Nhantsi Capital Trading (Pty) Ltd · Trading Journal
Privacy Policy
1. Who we are #
1.1 This Privacy Policy explains how Nhantsi Capital Trading (Pty) Ltd, registration number 2024/615022/07 ("we", "us", "our") processes personal information when you use the Trading Journal at journal.nhantsicapitaltrading.com (also at nhantsi-trading-journal.vercel.app) and related services (the "Journal").
1.2 We are the "responsible party" for your personal information under the Protection of Personal Information Act, 4 of 2013 ("POPIA"). If you are in the European Economic Area or the United Kingdom, we are also the "controller" under the EU or UK General Data Protection Regulation ("GDPR"), and this Policy is designed to meet those requirements as well.
1.3 Our Information Officer is Nqaba Nhantsi, Chief Executive Officer. You can contact the Information Officer at nqaba@nhantsicapitaltrading.com, on +27 76 887 0951, or at 277, Metropolitan Office Park, 281 Cape Rd, Greenacres, Gqeberha, 6001.
1.4 This Policy covers the Journal. Purchases from our website shop (for example our books) may be covered by a separate notice on that website.
1.5 Our PAIA Manual, prepared in terms of section 51 of the Promotion of Access to Information Act, 2 of 2000 ("PAIA"), explains how to request access to records we hold. It is also available as a PDF.
2. Personal information we collect #
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Name, email address, role (member or administrator), account status, invitation and sign-in dates. Your password is stored by our authentication provider only in hashed form, so we cannot read it. | You; the Administrator who invites you |
| Legal acceptance records | Which version of the Terms and Privacy Policy you accepted, the date and time, and your browser type | Generated when you accept |
| Trade data | Trading accounts and their labels, brokers, instruments, direction, entry and exit times and prices, size, stop-loss and take-profit levels, profit and loss, commissions and swaps, setups, tags, ratings, emotions, mistakes, rules followed, goals and prop-firm progress | You, by manual entry, file import, or automatic sync from a connected broker account |
| Connected broker accounts | Broker name, account number, server name, platform (MT4 or MT5), label, account type (live, demo or prop), chosen sync method, last-sync time and status, and open-position summaries used only for status. A per-account sync key for the free Nhantsi Sync Expert Advisor is shown to you once and stored by us only as a one-way hash, which we can revoke or replace. We do not store your broker master or investor password. | You, when you connect an account |
| Journal notes | Daily journal and notebook entries, trade notes, playbooks and any other free text you write | You |
| Screenshots | Images you upload, which may show charts, platform windows or account details | You |
| Uploaded candle files | Price-history (OHLC) files you upload, for example exports from TradingView or your broker, together with file names and metadata | You |
| Pine Scripts and strategies | Scripts, strategy settings, inputs, backtest results, chart drawings, indicator settings and templates | You |
| Usage and technical logs | Server request logs (IP address, browser and device type, date and time, pages and API routes requested); authentication logs (sign-ins, password resets); script-run logs (outcome, language functions used, run time, number of bars and trades, instrument and timeframe — not your code) | Generated automatically by our systems and service providers |
| Communications | Emails and support requests you send us, and our replies | You |
| Billing data (Paid Plans) | Plan, billing period, amounts, invoices, payment status, and a payment reference or token. Card details are collected and stored by Yoco, not by us. | You; Yoco |
2.1 We do not ask for, and you should not enter, identity numbers, banking details, your master (trading) broker password, or "special personal information" (for example health, religious, biometric or criminal information). If you include such information in free text or screenshots, we process it only to store and display it to you and Administrators, and you can delete it at any time.
2.1A If we have enabled the optional MetaApi connection and you choose to use it, you give us your investor (read-only) password so that we can pass it to MetaApi to read your deal history. We do not store that password in our database, and we never return it to your browser or to Administrators. You can disconnect the account at any time. Prefer the free Nhantsi Sync Expert Advisor if you do not want to provide a broker password at all.
2.2 You can use the Journal only if you provide account data. Everything else you add is optional, but some features will not work without it.
3. How we use your information and our lawful basis #
| Purpose | Lawful basis (POPIA section 11; GDPR article 6) |
|---|---|
| Creating and managing your account, signing you in, and providing the Journal's features (journaling, statistics, replay, backtesting, scripts, charts) | Performance of our agreement with you (POPIA s11(1)(b); GDPR art. 6(1)(b)) |
| Administrator support, coaching and oversight (section 6) | Performance of our agreement; our legitimate interest in supporting members and protecting the Service (s11(1)(b) and (f); art. 6(1)(b) and (f)) |
| Keeping the Journal secure, preventing abuse and fraud, enforcing our Terms and limiting misuse of scripts | Legitimate interests; compliance with law (s11(1)(c) and (f); art. 6(1)(c) and (f)) |
| Diagnosing errors and improving reliability, including compatibility statistics from script-run logs | Legitimate interests (s11(1)(f); art. 6(1)(f)) |
| Recording your acceptance of the Terms and this Policy | Legal obligation and legitimate interests (s11(1)(c) and (f); art. 6(1)(c) and (f)) |
| Service emails (sign-in links, invitations, security, billing and policy-change notices) | Performance of our agreement (s11(1)(b); art. 6(1)(b)) |
| Billing, invoicing and tax records (Paid Plans) | Performance of our agreement; legal obligation (s11(1)(b) and (c); art. 6(1)(b) and (c)) |
| Marketing about our products and programmes | Your consent, or, for existing customers, similar products in line with POPIA section 69(3). You can opt out at any time. |
| Establishing, exercising or defending legal claims | Legitimate interests; legal obligation |
3.1 We do not sell or rent personal information. We do not use advertising cookies, third-party analytics or tracking pixels in the Journal.
