Privacy Policy

This policy explains how Nexora (“Nexora”, “we”) handles personal information when you use wealthnexora.com and the services on it. Nexora is the controller of that information: we decide what is collected and why.

Registered entity: [REGISTERED ENTITY NAME], registration number [REGISTRATION NO.], registered at [REGISTERED ADDRESS]. Data protection contact: support@wealthnexora.com.

This policy is drafted against international data-protection standards — the principles common to the GDPR, the UK GDPR and South Africa’s POPIA: collect only what is needed, use it only for the stated purpose, keep it only as long as necessary, secure it, and let people exercise rights over it. Where your local law gives you more, your local law applies.

Account information — name, email address, password (stored only as a cryptographic hash, never in readable form), date of birth, referral code and the sponsor who referred you.

Identity verification (KYC) — full legal name, date of birth, nationality and country of residence, residential address, the type and number of a government-issued identity document, images of that document, and a selfie. This is a special category of information and is handled accordingly. See the KYC & Privacy FAQ for the detail.

Financial and transaction information — deposits, withdrawals, balances, investment packages, earnings, referral and rank rewards, trading activity on the exchange, and the blockchain wallet addresses you supply for payouts. Blockchain transactions are public and permanent by design; we cannot delete or alter them.

Technical information — IP address, device and browser information, and logs of activity on the platform, used for security, fraud prevention and diagnosing faults.

Communications — messages you send to support, and records of the transactional emails we send you.

• To provide the service — running your account, processing deposits and withdrawals, calculating earnings. Basis: performance of our contract with you.
• To verify your identity and meet AML obligations — KYC and customer due diligence, transaction monitoring, record-keeping. Basis: compliance with legal obligations, and our legitimate interest in preventing financial crime.
• To keep the platform and your funds secure — fraud detection, abuse prevention, screening withdrawals for risk. Basis: legitimate interests.
• To communicate with you — transactional email about deposits, withdrawals, verification outcomes and account security. Basis: performance of contract.
• To meet legal and regulatory duties — responding to lawful requests, retaining records. Basis: legal obligation.

We do not sell your personal information. We do not sell or share your identity documents. We do not use your identity documents for advertising or marketing.

We use a small number of service providers. Each processes personal information only to provide its service to us, under contract and on our instructions. This is the complete list of providers that handle personal information:

• Cloudflare (R2) — encrypted storage of your uploaded identity documents and selfie, and of media you post. Documents are served only through short-lived signed links issued to an authorised reviewer.
• Railway — hosting for the application and the database holding your account, transaction and verification records.
• Anthropic — the advisory automated checks. Your identity document and selfie are sent to Anthropic’s Claude when a reviewer runs a document check, and withdrawal and account data are sent when a risk screen is run. Anthropic processes this to return the check result and does not use it to train models.
• NOWPayments — the payment gateway that generates deposit addresses and confirms incoming crypto payments.
• Resend — delivery of transactional email. Receives your email address and the content of that email.

We also read public market data from Binance and CoinGecko to price the exchange. No personal information is sent to them.

We may disclose information to law enforcement, regulators, or professional advisers where we are legally required to, or where it is necessary to establish or defend legal claims.

Our providers operate internationally, so your information may be processed outside your country of residence. Where information leaves a jurisdiction whose law restricts such transfers, we rely on the safeguards available under that law — typically standard contractual clauses or an equivalent mechanism in our agreement with the provider.

• Account and transaction records — for the life of your account and then for the period our anti-money-laundering obligations require. Five years after the end of the customer relationship is the common international standard.
• KYC documents and verification records — the same retention period. Closing your account does not automatically delete them.
• Automated check results — kept with the verification or withdrawal record they annotate.
• Technical and security logs — a shorter period, sufficient for security investigation and diagnostics.

When a retention period ends and no lawful basis for keeping the information remains, it is securely deleted or otherwise disposed of.

Subject to applicable law and our retention obligations, you can ask us to:

• Give you access to the personal information we hold about you
• Correct information that is inaccurate or incomplete
• Delete information where no lawful basis for keeping it remains
• Restrict or object to certain processing, including processing based on legitimate interests
• Provide a copy of the information you gave us, in a portable format
• Withdraw consent, where processing relies on consent

We will not be able to delete records we are legally required to keep, and we cannot alter blockchain transactions. If we refuse a request we will tell you why.

Automated decision-making. Automated checks assist our reviewers but do not decide anything on their own. A person makes every verification and withdrawal decision. You may ask for human review of any outcome and contest it.

Send requests to support@wealthnexora.com. You also have the right to complain to your data-protection authority — in South Africa, the Information Regulator.

We use encryption in transit and at rest, role-based access limited to authorised staff, short-lived signed links for document viewing, hashed passwords, authentication controls on administrative actions, security logging, and incident-response procedures.

No system is perfectly secure. If a breach affects your personal information and creates a risk to you, we will notify you and the relevant authority as required by law.

Nexora is not for anyone under 18. We do not knowingly collect information from children. If we learn that we have, we will delete it.

We will update this policy when our processing changes — including when the Sumsub integration goes live. Material changes will be notified to members. The date at the top shows when this version took effect.