Privacy Policy

Effective date: 9 May 2026 · NkwaziScope

This Privacy Policy explains how NkwaziScope("we", "our", "the platform") collects, uses, and protects your personal information when you use our portfolio analytics service. We are committed to compliance with the Zambia Data Protection Act 2021 and applicable data protection principles.

1. What Data We Collect

Account data: your email address and name, provided via Google OAuth sign-in.
Portfolio data: investment transactions (ticker, quantity, price, date, type) that you enter manually or that are extracted from uploaded documents.
Uploaded documents: broker deal slips, contract notes, and dividend notices that you choose to upload for automatic data extraction.
Usage data: standard server logs (IP address, request timestamps) retained for up to 30 days for security and debugging purposes.

We do not collect payment card details, national ID numbers, or brokerage login credentials.

2. How We Use Your Data

To provide portfolio analytics — holdings, performance, income, and attribution calculations.
To extract transaction details from uploaded broker documents via AI-assisted parsing.
To calculate and display market data such as LuSE prices and GRZ Bond coupon schedules.
To authenticate your account and maintain session security.

We do not sell your data, use it for advertising, or share it with third parties for their own purposes.

3. Third-Party AI Processing (Google Gemini)

🔒 Privacy Notice

Most uploaded documents are processed entirely on our own servers and never leave them.

If our local parser cannot confidently extract all required transaction details — for example from a scanned or unusually formatted deal slip — the document text may be securely sent to Google's Gemini API to identify any missing fields, such as the ticker, trade date, quantity, or transaction amount.

When this occurs, personally identifiable financial information contained in the document (such as your name, account number, and transaction amounts) is transmitted to Google solely for the purpose of completing the extraction. Google acts as a data processor on our behalf and does not use this information for advertising or to train publicly available AI models.

Documents that our local parser reads successfully — including multi-transaction CSD statements — are never sent to Google.

Only the extracted transaction data is stored in your NkwaziScope account. Original uploaded documents are discarded after processing unless explicitly retained for operational purposes.

By uploading a document and checking the consent checkbox presented at upload time, you acknowledge and agree to this third-party processing.

4. Data Retention

Uploaded files: not retained after parsing is complete. Raw file content is discarded once transaction data has been extracted.
Portfolio and transaction data: retained for as long as your account is active, or until you request deletion.
Account data: retained until you delete your account via Settings.
Regulatory note: certain financial transaction records may be subject to retention obligations under the Zambia Financial Intelligence Centre Act 2010. In such cases, records may be anonymised rather than hard-deleted.

5. Your Rights Under Zambia DPA 2021

You have the right to:

Access the personal data we hold about you (contact us).
Correction of inaccurate or incomplete data.
Deletion — delete your account and all associated data at any time via Settings → Delete Account.
Withdraw consent for AI document processing at any time by not using the document upload feature.

To exercise these rights or for any privacy enquiry, contact us at privacy@zatuwealth.com.

6. Security

Data is transmitted over HTTPS. Passwords are hashed using bcrypt; sessions use short-lived JWT access tokens and HttpOnly refresh cookies. Database access is scoped per user at the PostgreSQL row level.

7. Changes to This Policy

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be announced in the application. Continued use after notice constitutes acceptance.