Privacy Policy

Effective date: 9 May 2026 · NkwaziScope

This Privacy Policy explains how NkwaziScope("we", "our", "the platform") collects, uses, and protects your personal information when you use our portfolio analytics service. We are committed to compliance with the Zambia Data Protection Act 2021 and applicable data protection principles.

1. What Data We Collect

Account data: your email address and name, provided via Google OAuth sign-in.
Portfolio data: investment transactions (ticker, quantity, price, date, type) that you enter manually or that are extracted from uploaded documents.
Uploaded documents: broker deal slips, contract notes, and dividend notices that you choose to upload for automatic data extraction.
Usage data: standard server logs (IP address, request timestamps) retained for up to 30 days for security and debugging purposes.

We do not collect payment card details, national ID numbers, or brokerage login credentials.

2. How We Use Your Data

To provide portfolio analytics — holdings, performance, income, and attribution calculations.
To extract transaction details from uploaded broker documents via AI-assisted parsing.
To calculate and display market data such as LuSE prices and GRZ Bond coupon schedules.
To authenticate your account and maintain session security.

We do not sell your data, use it for advertising, or share it with third parties for their own purposes.

3. Third-Party AI Processing (Google Gemini)

Important: When you upload a broker document, its contents are sent to Google's Gemini API for text extraction and data parsing. This means personally identifiable financial information in those documents (e.g. your name, account number, transaction amounts) is transmitted to Google as a data processor.

Google processes this data solely to complete the extraction task on our behalf, under Google's Gemini API Terms of Service and data processing agreements. Uploaded documents are not retained by NkwaziScope after parsing — only the extracted transaction fields are stored in your account.

By uploading a document and checking the consent checkbox presented at upload time, you acknowledge and agree to this third-party processing.

4. Data Retention

Uploaded files: not retained after parsing is complete. Raw file content is discarded once transaction data has been extracted.
Portfolio and transaction data: retained for as long as your account is active, or until you request deletion.
Account data: retained until you delete your account via Settings.
Regulatory note: certain financial transaction records may be subject to retention obligations under the Zambia Financial Intelligence Centre Act 2010. In such cases, records may be anonymised rather than hard-deleted.

5. Your Rights Under Zambia DPA 2021

You have the right to:

Access the personal data we hold about you (contact us).
Correction of inaccurate or incomplete data.
Deletion — delete your account and all associated data at any time via Settings → Delete Account.
Withdraw consent for AI document processing at any time by not using the document upload feature.

To exercise these rights or for any privacy enquiry, contact us at privacy@nkwaziscope.com.

6. Security

Data is transmitted over HTTPS. Passwords are hashed using bcrypt; sessions use short-lived JWT access tokens and HttpOnly refresh cookies. Database access is scoped per user at the PostgreSQL row level.

7. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be announced in the application. Continued use after notice constitutes acceptance.