Paper-first · evidence-first · grade-gated Not financial advice
Makini Strix

Legal · document 2 of 3

Privacy Policy

This policy enumerates what we hold from the actual database schema — table by table — rather than describing it in the abstract. If a thing is not listed in section 2, we do not store it.

Version
2026-07-27.v1
Supersedes
Nothing — first published version
In-app equivalent
None — see 15.2

Outstanding — read before relying on this document

The controller, its registration, its seat and its contact address are stated as facts in section 1, and so is the country the server holding your data sits in — Germany (see 7.1). Nothing in this document is a placeholder any more. One question is still open, and we would rather mark it than let it pass unnoticed.

  • Which data-protection law leads. The backend and the database are in Germany, inside the EU/EEA, so the personal data we hold ourselves does not leave the EEA at all — which materially simplifies the transfer question, and narrows it to the specific outbound flows named in 7.2, 7.3 and 7.5. What it does not settle is the choice of law: we are established in Mozambique (Terms, section 18) while serving users who live in the EU and the UK. Which data-protection law is the primary one for a given user, which supervisory authority hears that user’s complaint, and which transfer mechanism governs the outbound flows are questions that follow from that establishment together with where the user lives — exactly the case where the answer is not obvious. This needs a specialist, not a guess from us.

No Data Protection Officer has been appointed. Whether one is required depends on the analysis above. We have not appointed one and we are not going to imply that we have. Rights requests go to the address in 1.3, which reaches a person.

This document has not yet been reviewed by a qualified lawyer or a privacy specialist. It is complete, specific and meant to be relied on — and it is awaiting professional review.

1 Who we are and what this covers

1.1 The controller of the personal data described here is NM Technology Services & Solutions, trading as NMTSS — a business registered in Mozambique as an empresário individual (individual entrepreneur), an unincorporated business form and not a company — taxpayer number NUIT 112059725, with its registered seat at Av. Capitão Pereira do Lago, nº 1837, 7º Bairro Matacuane, Beira, Sofala, CP 2300, Mozambique. Makini and Strix are its brand names. That registration category describes how the business is registered and nothing else; it has no connection to trading or dealing in financial instruments, which we do not do (Terms, section 2).

1.2 What this covers: the public site and blog at makini.trading, the trading terminal at app.makini.trading, and the backend API and WebSocket service at api.makini.trading. It does not cover your broker, your exchange, or your AI provider — see 6.3.

1.3 Contact for anything in this document, including every rights request in section 9: [email protected]. No Data Protection Officer has been appointed (see the note above); that address reaches a person who can act on the request.

2 Everything we collect

2.1 The table below is the complete inventory, written from the database schema itself. The Where column names the actual tables so that this can be checked against the software rather than taken on trust.

What Exactly Where
Account Username, a bcrypt hash of your password (never the password), account creation time, your email address if you give one, your declared country of residence as a two-letter code, and a pointer to your active AI-provider profile. users
Email verification Your email address, a six-digit one-time code, its expiry, and whether it was used; plus failed-attempt counts and lockout state keyed to the email address. otp_codes, otp_lockout
Broker credentials Per venue: API key, identifier or account id, password or secret, any extra fields that venue’s API requires, and a demo/live flag. Every secret field is encrypted at rest (see section 5). credentials
AI-provider credentials Provider name, an encrypted API key (OpenAI, Gemini, or an AWS access key and secret), region, custom base URL, model name, when the key was last verified, and the list of models it was verified against. llm_credentials, llm_provider_profiles
Your settings Instruments, risk profile, gate settings, policy limits, notification webhook URL, carry-strategy parameters, portfolio allocations, and your Autopilot risk level and declared capital amount. configs, policy_configs, webhook_configs, carry_configs, portfolio_configs, autopilot_configs
Trading records Each trade: time, instrument, direction, size, price, the reason recorded, the model score and confidence at the time, and realised P&L. Each journal entry: entry and exit prices and times, hold duration, P&L, the signals and indicators present at entry, entry and exit reasons, outcome, and — only if you enable AI reflection — a text note generated by your chosen AI provider. trades, trade_journal, performance, risk_state, carry_state, carry_journal, pre_market_analysis
Audit log Your user id, a timestamp, the action, and where relevant the instrument, direction, amount, price and a short detail string. It records compliance acceptances, Autopilot state changes, policy violations, preview orders and similar events. audit_log
Sessions A SHA-256 hash of each issued session token — never the token itself — with when it was issued and expires, the user-agent string your browser sent, the IP address the session was created from, and whether it has been revoked. user_sessions, revoked_tokens
Document acceptances Which document, which version string, when you accepted it, and the IP address the acceptance came from. user_acceptances
Subscription Your tier, subscription status, the end of the current period, the PayPal subscription id, plan id and environment, a last-updated stamp, your monthly quota counters, and the ids of PayPal notifications already processed. entitlements, usage_counters, billing_events
Logs and error reports Server request logs with a correlation id, and — where an unhandled error occurs — a stack trace with request context, sent to our own error tracker (see 6.2). Server filesystem; self-hosted error tracker

