Legal
Privacy policy
What Niclax Learning Hub collects when you use NFXHub, why we hold it, who else touches it, and what you can make us do about it.
01Who is responsible
Niclax Learning Hub, a business registered in Nigeria (registration 8775849) at 21 Sterling Street, Nvuigwe Woji, Klaus Residence, Nigeria, decides what personal data is collected here and why. In European terms, we are the data controller. Data questions go to privacy@nfxhub.com.
Because we sell internationally, more than one privacy law applies at once. Rather than publish several policies, this one is written to the strictest of them and names, in section 8, the rights each gives you.
02What we collect
Four kinds of data, and nothing outside them.
| Kind | What it is | Where it comes from |
|---|---|---|
| Account | Email address, name if you give one, password (stored hashed, never readable by us), country | You, at signup |
| Purchase | What you bought, when, the amount, the currency, and the processor's reference | Paystack or Paddle, after payment |
| Usage | Lessons opened and completed, and standard server logs including IP address and browser | Automatically, as you use the site |
| Journal | Trades, notes, screenshots and reviews you enter yourself | You, only if you use the journal |
We do not collect your card number. Card details go straight to Paystack or Paddle and never reach our servers, which is a deliberate design choice and not a courtesy.
03Why we hold it
- To give you what you bought. An account, access to the right course, and your progress in it. This is performance of our contract with you.
- To handle payment, tax and refunds. A legal obligation as much as a commercial one; tax records have statutory retention periods.
- To send account email. Confirmations, password resets, and notices about your access. These are not marketing and cannot be unsubscribed from while you hold an account.
- To keep the platform working and unshared. Detecting account sharing, abuse, and fraud is our legitimate interest, and it is why login IP addresses are logged.
- To send you marketing, only if you asked. Waitlist and newsletter email goes out on consent, and every message carries an unsubscribe link that works immediately.
We do not sell personal data. We do not share it with advertisers. There is no ad tracking on this site.
04Your journal data
NFX Ledger holds a detailed record of how you trade: entries, exits, sizes, losses, and written reflections about your own decisions. That is more revealing than most of what people put into a web app, and it is treated accordingly.
Four commitments on journal data
- Your entries are yours.Row Level Security in the database means your rows are readable only by your account. This is enforced by Postgres, not by application code, so a bug in a page cannot expose another person's journal.
- We never store banking details. Bank account numbers stay out of the database entirely. The payout section is bookkeeping you fill in yourself, and it holds no account credentials.
- Comparison with other students is on discipline, never on money. Where we show how you compare to others, the measures are plan adherence and rule breaks. Profit and loss is never pooled, ranked, or shown to anyone else.
- We do not sell or publish trading data, in any form, aggregated or otherwise, to brokers, data brokers, or anyone else.
Our team can technically access journal records through administrative tooling. We do it only to fix a fault you have reported or where we are legally required to, and we do not read journals out of interest.
05Who else touches it
Running the platform means using other companies. Each one below sees only the data it needs, is contractually bound to process it on our instructions, and cannot use it for its own purposes.
| Service | What it is used for | Where |
|---|---|---|
| Supabase | Accounts, course progress, journal entries | United States |
| Vercel | Hosting and request logs | Global edge |
| Resend | Account and transactional email | United States |
| Paystack | Payments in Naira | Nigeria |
| Paddle | International payments, tax, invoicing | United Kingdom |
| Discord | Community access, if you choose to join | United States |
| Bunny Stream | Course video delivery | Global edge |
Paddle is more than a processor. As Merchant of Record it is the seller on international transactions, so it is an independent controller of your billing data and applies its own privacy policy alongside this one.
06Where it is stored
Our database and email run on infrastructure in the United States, and our hosting is served from edge locations worldwide. If you are in Canada, Nigeria, the UK or the EU, your data is therefore transferred outside your country. Those transfers rely on the standard contractual clauses our providers publish, and on their own compliance frameworks.
Being plain about the trade-off: this is the standard arrangement for a small platform, and it means your data sits under United States jurisdiction. If that is not acceptable to you, do not create an account.
07How long we keep it
| Data | Kept for |
|---|---|
| Account and course progress | As long as your account exists |
| Journal entries | As long as your account exists, then deleted with it |
| Purchase and tax records | Seven years after the transaction, as tax law requires |
| Server and login logs | Ninety days |
| Marketing consent records | Until you unsubscribe, plus two years as proof of consent |
Deleting your account removes your profile, progress and journal. Purchase records survive it, because a tax authority does not accept "the customer asked us to delete it" as bookkeeping.
08Your rights
Whichever law covers you, the practical position is the same: email privacy@nfxhub.com and we answer within thirty days. We may ask you to confirm you control the account, which is a protection for you rather than an obstacle.
- See it. A copy of everything we hold about you.
- Correct it. Fix anything wrong. Name and email are editable yourself in your account.
- Delete it. Erasure of your account and journal, subject to the tax records in section 7.
- Take it elsewhere. Your journal exported in a machine-readable format.
- Object, or restrict. Tell us to stop a particular use, including anything we do on legitimate interest.
- Withdraw consent. Unsubscribe from marketing at any time, without affecting your course access.
These map to the NDPA in Nigeria, the GDPR and UK GDPR in Europe and the United Kingdom, and PIPEDA in Canada. You are never charged for exercising them, and we do not degrade your account because you did.
10Security
- Everything moves over TLS. Passwords are hashed by Supabase Auth and are not readable by us.
- Access to your rows is enforced in the database by Row Level Security, not by application code.
- The key capable of bypassing those rules is server-side only and never sent to a browser.
- Card details never reach our systems.
No system is perfectly secure. If a breach affects you, we will tell you and the relevant regulator without undue delay, and we will describe what happened rather than issuing a statement that says nothing.
11Age
This platform is for adults. You must be at least 18 to hold an account, and we do not knowingly collect data from anyone younger. If you believe a minor has created an account, email privacy@nfxhub.com and we will delete it.
12Changes
The date at the top is the current version. If we change how we use your data in a way that materially affects you, we email account holders before it takes effect rather than quietly updating the page.
13Contact and complaints
Niclax Learning Hub, 21 Sterling Street, Nvuigwe Woji, Klaus Residence, Nigeria. Privacy requests: privacy@nfxhub.com.
If we handle your request badly, you can complain to a regulator. In Nigeria, the Nigeria Data Protection Commission. In the EU or UK, your national data protection authority. In Canada, the Office of the Privacy Commissioner. We would rather you gave us the chance to fix it first.