Last updated: May 2026. This policy applies to all Gopexly users globally with specific provisions for Nigerian residents.
Gopexly is committed to protecting the personal data of its users. This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and the rights you have over your data. Please read it carefully.
Gopexly is a social investing platform headquartered in Lagos, Nigeria. We are the data controller for personal information collected through the platform. You can contact our data team at: admin@gopexly.com
We collect the following categories of personal data:
Account Data: Your name, email address, username, password (hashed, never stored in plain text), profile photo, biography, location, and country.
Financial Data: Portfolio holdings you manually enter (stock tickers, number of shares, purchase price). We do not connect to or access your brokerage account. We do not store your bank account details or card numbers — all payment processing is handled by Paystack.
Behavioural Data: Posts you create, stocks you add to your watchlist, courses you complete, comments you write, users you follow, and features you interact with.
Usage Data: IP address, device type, browser, operating system, pages visited, time spent on pages, and click patterns. This data is collected to improve the platform and is not sold to advertisers.
AI Interaction Data: When you use Gopexly AI, your questions and the AI responses are logged to enforce daily usage limits and to improve the AI assistant. We do not use your AI conversations to train external AI models.
We use your personal data to:
- Provide, maintain, and improve the Gopexly platform.
- Process your Pro subscription payments and verify transactions.
- Show your portfolio performance and synchronise data across the app.
- Personalise your feed, recommendations, and course content.
- Send you platform notifications, security alerts, and (if opted in) marketing communications.
- Enforce our Terms and Conditions and prevent fraud or abuse.
- Comply with legal obligations under Nigerian law.
- Generate anonymised and aggregated analytics to understand platform usage trends.
We do not use your personal data for advertising profiling. We do not sell your data to any third party under any circumstances.
We process your personal data on the following legal bases: your consent (which you may withdraw at any time); the performance of our contract with you (to deliver the service you signed up for); compliance with legal obligations; and our legitimate interests in operating, securing, and improving the platform, provided those interests do not override your rights.
We share your personal data only in the following limited circumstances:
Service Providers: We work with carefully selected technology partners to operate the platform. These include Vercel (infrastructure and hosting), Railway (database), Paystack (payment processing), and Groq (AI inference). Each provider is bound by data processing agreements and may not use your data for their own purposes.
Other Users: Your public profile information, posts, portfolio percentage performance (not naira values), and activity on the social feed are visible to other registered users. You control what you post.
Legal Compliance: We may disclose your data to law enforcement, regulatory authorities, or courts where required by applicable Nigerian law, court order, or to protect the rights and safety of our users.
Business Transfer: In the event of a merger, acquisition, or sale of assets, your data may be transferred to the successor entity, which will be bound by this Privacy Policy.
Your portfolio naira values are private by default. Only percentage allocation and percentage returns are visible to other users when you choose to share your portfolio in a post. The exact monetary value of your holdings is never displayed to other users without your explicit action to reveal it. You can hide your balance at any time using the visibility toggle on the home page.
We retain your personal data for as long as your account is active. If you delete your account, your personal data will be removed from our active systems within 30 days, except where retention is required for legal, tax, or regulatory compliance. Aggregated anonymised data that cannot identify you individually may be retained indefinitely.
Posts, comments, and content you create may be retained for a short period after deletion to allow for content moderation and abuse reporting processes to complete.
Under applicable data protection law, you have the following rights:
Access: You can request a copy of the personal data we hold about you.
Correction: You can update your personal information at any time through your profile settings.
Deletion: You can request that we delete your account and personal data.
Portability: You can request an export of your portfolio data in CSV format (Pro users) or request your account data.
Objection: You can object to processing based on legitimate interests.
Withdrawal of consent: Where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email us at admin@gopexly.com. We will respond within 30 days.
We take the security of your data seriously. Passwords are hashed using bcrypt and never stored in plain text. All data in transit is encrypted using TLS. Access to production databases is restricted to authorised personnel only. We conduct periodic security reviews of our infrastructure.
Despite these measures, no internet transmission is completely secure. You use Gopexly at your own risk and should choose a strong, unique password and enable any available two-factor authentication.
Gopexly uses a single authentication session cookie to keep you logged in. This cookie contains a signed, encrypted JWT token and does not track you across other websites. We do not use advertising cookies, third-party tracking pixels, or analytics tools that share your data with advertisers. There are no ads on Gopexly.
Gopexly is not directed at children under 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has registered, we will delete the account and all associated data immediately.
Gopexly's infrastructure is hosted on servers located primarily in the United States (Vercel) and may process data in other jurisdictions. By using Gopexly, you consent to the transfer of your data to these locations. We ensure that such transfers are protected by appropriate safeguards including standard contractual clauses where required.
Gopexly complies with the Nigeria Data Protection Act 2023 (NDPA) and the Nigeria Data Protection Regulation (NDPR). We do not process personal data in a manner that violates the dignity of natural persons, and we do not engage in the processing of sensitive personal data without explicit consent. Nigerian users have the right to lodge a complaint with the Nigeria Data Protection Commission (NDPC) at ndpc.gov.ng if you believe your rights have been violated.
We may update this Privacy Policy periodically. Material changes will be communicated to registered users via in-app notification or email. The current version is always available at gopexly.com/privacy. Continued use of the platform after notification constitutes acceptance of the updated policy.
For privacy-related enquiries, data requests, or complaints:
Email: admin@gopexly.com
General support: admin@gopexly.com
Gopexly, Lagos, Nigeria.
This Privacy Policy was prepared in accordance with the Nigeria Data Protection Act 2023, NDPR 2019, and internationally recognised data protection principles.