVICE. This document is a starting point only. It has NOT been reviewed by a lawyer and must not be published or relied upon as-is. Have it reviewed by a qualified attorney familiar with Kenyan data protection law (Data Protection Act, 2019) before use. Replace all bracketed [placeholders].

Last updated: [DATE]

1. Introduction

This Privacy Policy explains how Candexai ("we," "us") collects, uses, and protects your information when you use our platform.

2. Information We Collect

Account information:

• Name, email address, phone number (if used for notifications)
• Password (stored hashed, never in plain text)

Exchange API credentials:

• API key and secret you provide to connect your exchange account
• These are stored encrypted at rest and used solely to place trades and read account data on your behalf, exactly as instructed by your configured trading settings
• We never use your API credentials for any purpose other than the automated trading functionality you configure

Trading and usage data:

• Trades executed, signals generated, portfolio settings, risk parameters
• Login activity, device/browser information, IP address

Payment information:

• Subscription billing details are processed by our third-party payment processor [e.g., Stripe / M-Pesa Daraja]. We do not store full payment card numbers ourselves.

3. How We Use Your Information

• To provide and operate the automated trading service you've configured
• To process subscription payments and manage your account
• To send you notifications about trades, account status, or service updates (only where you've opted in)
• To improve and maintain the Platform
• To comply with legal obligations

4. How We Do NOT Use Your Information

• We do not sell your personal data to third parties.
• We do not use your API credentials to trade on our own behalf or for any account other than yours.
• We do not share your trading data with other users.

5. Third-Party Services

Your API credentials are used to communicate directly with your connected exchange (e.g., Binance) on your behalf. Your use of that exchange is also governed by their own terms and privacy policy, which we encourage you to review separately.

Subscription payments may be processed through third-party payment providers [e.g., Stripe, M-Pesa/Safaricom Daraja], who have their own privacy practices.

6. Data Security

• API credentials and passwords are encrypted at rest.
• We use [industry-standard practices — TLS in transit, access controls, etc. — describe your actual setup once built] to protect your data.
• No system is 100% secure; while we take reasonable steps to protect your information, we cannot guarantee absolute security.

7. Data Retention

We retain your account and trading data for as long as your account is active, and for a reasonable period afterward as required for legal, accounting, or dispute-resolution purposes. [Define specific retention period, e.g., "24 months after account closure."]

8. Your Rights

Under the Kenyan Data Protection Act, 2019 (and similar regulations if you serve users elsewhere), you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data (subject to legal retention requirements)
• Withdraw consent for optional data uses (e.g., marketing communications)

To exercise these rights, contact us at [CONTACT EMAIL].

9. Children's Privacy

Candexai is not intended for use by anyone under 18. We do not knowingly collect data from minors.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will record the version and date you accepted at registration, and notify you of material changes.

11. Contact

Questions about this Privacy Policy or your data: [CONTACT EMAIL]

---

By checking "I agree to the Terms of Use and Privacy Policy" during registration, you confirm you have read, understood, and agree to this Privacy Policy.