Confluovest ("Confluovest," "we," "us") is a portfolio tracking service operated by Omareon Labs Limited, a company registered in Nigeria. This policy explains what personal data we collect, why, how we protect it, and the rights you have over it. It applies to confluovest.com and the Confluovest web application.
We process personal data in accordance with the Nigeria Data Protection Act, 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR).
What we collect
Account information. Your name, email address, password (stored only as a cryptographic hash), and preferences such as your base currency.
Financial account data you connect or upload. When you connect an exchange with read-only API keys, we collect the balances, holdings, and transaction history those keys expose. When you upload a CSV file, we collect its contents (holdings and transactions) and the source label you give it. We never collect the login credentials of any investment platform.
API keys. Read-only API keys you provide are stored encrypted (AES-256). They are used solely to fetch your account data on your behalf.
Usage and technical data. Log data (IP address, browser type, pages viewed, timestamps) and privacy-respecting product analytics used to understand and improve the service.
Payment data. If you subscribe to Pro, payments are processed by our payment provider; we receive confirmation of payment and subscription status, not your full card details. [PLACEHOLDER: name provider once selected]
What we use it for
We use your data to: provide the service (aggregate, normalize, and display your portfolio); convert values between currencies using market rates; process CSV files you upload, including automated column detection (see Section 3); operate your subscription and free-tier limits; send service communications (sync failures, import warnings, security notices); improve the product using aggregate usage patterns; and comply with legal obligations.
Lawful bases. We rely on contract performance (providing the service you signed up for), your consent (where required, e.g. optional communications), and legitimate interests (service security, improvement) as recognized under the NDPA.
Automated CSV processing (AI)
When you upload a CSV, a sample of its rows is processed by a third-party AI service (Anthropic) to detect which columns contain symbols, quantities, prices, dates, and fees. This processing exists solely to map your file's format; the proposed mapping is always shown to you for review before any data is imported. AI providers we use are contractually restricted from using your data to train their models. [PLACEHOLDER: verify current Anthropic API data-use terms at launch]
What we never do
We do not sell your personal data. We do not share your portfolio data with advertisers. We do not use your data to trade, and we could not — Confluovest holds read-only access only. Where the product surfaces partner platforms through referral links, clicking is always your choice, and partners never receive your portfolio data — at most they know you arrived via Confluovest.
International transfers
Some of our service providers (e.g. cloud hosting, AI processing) operate outside Nigeria. Where personal data leaves Nigeria we take steps to ensure an adequate level of protection consistent with the NDPA, including contractual safeguards.
Retention
Your data is retained while your account is active. If you delete a connected source, its stored API key is deleted immediately. If you delete your account, your profile and portfolio data (sources, holdings, transactions, imports, reports, snapshots) are permanently deleted, save for minimal records we are legally required to keep (e.g. payment records) and short-lived encrypted backups that expire on a fixed schedule.
Your rights
Under the NDPA you have the right to access the personal data we hold about you; correct inaccurate data; delete your data (right to erasure); receive a portable copy (your holdings and transactions are exportable in-app as CSV at any time); object to or restrict certain processing; and withdraw consent where processing is based on consent. To exercise any of these, email privacy@confluovest.com or use the in-app controls. We respond within the timelines the NDPA prescribes. You also have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC).
Security
We protect your data with encryption in transit (TLS) and at rest (AES-256 for API keys), hashed passwords, access controls, and audit logging of administrative actions. No method of storage or transmission is completely secure; if a breach affects your personal data, we will notify you and the NDPC as required by law. Details: confluovest.com/security.
Children
Confluovest is not directed at anyone under 18, and we do not knowingly collect data from minors. If you believe a minor has created an account, contact us and we will delete it.
Changes
We will post any changes to this policy here and update the date above. For material changes, we will notify you by email or in-app before they take effect.
Contact
Data controller: Omareon Labs Limited, [PLACEHOLDER: registered address], Lagos, Nigeria. Privacy contact: privacy@confluovest.com.