We respect your privacy and are committed to protecting your personal data. This policy explains your privacy rights and how your information is handled in accordance with the EU General Data Protection Regulation (GDPR) and the Kenya Data Protection Act 2019.
Effective Date: September 1, 2026 · Last Updated: September 2026
CJ Smart Finance operates this platform and acts as the Data Controller for your personal information. We are registered in Nairobi, Kenya, providing financial market data, AI-driven stock research tools, and investor educational materials.
Under Article 5 of the EU GDPR and Section 3 of the Kenya Data Protection Act 2019, personal data must be processed in accordance with strict principles. We pledge that:
Lawfulness & Fairness
Data is collected transparently and strictly with lawful basis.
Purpose Limitation
Used exclusively for market intelligence and agreed account services.
Data Minimization
We only request data strictly required to provide our tools.
Accuracy
We keep your information current and allow effortless profile updates.
Storage Limitation
Data is retained only as long as necessary for platform service.
Integrity & Security
Protected with cryptographic safeguards and access controls.
3. Personal Data We Collect
We collect information when you register, use our AI tools, interact with community forums, or contact our support team:
Identity & Account Data: Full name, email address, password hash, profile avatar, and account preference settings.
Investment & Watchlist Data: Tickers you add to your watchlist, portfolio assets tracked (simulated or real entry values), and notifications requested.
Payment & Subscription Data: Subscription tier (Free or Pro), transaction references, billing history. Important: Payment card numbers and M-Pesa mobile PINs are processed directly by certified third-party payment gateways (e.g., Paystack, Flutterwave, or Safaricom Daraja) and are never stored on CJ Smart Finance servers.
Technical & Usage Data: IP address, device identifier, browser type, operating system, pages visited, time spent on market charts, and interaction telemetry.
Communications: Feedback submissions, support inquiries, community forum posts, and newsletter subscription records.
4. Lawful Bases for Processing (GDPR & KDPA)
We process personal data only when a recognized lawful basis applies under GDPR Article 6 and Section 30 of the Kenya Data Protection Act 2019:
1. Performance of a Contract
Processing required to deliver your requested services, authenticate your login, calculate portfolio performance, and provide AI stock signals.
2. Consent
Explicit consent obtained for non-essential cookies, email newsletters, marketing communications, and community public profile sharing. You can revoke consent at any time.
3. Legitimate Interests
Securing our platform against malicious attacks, preventing abusive automated scraping, analyzing aggregate performance to improve algorithm accuracy, and ensuring platform reliability.
4. Legal Obligation
Compliance with statutory tax accounting, anti-fraud regulations, and lawful requests by regulatory bodies or law enforcement agencies.
5. How We Use Your Information
Your personal data is used to provide, personalize, and improve our services:
Delivering automated AI stock insights and NSE market analysis
Managing user authentication, sessions, and Pro subscription entitlements
Tracking your customized stock watchlists and simulated portfolios
Providing customer support and responding to platform inquiries
Ensuring uptime, network security, and fraud prevention
Sending important platform security notices and system announcements
We Never Sell Your Data:CJ Smart Finance does not sell, rent, or trade your personal data to third-party data brokers, marketers, or advertisers under any circumstances.
6. Third-Party Sharing & International Transfers
We work with trusted infrastructure partners to host our servers, process payments, and provide email notifications. These providers act as Data Processors bound by strict data processing agreements:
Cloud Hosting & CDN: Vercel, Supabase, AWS, or DigitalOcean servers equipped with modern firewalls and high-grade encryption.
Payment Processors: PCI-DSS compliant providers handling subscription processing via M-Pesa or credit/debit cards.
Transactional Email: Services delivering account verifications and password reset links.
Where data is transferred outside the European Economic Area (EEA) or Kenya, we ensure appropriate safeguards are enacted, such as the European Commission Standard Contractual Clauses (SCCs) and equivalent adequacy measures recognized under Kenyan law.
7. Data Retention & Security Measures
We implement robust technical and organizational security controls:
Transport Layer Security (TLS 1.3/HTTPS) on all API endpoints and web traffic.
Bcrypt password hashing with unique salt values.
JWT authentication tokens with secure expiration lifespans.
Automated vulnerability scans and database encryption at rest.
We retain personal data for as long as your account remains active. If you delete your account, we securely erase or anonymize your personal records within 30 days, except where retention is mandated by law (such as tax invoices).
8. Your Rights Under GDPR & Kenyan Law
Under Chapter III of the GDPR and Part IV of the Kenya Data Protection Act 2019, you hold fundamental privacy rights:
Right of Access
Request a copy of all personal data held about you.
Right to Rectification
Correct inaccurate or incomplete profile data directly or via support.
Right to Erasure ("Right to Be Forgotten")
Request deletion of your account and personal history.
Right to Restriction of Processing
Ask to freeze processing while verifying accuracy or objections.
Right to Data Portability
Receive your data in a structured, machine-readable format (JSON/CSV).
Right to Object
Object at any time to direct communications or legitimate interest processing.
How to exercise your rights:
To exercise any of these rights, email us at privacy@cjsmartfinance.com. We respond to all requests within 30 days without charge. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya or your local European Data Protection Authority.
9. Cookies & Local Storage
Our site uses local storage and cookies essential for platform security and functionality:
Essential Tokens: Storing cj_token to keep you signed in securely across page reloads.
Preference Cookies: Remembering your chart view preferences and dark theme selection.
Anonymous Analytics: Aggregate statistics to understand which tools provide the most value without profiling individual users.
You can control cookie settings through your browser preferences. Disabling essential storage may prevent you from logging in to your CJ Smart Finance account.
10. Minors & Children’s Privacy
CJ Smart Finance is intended exclusively for users aged 18 and older. We do not knowingly solicit or collect personal information from individuals under the age of 18. If we learn that we have inadvertently collected data from a minor, we will promptly delete that information from our records.
11. Policy Updates & Contact
We may periodically revise this Privacy Policy to reflect regulatory modifications or platform enhancements. When substantial changes occur, we will notify you through an account dashboard banner or email.