3.2 We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
3.3 We use information only for the purposes above or for compatible purposes, as POPIA section 13 and the GDPR require. If we want to use it for a new purpose, we will tell you first and, where needed, ask for your consent.
4. Where we get your information #
Most information comes directly from you. The Administrator who invites you provides your name and email address. If you connect a broker account, closed-trade details also come from your platform through the Nhantsi Sync Expert Advisor you run, or — when we have enabled it and you have chosen it — through MetaApi acting as our operator for read-only access. Our service providers generate technical logs when you use the Journal, and our payment provider confirms payments. We do not buy personal information from data brokers.
5. Market data #
To show charts, our servers request historical prices from third-party market-data sources such as Dukascopy. These requests contain only instrument and time-range parameters, not your personal information. Price files you upload are stored privately in your account (section 2).
6. Administrator access to member journals #
6.1 Administrators of the Journal can view your account details and everything in your journal in read-only form: trades, notes, notebook entries, screenshots, uploaded files, scripts, chart drawings, reports, script-run logs, and the labels and status of any connected broker accounts. They can also see when you were invited and last signed in, and can suspend or restore your account. They cannot see your sync keys, key hashes, or any broker password.
6.2 Administrators use this access only to provide support, to give feedback or coaching where you take part in our programmes, to protect the Service, and to investigate breaches of our Terms. They cannot edit or delete your content through this view. Access is technically restricted to authorised administrator accounts and enforced by database security rules.
7. Who we share information with #
We share personal information only as needed for the purposes in section 3:
- Operators (service providers) that process information on our behalf under written agreements requiring confidentiality and security, as POPIA sections 20 and 21 require:
- Supabase, Inc. — database, authentication and file storage. Our project is hosted in Supabase's London (United Kingdom) region.
- Vercel Inc. (United States) — hosting and content delivery of the web application through a global network, including server request logs.
- Resend (United States) — delivery of invitation, sign-in and service emails.
- Google LLC (Google Fonts) — the Journal loads fonts from Google's servers, so your browser sends your IP address and browser information to Google when pages load.
- Yoco Technologies (Pty) Ltd (South Africa, registration number 2013/203377/07) — processes card payments for Paid Plans as our operator (processor) under POPIA. We do not receive or store your card number, expiry date or CVV. Yoco processes that payment information on our instructions, and also under its own terms and privacy policy.
- MetaApi (metaapi.cloud) — only when we have enabled this option on the server and you choose to connect a broker account that way. MetaApi is then our operator (processor) for read-only access to that account's deal history. We send MetaApi the login, server and investor password you provide; we do not store the password. Synced trades are then stored in your journal like any other trade. You can disconnect at any time. MetaApi's own terms and privacy notice apply to their processing, and their infrastructure may be outside South Africa (see section 8).
- Administrators, as described in section 6.
- Professional advisers, such as attorneys and accountants, under confidentiality obligations.
- Authorities, such as courts, regulators and law-enforcement agencies, when the law requires it or when it is needed to protect rights, property or safety.
- A successor business, if our business or the Journal is sold or restructured, subject to this Policy.
We do not share your journal with other members.
8. Cross-border transfers #
8.1 Your information is stored and processed outside South Africa: in the United Kingdom (Supabase, London region), in the United States (Vercel, Resend, Google, and MetaApi when that option is enabled and you use it), and in other countries where these providers or their sub-processors operate, including Vercel's global edge network and the MetaApi region chosen for a connection.
8.2 Under POPIA section 72, we transfer information only where (a) the recipient is subject to law, binding corporate rules or a binding agreement that provides an adequate level of protection substantially similar to POPIA, or (b) the transfer is necessary to perform our agreement with you. Our providers commit to data-processing terms, including, where applicable, the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum.
8.3 For members in the EEA or UK, transfers to countries without an adequacy decision rely on these safeguards. You may ask us for more information about them.
9. Cookies and local storage #
The Journal uses only cookies and browser storage that are needed for it to work, or that remember choices you make:
| Name | Type | Purpose | Duration |
|---|---|---|---|
sb-…-auth-token (may be split into several parts) | Cookie (essential) | Keeps you signed in securely | Until you sign out or the session expires |
tj-theme | Local storage | Remembers your theme and light/dark choice | Until you clear it |
tj-chartkit | Local storage | Remembers drawing-tool preferences (for example the magnet setting) | Until you clear it |
We do not use advertising, analytics or cross-site tracking cookies. If you block essential cookies, you will not be able to sign in. You can clear local storage in your browser settings at any time.