2.2 No identity documents, no KYC. We do not ask for your date of birth, home address, national identifier, or any identity document, and we do not collect any special-category data (health, biometrics, political or religious affiliation, and so on). Identity verification for trading is performed by your broker, under their obligations — not by us.

2.3 Your declared country is a declaration. We store the two-letter code you typed. We do not geolocate you, and we do not cross-check it against your IP address.

2.4 One table holds no personal data at all. The research snapshot store (research_snapshots) holds point-in-time market data with no user identifier attached, so it is out of scope for this policy. We mention it so the inventory is genuinely complete rather than selectively complete.

3 What we never collect

3.1 No payment card data, ever. Card numbers, bank details and PayPal login details go directly to PayPal and never reach our servers. We could not produce them if a court asked us to. What we receive back from PayPal is listed in section 2 and is nothing more than identifiers and a status.

3.2 No funds. We hold no money or assets of yours at any point. There is no balance to seize, freeze or lose.

3.3 No sale, no advertising, no data brokers. We do not sell personal data, do not share it with data brokers, do not use it for advertising or profiling, and run no advertising or analytics trackers on any of our surfaces.

3.4 Not used to train models for others. Our forecasting models are trained on market price data, within your own session. Your trades, your journal and your settings are not used to train a model that serves any other user.

4 Why we process it — lawful bases

Purpose Data Basis
Running the Service for you — account, settings, market data, trading, journal, backtests Account, settings, trading records Performance of our contract with you
Connecting to your broker and placing the orders you configured Broker credentials, settings Performance of our contract, carrying out your explicit instruction
Verifying an email address you give us Email, one-time code Performance of our contract (securing your account)
Proving that a risk disclosure was made and accepted before any live-money action Acceptance record with timestamp and IP Our legitimate interest in being able to evidence it; and legal obligation where one applies
Letting you see and revoke your own sessions, and detecting account takeover Session ledger with IP and user-agent Our legitimate interest in the security of the Service and of your account
Investigating incidents, resolving disputes, and showing what the automation actually did Audit log Our legitimate interest in accountability and dispute resolution
Taking payment and enforcing entitlements Subscription records Performance of our contract; legal obligation for accounting records
Keeping the Service working and secure Request logs, error reports Our legitimate interest in operating reliable, secure software

4.1 Marketing. We send no marketing email. The only email we send today is the one-time verification code, and service notices such as a material change to the Terms. If we ever start sending marketing, it will be on your consent, and every message will carry an unsubscribe link.

4.2 Objecting to legitimate interests. Where a data-protection law that gives you the right applies, you may object to any processing above that rests on our legitimate interests. See section 9. Be aware that objecting to the acceptance record or the audit log is effectively a request to close the account, because live trading cannot be offered without them.

5 Credentials: how they are protected and used

5.1 Encrypted at rest. Broker and AI-provider secrets are encrypted with Fernet (AES-128-CBC with HMAC-SHA256 authentication) under a key derived from a server-side secret that lives in the server’s environment — never in the database, never in the source code, never in a client. The stored format is versioned so keys can be rotated without losing access to older records.

5.2 Never shown, never logged. A saved credential is never displayed back to you in full, never written to a log line, and never sent anywhere except to the venue it belongs to.

5.3 Used only to act on your instruction. Decryption happens in memory, at the moment of use, to do one of: open a session with your broker, read your balance and positions, or place, modify or close an order that you or your configured automation asked for.

5.4 Never used to move money. We never use a broker key to withdraw or transfer funds. The software contains no such function.

5.5 Separated from your login. Session tokens are signed with a different key from the one that encrypts credentials, so that compromising one does not yield the other.

