Privacy Policy

Last updated: 19 October 2026

Panda Card is operated by Solforeyx, a company registered in Nigeria. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights. If you do not agree with this policy, do not use Panda Card.

1. Who We Are

Data Controller: Solforeyx

Contact: hello@solforeyx.com

Product: Panda Card — available at pandacard.solforeyx.com

2. What Data We Collect

2.1 Data you provide

Account data: full name, email address, username, country, date of birth, phone number (optional), address (optional).
Security data: hashed password, 4-digit transaction PIN (hashed), device and IP information for fraud prevention.
Financial data: deposit and earnings balances, transaction history, bank account details (bank name, account name, account number), withdrawal history.
Referral data: referral code, referral history, users you have invited.
Support data: messages and emails sent to our support team.

2.2 Data we collect automatically

Device type, browser, operating system
IP address and approximate location
Pages viewed, actions taken, and time spent in the app
Cookies and local storage items (see Section 8)

2.3 Data from third parties

Identity verification information from our payment partners (Paystack, Flutterwave) when you deposit or withdraw
Fraud signals from anti-fraud providers

3. Why We Collect Your Data

To provide the service — create your account, process trades, mining, deposits, withdrawals.
To keep the marketplace fair — detect fraud, self-trading, and manipulation.
To comply with the law — Nigerian financial regulations, anti-money laundering (AML) rules, and tax obligations.
To improve the app — understand how users interact, fix bugs, and build features.
To communicate with you — support replies, transaction receipts, security alerts, and (if you opt in) product updates.

4. Who We Share Your Data With

4.1 Service providers

Supabase — database, authentication, and file storage (EU/US data centers)
Paystack — payment processing for Nigeria
Flutterwave — payment processing for international cards
Render — website hosting
Microsoft / Google — translation services (only the visible text is sent, never your personal data)

4.2 When required by law

We may disclose your data when required by court order, subpoena, or by Nigerian authorities (EFCC, CBN, FIRS, SEC) acting under their legal powers.

4.3 Business transfers

If Solforeyx is acquired, merges with another company, or transfers its assets, your data may transfer as part of that transaction. You will be notified before this happens.

4.4 What we never do

We never sell your personal data to advertisers
We never share your bank details with other users
We never display your email or phone number publicly

5. How Long We Keep Your Data

Active accounts: as long as your account is open.
Closed accounts: 30 days after you request deletion (recovery window), then permanently deleted from active systems. Financial transaction records are retained for 7 years to comply with Nigerian tax and AML law.
Dormant accounts: deleted after the inactivity periods described in our Terms.
Support messages: 24 months.
Fraud signals: up to 5 years.

6. Your Rights (NDPA and GDPR)

Under the Nigerian Data Protection Act (NDPA) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:

Access — request a copy of your personal data
Correction — ask us to fix inaccurate data
Deletion — ask us to delete your account and data (subject to legal retention)
Restriction — ask us to stop processing your data in certain ways
Portability — request your data in a machine-readable format
Objection — object to certain types of processing
Withdraw consent — where processing is based on consent, withdraw at any time
Lodge a complaint — with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng

To exercise any of these rights, email hello@solforeyx.com from your registered email. We respond within 30 days.

7. Data Security

We protect your data with:

HTTPS encryption on all connections
Hashed passwords and PINs (never stored in plain text)
Row-level security on our database — you can only read and write your own records
Server-side validation of all financial transactions
Regular security reviews

Despite our best efforts, no system is 100% secure. If you suspect your account is compromised, change your password and email us immediately.

8. Cookies and Local Storage

Panda Card does not use advertising cookies or third-party trackers. We use:

Local storage — to remember your language preference, dark mode setting, sound preference, and (in Demo Mode) your local demo account data.
Session cookies — to keep you logged in during a visit.
Authentication tokens — issued by Supabase Auth, stored securely.

You can clear local storage at any time from your browser settings. Note: clearing local storage in Demo Mode permanently deletes your demo account.

9. Children's Privacy

Panda Card does not have a minimum age requirement. However, we do not knowingly collect data from children under 13 without parental consent. If you believe a child has created an account, email hello@solforeyx.com and we will remove the account.

10. International Transfers

Your data may be transferred to and processed in countries outside Nigeria, including the EU and the United States, where our infrastructure providers operate. We ensure these transfers are protected by Standard Contractual Clauses or equivalent safeguards.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will notify you in-app and update the date at the top. Continued use of Panda Card after changes means you accept the updated policy.

12. Contact Us

For any privacy questions or concerns:

Email: hello@solforeyx.com
Subject line: "Privacy Request"
Response time: Within 30 days