Privacy Policy

1. Introduction

Welcome to Quorra ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains what information we collect, how we use it, and your rights when you use our web application and services (collectively, the "Platform").

By accessing or using Quorra, you consent to the data practices described in this policy.

2. Information We Collect

We collect information that allows us to provide a secure and compliant financial service.

2.4 Notifications and Estate Claims

If you allow notifications, we collect an Expo push token for each device so we can send security, transaction, and account notices. Market reminder notifications are on by default and you can turn them off at any time in Profile → Settings. No notification is sent to your device unless you allow notifications on your phone.

Our public estate claim form uses Cloudflare Turnstile to help prevent automated or abusive submissions. Claim documents are uploaded to private storage and are available only to authorised staff handling the claim.

You may provide next-of-kin contact details and consent to our holding them for account support and claim review. A next-of-kin nomination is not an automatic legal beneficiary designation or automatic transfer of your assets. Any claim is reviewed under the applicable legal process.

3. How We Use Your Information

We use your data for the following legitimate business purposes:

1. Service Delivery: To create your account, process deposits/withdrawals, and execute stock trades. The first time you trade stocks on an African exchange, we open a brokerage sub-account in your name at MyStocks Africa and tell them the result of your identity verification.
2. Identity Verification: To verify you are who you say you are and prevent fraud (via Didit).
3. Communication: To send you transaction receipts, security alerts, and account updates.
4. Legal Compliance: To comply with applicable laws, regulations, and requests from law enforcement agencies.
5. Platform Improvement: To analyze usage patterns and improve user experience.

4. Sharing Your Information

We do NOT sell your personal data. We only share information with the following trusted third-party service providers necessary to operate our business:

These partners are contractually obligated to protect your data and compliance with GDPR and relevant local data protection laws.

5. Data Security

We implement industry-standard security measures to protect your personal information:

• Encryption: Data is encrypted in transit (SSL/TLS) and at rest.
• Access Control: Strict access controls limit who can view your personal data.
• Secure Infrastructure: We use Google Cloud Platform's secure infrastructure.

However, please remember that no transmission over the internet is 100% secure. You are responsible for keeping your account password and login credentials confidential.

6. Retention of Data

We retain your personal information only for as long as necessary to fulfill the purposes set out in this policy, or as required by law (e.g., financial record-keeping regulations often require retaining transaction data for 5-7 years).

7. Your Privacy Rights

Depending on your jurisdiction, you may have the right to:

• Access (DSAR): Request a copy of the personal data we hold about you. We handle access requests by email. The app does not offer a full self-serve export yet.
• Correction: Request correction of inaccurate information.
• Deletion: You may close your account in the app (soft-delete). Full erasure of every record may be limited where law requires us to keep financial or identity records.

Product analytics (PostHog) uses your account UUID as the user id, not your email.

To exercise these rights, please contact our Data Protection Officer at [email protected].

8. Changes to This Policy

We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Revised" date and will be effective as soon as it is accessible.