5.6 Deleting them. Deleting a broker credential or an AI profile in the app deletes the stored ciphertext. Revoking the key at the venue is separate and remains yours to do — and you should do it.

6 Who else touches your data

6.1 Our infrastructure providers

These four are processors acting for us. They are the complete list.

6.2 Error tracking is not a third party

Our error tracker is Bugsink, which is open-source software that we run ourselves on a server we operate. Stack traces and request context do not go to any error-tracking SaaS. The one third party involved is the company that rents us the machine it runs on — Hetzner Online GmbH, in Nuremberg, Germany — which is a processor for the same reason Contabo is.

6.3 Your broker and your AI provider are your counterparties — not our sub-processors

This distinction is precise and it matters. Capital.com, Binance, Alpaca, OANDA, OpenAI, Google, AWS Bedrock and any other endpoint you configure are parties you chose and you contract with. We have no agreement with any of them about your data. We do not act as their controller or their processor, and they do not act as ours. When Strix sends an order to your broker or a prompt to your AI provider, it is acting as your tool, carrying out your instruction, using your credentials.

The practical consequence: data that reaches them is governed by their privacy policy and your agreement with them, not by this one, and a rights request about that data goes to them. Read their policies before you connect them.

6.4 Other disclosures

We may also disclose personal data:

7 International transfers

7.1 The backend and the database run on a virtual private server rented from Contabo GmbH and located in Germany. The application, the database and the backups we hold ourselves are all on that machine, so the personal data described in section 2 sits inside the EU/EEA and does not leave it on our own infrastructure. The flows that do go elsewhere are named individually in 7.2, 7.3 and 7.5 below.

7.2 The site and the terminal are served from Cloudflare’s global network, so the request is handled at the edge location nearest you, wherever that is.

7.3 Verification email is sent through AWS SES configured in the us-east-1 region. That means your email address and the verification code are processed in the United States. If you would rather that did not happen, do not give us an email address — the app does not require one.

7.4 Error reports stay on our own server in Germany (6.2).

7.5 PayPal processes payment data on its own global infrastructure under its own policy.

7.6 Safeguards. Where a transfer leaves the jurisdiction whose law protects you, we rely on the data-processing terms and standard contractual clauses each provider publishes for that purpose. Which set governs depends on the data-protection law that applies to you and on our establishment in Mozambique — an analysis that is the outstanding item at the top of this page.

8 How long we keep things

8.1 The table below states our retention policy and, honestly, whether the software enforces it automatically or a human does it. We say which, because “we delete it after X” means two different things depending on the answer.

Data Kept for Enforced
Session ledger and revoked tokens Until the token expires — 24 hours after issue by default Automatically, by the software
One-time email codes Valid for 10 minutes; invalidated on use or when a new one is issued. The spent row stays until the account is deleted. Expiry automatic; row removal at account deletion
Processed payment-notification ids 90 days Automatically, by the software
Account, settings, credentials While the account exists; deleted within 30 days of a confirmed closure request By us, on request
Trades, journal, performance and carry records While the account exists, then deleted with it. Export before you close. By us, on request
Document acceptances and audit log Six years after the event or after account closure, whichever is later By us — this is a retention commitment, not an automatic job
Billing records As long as the accounting and tax law of our jurisdiction requires, commonly six to seven years By us
Server request logs Rotated by the operating system on the server Automatically
Error reports Only as long as needed to diagnose and fix the fault By us

8.2 Why acceptances and the audit log outlive your account. They are the evidence that a risk disclosure was made before real money moved, and the record of what the automation did with it. If a dispute about a live trade arises after you have left, those two records are the only way either of us can reconstruct what happened. Keeping them protects you as much as us.

9 Your rights, and how to use them

9.1 Depending on where you live, you may have the right to access your data, to have it corrected, to have it erased, to restrict or object to processing, to receive it in a portable form, to withdraw a consent you gave, and to complain to a data-protection authority. We honour these requests for everyone who asks, regardless of whether the law in your country compels us to.

9.2 What you can do yourself, right now, in the app

9.3 What still requires a human — and we would rather say so

There is no self-service “delete my account” button yet. Building one is on our backlog. Until it exists, write to [email protected] from the email address on your account, or tell us the account name and act from a signed-in session so we can confirm it is you. We will confirm receipt, complete the deletion within 30 days, and tell you when it is done. A full account export beyond the journal and audit-log exports is also a manual request today.