10. How long we keep information #
| Information | Retention |
|---|---|
| Account data, trade data, connected broker accounts, journal notes, screenshots, uploaded files, scripts and chart settings | For as long as your account exists. You can delete individual items, or disconnect a broker account, at any time. Disconnecting keeps already-synced trades unless you delete them. |
| After you ask us to close your account | Deleted from our live systems within 30 days (after any export period agreed with you). Copies in encrypted backups are deleted as backups expire, normally within a further 30 days. |
| Legal acceptance records | For as long as your account exists |
| Script-run logs | Up to 12 months, then deleted or anonymised |
| Server, security and authentication logs | According to our providers' retention periods, normally no longer than 90 days |
| Billing and tax records | 5 years, as required by the Tax Administration Act, 28 of 2011 |
| Support correspondence | Up to 3 years after the matter is closed |
We may keep information for longer where the law requires or permits it (POPIA section 14), for example to deal with a dispute. Anonymised information that can no longer identify you may be kept for statistics.
11. How we protect your information #
11.1 As POPIA section 19 requires, we take appropriate and reasonable technical and organisational measures to protect personal information, including:
- encryption in transit (HTTPS/TLS) and encryption at rest by our hosting and database providers;
- database row-level security, so that each member can access only their own records, while Administrators have read-only access;
- private file storage, with each member's files kept in a separate folder protected by access rules;
- server-side secrets that are never sent to your browser, and least-privilege access for our personnel;
- password hashing, single-use sign-in links and suspension of access when needed; and
- sandboxing and time limits for scripts run in the Journal.
11.2 No system is completely secure. Please use a strong, unique password and keep your sign-in links private.
12. Security compromises (data breaches) #
If we have reasonable grounds to believe that your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator through its eServices portal and notify you in writing, as soon as reasonably possible, as POPIA section 22 requires. We will explain what happened, its possible consequences, what we are doing about it, and what you can do to protect yourself. Where the GDPR applies, we will also notify the relevant supervisory authority within 72 hours where required.
13. Your rights #
Subject to the law, you have the right to:
- be informed that your personal information is being collected, and when it has been accessed by an unauthorised person;
- access your personal information and ask what information we hold and who has had access to it (POPIA section 23);
- correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or unlawfully obtained, or that we are no longer authorised to keep (POPIA section 24);
- object, on reasonable grounds, to processing based on our legitimate interests, and object at any time to direct marketing (POPIA section 11(3));
- withdraw consent where processing is based on consent, without affecting earlier processing;
- not receive unsolicited electronic marketing unless you have consented or are an existing customer (POPIA section 69);
- data portability: receive your data in a structured, commonly used format. You can export your trades from the Journal yourself at any time;
- under the GDPR, where applicable, restrict processing and not be subject to decisions based solely on automated processing; and
- complain to the Information Regulator or, in the EEA or UK, to your local data-protection authority (section 14).
13.1 How to make a request. Email nqaba@nhantsicapitaltrading.com, or contact us by post, WhatsApp or any other reasonable means. We may ask you to verify your identity. Objections and requests to correct or delete information are free of charge, as the POPIA Regulations require. A request by you for your own personal information (POPIA section 23) is free. Formal requests for access to records under PAIA should follow the procedure in our PAIA Manual, using the prescribed Form 2. Where PAIA prescribes a fee for a request or for copies of records, we will tell you before any fee is charged. We will respond within a reasonable time, and in any event within 30 days (or one month under the GDPR), unless the law allows an extension, in which case we will tell you why.
14. The Information Regulator #
If you are not satisfied with how we handle your personal information, please contact our Information Officer first. You also have the right to lodge a complaint with the Information Regulator (South Africa):
- Website: inforegulator.org.za
- Online complaints (POPIA Form 5): eservices.inforegulator.org.za
- Email: enquiries@inforegulator.org.za
- Telephone: 010 023 5200
- Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg · P.O. Box 31533, Braamfontein, Johannesburg, 2017
15. Children #
The Journal is intended only for people aged 18 or older. We do not knowingly collect personal information of children (persons under 18, as defined in POPIA). If we learn that a child has created an account, we will close it and delete the child's information. If you believe a child has given us information, please contact us.
16. Third-party links #
Charts in the Journal carry a TradingView attribution link, and the Journal may link to other websites. If you follow these links, the other site's privacy policy applies, and we are not responsible for it.
17. Changes to this Policy #
We may update this Policy from time to time. The "Last updated" date and version at the top show when it last changed. We will notify you of material changes by email or in the Journal before they take effect, and will ask you to review the updated Policy when you next sign in.
18. Contact us #
Information Officer, Nqaba Nhantsi (Chief Executive Officer), Nhantsi Capital Trading (Pty) Ltd · nqaba@nhantsicapitaltrading.com · +27 76 887 0951 · 277, Metropolitan Office Park, 281 Cape Rd, Greenacres, Gqeberha, 6001 · nhantsicapitaltrading.com · PAIA Manual