Legal
Privacy Policy
Last updated: April 2026 · Effective immediately
Summary
Trade GSE collects only what is needed to run the service — your name, email, and usage data. We never sell your data or use it for advertising. You can delete your account and all associated data at any time by emailing [email protected].
1. Who We Are
Trade GSE is operated by Alpha Gamma Reals. We provide a platform for tracking the Ghana Stock Exchange (GSE), AI-powered market commentary, trading education courses, and simulated paper trading at ghanastocks.xyz.
Data controller contact:
Email: [email protected]
We will respond to all privacy requests within 30 days.
2. Data We Collect
Account data — collected when you register:
- Name and email address
- Username and password (stored as a secure hash — never plaintext)
- Profile photo (optional, if you upload one)
Usage data — collected automatically:
- Pages visited, stocks viewed, watchlist and portfolio activity
- Paper Trading activity — virtual trades using GHS 10,000 of virtual cash only. We do not collect bank account numbers, payment card details, mobile money credentials, or any real financial account information. Paper Trading is entirely simulated.
- Course enrolment and progress
Technical data — for security:
- IP address and login timestamps
- Browser type and device information
Communications:
- Email address used to send OTP verification codes
- Price alerts and market summaries (only if you opt in via Profile settings)
3. How We Use Your Data
| Purpose | Legal Basis |
|---|---|
| Providing and maintaining your account | Contract performance |
| Sending OTP codes and password resets | Contract performance |
| Price alerts and market summaries | Consent (opt-in only) |
| Fraud and security monitoring | Legitimate interests |
| Service improvement and analytics | Legitimate interests |
| Legal compliance | Legal obligation |
4. Data Sharing & Third Parties
We share your data only with the following processors:
- Neon (PostgreSQL database) — stores all account and market data. Data is encrypted at rest and in transit. Servers located in US/EU. Neon Privacy Policy ↗
- Vercel (hosting) — serves the web application. Processes HTTP request data including IP addresses. Vercel Privacy Policy ↗
- hCaptcha — CAPTCHA verification on login and registration. Processes your browser fingerprint to detect bots. hCaptcha Privacy Policy ↗
- Google Analytics — anonymised page-view statistics. No personal identifiers are sent. IP addresses are anonymised. Google Privacy Policy ↗
- Cloudinary — hosts profile avatars and article images. Cloudinary Privacy Policy ↗
- Vercel Analytics — privacy-first performance monitoring. Collects aggregated, anonymised page-view metrics (load times, Web Vitals). No cookies are set; no personal identifiers are sent or stored. Vercel Privacy Policy ↗
- Google Gemini API (AI Advisor) — processes your questions to generate market commentary and insights. Queries are transmitted to Google under their Data Processing Agreement. AI Advisor queries are not used to train Google's global models when accessed via the API. We do not permanently store your AI Advisor conversation history. Google Cloud Privacy Notice ↗
4a. International Data Transfers
Your personal data is stored and processed outside Ghana on servers operated by our sub-processors in the United States and European Union:
- Neon (PostgreSQL database) — US East region (AWS us-east-2)
- Vercel (hosting & analytics) — Global edge network with US and EU nodes
These transfers are made in compliance with Section 47 of the Ghana Data Protection Act 2012 (Act 843), which permits international transfers where the receiving country provides adequate protection or appropriate safeguards are in place. Both Neon and Vercel are GDPR-compliant and operate under standard contractual clauses, providing protections equivalent to those under Act 843. All data in transit is encrypted via TLS 1.2+ and encrypted at rest on all data stores.
5. Cookies
| Cookie | Purpose | Duration |
|---|---|---|
| sessionid | Keeps you logged in (essential) | 24h or browser close |
| csrftoken | Prevents cross-site request forgery (essential) | 1 year |
| _ga, _gid | Google Analytics — anonymised visit tracking | 2 years / 24h |
We do not use advertising cookies or third-party tracking pixels.
Both sessionid
and csrftoken
are set with the HttpOnly and Secure
flags — they cannot be read by JavaScript and are never sent over plain HTTP.
You can opt out of Google Analytics via the Google Analytics Opt-out Add-on ↗.
6. Data Retention
- Active accounts — data retained for as long as your account exists
- Deleted accounts — all personal data permanently deleted within 30 days of account deletion
- Security logs (login attempts, IP addresses) — retained for 90 days for fraud prevention
- Anonymised analytics — retained indefinitely (no personal data)
- Market price history (GSE snapshots) — retained indefinitely as a time-series record for historical charting and analytics. Our system only writes a new snapshot when a price, change, or volume value has actually changed — unchanged duplicate records are not stored. This data contains no personal information.
7. Security
We protect your data with:
- HTTPS encryption on all connections with 1-year HSTS preload
- Passwords hashed with PBKDF2-SHA256 — never stored in plaintext
- Database encrypted at rest (Neon PostgreSQL)
- Two-factor OTP email verification on registration
- CAPTCHA on login and registration to prevent automated attacks
- Brute-force protection — accounts locked after 5 failed login attempts
- Regular dependency vulnerability scanning via automated CI checks
8. Your Rights
Under the Ghana Data Protection Act 2012 (Act 843) and the EU General Data Protection Regulation (GDPR), you have the following rights:
- Access — request a copy of all personal data we hold about you
- Correction — update inaccurate or incomplete data (via Profile settings)
- Erasure ("right to be forgotten") — request deletion of your account and all personal data
- Portability — receive your data in a machine-readable format (JSON or CSV)
- Withdraw consent — opt out of marketing emails at any time via Profile → Notification Settings
- Object — object to processing based on legitimate interests
- Restriction — request that we restrict processing of your data pending a dispute
To exercise any right, email [email protected]. We will respond within 30 days.
Right to Lodge a Complaint — Ghana Data Protection Commission
If you believe your rights under Act 843 have been violated and you are not satisfied with our response, you have the right to lodge a formal complaint with the Ghana Data Protection Commission (DPC) without restriction or precondition:
- Website: www.dataprotection.org.gh ↗
- Email: [email protected]
We always encourage you to contact us first at [email protected] — we are committed to resolving privacy concerns directly. Escalation to the DPC is your right at any point.
9. Children's Privacy
Trade GSE is not directed at children under 18. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact [email protected] and we will delete it immediately.
10. Changes to This Policy
We may update this policy as the service evolves. Material changes will be notified by email at least 14 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.
Exercise Your Rights
Access, correct, export, or delete your data at any time. Most actions are available directly in your Profile Settings. For anything else, email us and we will respond within 30 days.
[email protected] →