9.4 Identity checks. Before we act on a request we may ask you to prove control of the account — by writing from its registered email address, or by performing an action inside a signed-in session. We will not ask you for an identity document: we do not hold one, so we could not match it against anything.

9.5 Response time. Within 30 days. If a request is genuinely complex we will tell you why and give you a date, rather than going quiet.

9.6 No charge, and no retaliation. Exercising a right costs nothing and does not degrade your service. We may decline or charge for a request that is manifestly excessive or repetitive, and if we do we will say exactly why.

9.7 Complaints. Tell us first at the address in 1.3 — we would rather fix it. You also have the right to complain to the data-protection authority where you live or where we are established. Which authority supervises us depends on the establishment jurisdiction — the outstanding item at the top of this page.

9.8 Your broker and your AI provider. Rights requests about data held by them go to them, not to us (6.3). We cannot access, correct or delete anything inside your broker account.

10 Cookies and browser storage

10.1 The public site sets no cookies and runs no analytics, advertising, or tracking scripts of any kind. There is no consent banner because there is nothing to consent to. Fonts are served from our own domain rather than a font CDN, so reading this page tells no third party that you did.

10.2 The terminal sets no cookies either. It stores four items in your browser’s local storage, all of them functional:

Clearing your browser storage signs you out and resets those two preferences. Nothing else is stored on your device.

10.3 Cloudflare’s own cookie. Cloudflare serves these domains and may set its own security cookie — for example __cf_bm — as part of bot mitigation. That is set by Cloudflare’s network rather than by our code, and is described in Cloudflare’s own documentation.

10.4 There is no cross-site tracking, no third-party pixel, no advertising identifier, and no session-replay recording of what you do on screen.

11 Security — including its limits

11.1 What we do:

11.2 What we do not have. We hold no security certification — no ISO 27001, no SOC 2 — and we do not claim one. We are a small operation running a single application server. Nothing here is the security posture of a bank, and we would rather you size that accurately than assume it.

11.3 Your part. Use a unique password. Scope broker API keys as narrowly as your venue allows and never grant withdrawal permission. Revoke sessions you do not recognise. Stay in demo until you have your own evidence.

12 If there is a breach

12.1 If a breach of personal data occurs and is likely to result in a risk to you, we will notify you without undue delay and in any event within 72 hours of becoming aware of it — by email to the address on your account, or in the app if we hold no email address. The notice will say what happened, which data was involved, what we have done, and what you should do.

12.2 The credential case, specifically. If there is any possibility that stored broker or AI credentials were affected, we will disable the affected credentials on our side and the notice will tell you to revoke and rotate those keys at your venue immediately. We will not wait for certainty before telling you that.

12.3 Where a supervisory authority must be notified, we will notify it within the period its law requires.

13 Children

13.1 The Service is not for anyone under 18. We do not knowingly collect personal data from a child. If we learn that we have, we delete the account and its data.

13.2 If you believe a child has created an account, tell us at [email protected] and we will act on it.

14 Automated decisions

14.1 The Service makes automated decisions inside your own account: the trading agent places orders according to the configuration you set, and the grade and decay gates decide whether a strategy may be allocated real money.

14.2 These decisions operate on market data and on strategy evidence, within limits you chose. They do not profile you as a person, do not score your creditworthiness or character, and produce no legal effect on you of the kind that automated-decision rules are aimed at. They affect your trading, which is the entire point of the software.

14.3 You can stop them at any moment — the kill switch, disabling auto-trading, or returning the Autopilot to paper — and none of those actions is ever gated by payment or paperwork.

15 Changes, and contact

15.1 This policy is versioned and dated. This is version 2026-07-27.v1. When we change it materially we will publish the new version here, tell you in the app, and email you where we hold an address for you.

15.2 This document is not part of the in-app acceptance gate. The Terms of Service and the Risk Disclosure are: the app records your acceptance of each of them by version, and a version bump re-arms that gate. This policy is not gated that way, because consent is not the basis on which we process most of what is described here — see section 4. We are telling you that rather than implying an acceptance record that does not exist.

15.3 Contact. NM Technology Services & Solutions (NMTSS), Av. Capitão Pereira do Lago, nº 1837, 7º Bairro Matacuane, Beira, Sofala, CP 2300, Mozambique. For anything in this policy, including a rights request: [email protected].

The other two documents: Terms of Service Risk Disclosure