01Who we are
Hentrad is operated by Aloine Technologies Ltd. We are the data controller for the personal data described here. We handle it in line with the Nigeria Data Protection Act 2023.
Data Protection Officer: support@hentrad.com. Contact our Data Protection Officer about anything in this policy, or to use any of your rights.
02What we collect
| Data | Why we need it |
|---|---|
| Full name, username, email address, password (stored only in scrambled, hashed form), country, and your confirmation that you're 18 or over | To create and secure your account and contact you |
| Your place on your country's waitlist, if Hentrad isn't open there yet | To tell you when it opens |
| Referral code you used, if any | To credit the person who referred you |
| Payment references, amounts, the currency you paid in and the exchange rate used (we never see or store your card details) | To confirm fees and keep financial records |
| Lesson progress, evaluation answers and scores | To run your training and decide whether you pass |
| Trades, balances, daily results, levels and badges | To run your trading accounts, enforce the rules and work out profit share |
| Bank name, account name and account number | To pay your profit share. The account number is encrypted. |
| Your trading journal, trading plan and daily check-ins, if you use them | To help you build trading habits; only you and our support team can see them |
| Messages and requests you send us | To answer and keep a record of them |
| Technical data such as IP address, device and browser type, and request logs | To keep the service secure, stop abuse and fix problems |
| The devices you sign in from: a fingerprint of the browser and system type (for example "Chrome on Windows"), with the last IP address and time | To email you when your account is signed in to from a new device |
We collect only what we need for these purposes, and we don't collect sensitive personal data (such as health, religion or biometric data) or your BVN.
We don't use advertising trackers or sell your data. The website and portal don't use analytics cookies. The portal stores a login token in your browser so you stay logged in (logging out removes it), and a few settings on your device, such as your theme and which tips you've already seen.
03Why we're allowed to use it
- To perform our agreement with you: running your account, training, evaluation, trading and payments.
- To meet legal obligations: financial, tax and anti-fraud records.
- Legitimate interests: keeping the platform secure, preventing abuse and improving the programme, in ways you'd reasonably expect.
- Your consent, where we ask for it, such as course reminder emails. You can withdraw consent at any time, for example by turning reminders off under Me.
Automated decisions
Some decisions in the programme are made automatically, by the rules published in the Programme Rules: scoring your evaluation, deciding your verification week, stopping trading at your daily line, and withdrawing a funded account after losing days. These rules are the same for everyone and are set out before you pay. If you think an automated decision about you is wrong, you can ask for it to be reviewed by a person: contact our Data Protection Officer or use Help & contact in the portal, and we'll explain the decision and correct it if it was wrong.
04Public badge checks
When you pass verification you receive a Hentrad badge. Anyone with your badge's link or ID can check on our website that it is genuine and see the details on it: your username (never your full name), your current level, how many profitable weeks you've had, when each level was reached, when the badge was issued, and whether it has been revoked. Please only share your badge with people you're happy to show those details to.
05Who we share it with
We share personal data only with providers who help us run Hentrad, under contracts that require them to protect it, and only as much as each needs:
- Payment provider (Paymish, Nigeria): to take fee payments.
- Email provider (Brevo, European Union): to send verification codes, security notices, receipts and programme emails.
- Have I Been Pwned: when you choose a password, we check it against passwords exposed in known data breaches. Only the first 5 characters of a scrambled (SHA-1) form of the password are sent; the password itself never leaves our servers, and the service can't tell what it is.
- Hosting and database providers (Render and Supabase, servers in Frankfurt, Germany): to run the app and store data.
- Trading infrastructure provider: to show live prices and to place funded-account trades in the market. Trades are placed under Hentrad's own account and include no personal data about you.
- Our bank: to send your profit share payments.
We may also disclose data where the law requires it, for example to regulators, law enforcement or courts, or to protect the rights and safety of our users and the business.
06Data stored outside Nigeria
Your data is stored on servers in Frankfurt, Germany (European Union), and our email provider processes it in the European Union. We transfer data abroad only as the Nigeria Data Protection Act 2023 allows: to countries with an adequate level of protection, such as those covered by the EU's General Data Protection Regulation, and under contracts that require the provider to protect it to the same standard. You can ask our Data Protection Officer for details of these safeguards.
07How we protect it
- Data is sent over encrypted connections.
- Passwords are hashed, and bank account numbers are encrypted when stored.
- Staff access is limited to people who need it and protected by passwords and authenticator codes.
- Changing your password, email or payout account requires your password, and we email you when they change.
- A sign-in from a new device is emailed to you, with a link that logs out every device at once if it wasn't you.
- Passwords found in known data breaches are refused.
- Staff actions in our admin tools, such as approving payouts, are recorded with who did them and when.
No system is perfectly secure. If a breach of personal data is likely to put your rights at risk, we'll report it to the Nigeria Data Protection Commission within 72 hours of becoming aware of it, and tell you promptly, in plain language, what happened and what to do.
08How long we keep it
| Data | How long |
|---|---|
| Account, course, journal, plan, check-ins and messages | While your account is open; deleted when you delete your account |
| Bank details | While your account is open; deleted when you delete your account |
| Payment, payout and trading records | Six years after the year they relate to, as Nigerian tax and company law requires; no longer linked to your name once your account is deleted |
| Sign-in devices and security records | While your account is open; deleted when you delete your account |
| Server request logs | Up to 30 days |
When you delete your account, we first pay any profit or referral share you haven't withdrawn, then delete your personal data and email you to confirm, normally within 30 days of your request.
09Your rights
Under the Nigeria Data Protection Act 2023 you have the right to:
- get a copy of your data: download it any time from your portal;
- correct inaccurate data;
- have your data deleted: request it from your portal;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent where we rely on it;
- complain to the Nigeria Data Protection Commission (NDPC).
If you live outside Nigeria, you may also have rights under the data protection law where you live, and we'll respect them.
To use any other right, email our Data Protection Officer at support@hentrad.com. We may need to confirm your identity, and we'll respond within 30 days. Using your rights is free.
You can complain to the Nigeria Data Protection Commission at any time (ndpc.gov.ng), but we'd appreciate the chance to put things right first.
10Children
Hentrad is only for people aged 18 and over. We don't knowingly collect data from children. If you think a child has registered, tell us and we'll delete the account.
11Changes
We'll update this policy when our practices change and show the date of the latest version at the top. We'll tell you about significant changes in the app or by email.