Privacy Policy

Last updated: October 9, 2026.

This policy describes how Factornix (CITYHYPER GROUP LTD) handles personal information on its public website and subscriber portal.

Company identity and contact

Factornix is operated by CITYHYPER GROUP LTD, a company registered in Kenya.

• Registered company name: CITYHYPER GROUP LTD.
• Contact: [email protected].

What we collect

• Account information: your email address, a password hash, verification and password-reset records, session records, and the versions of the terms and privacy policy accepted at signup.
• Subscription and billing information: your selected strategy and price, subscription status, payment references, verified payment periods, and payment-provider customer, subscription and authorization references. Checkout is hosted by Paystack; Factornix does not collect your full card number or card security code through its checkout forms.
• Optional broker connection information: authorization tokens, broker account identifiers and status, balances, buying power, positions, orders and fills needed to check eligibility, prepare proposed orders and track authorized paper trading.
• Newsletter and launch-list information: the email address you provide, signup and confirmation records, and unsubscribe or suppression status.
• Operational and security records: account-linking actions, proposals, approvals, submission and reconciliation records, billing events, and standard web server logs such as IP address, browser user agent, requested page and timestamp.

How we use your information

We use this information to operate your account, authenticate access, deliver verification and password-reset emails, manage subscriptions and payments, display model portfolios, prepare and track authorized paper orders, investigate errors and disputes, and protect the service. Marketing updates are separate from account and service emails. We do not sell your information or share it with third parties for their own marketing purposes.

Optional broker connections

Broker linking is optional. You authorize the connection on the broker's own authorization page; Factornix does not ask for your brokerage password. Stored broker authorization tokens are encrypted. Account and trading data are used for the connected-account functions described above. An account link is not standing permission to submit orders: each proposed rebalance needs your approval.

You can manage connections in the portal or revoke authorization with your broker. Unlinking can be blocked while orders remain unresolved. Revoking a connection does not cancel orders already accepted by the broker, cancel a subscription, or erase historical approval and trading records.

Newsletter and launch lists

The general newsletter uses double opt-in: your email address becomes active after you follow the confirmation link. Newsletter emails include an unsubscribe link. We retain suppression records to respect unsubscribe and spam-report preferences. Unsubscribing from marketing does not stop essential account and service emails.

A strategy launch list records your interest without a separate confirmation step. Contact us to request removal from a launch list.

Service providers

We use Paystack for payment processing, Brevo for email delivery, a brokerage integration provider for optional broker connections, and infrastructure providers for hosting and data storage. Information is shared as needed to perform these functions. Provider-hosted checkout and broker authorization pages are also subject to those providers' privacy notices.

Cookies and analytics

The subscriber portal uses essential cookies to maintain your signed-in session and protect forms against forged requests. Blocking these cookies can prevent login and account actions. The site does not currently use advertising or third-party tracking cookies. We will update this policy if that changes.

Security measures

We use encrypted storage for broker authorization tokens and reusable payment authorization codes, password hashing, authenticated sessions, ownership checks and request-forgery protection. Public website and portal connections use HTTPS. These measures are intended to reduce unauthorized access and disclosure; no system can guarantee absolute security. If you suspect an account or data-security issue, contact us at [email protected].

Children

Factornix is intended for people aged 18 or older. We do not invite children to create accounts or provide personal information. If you believe a person under 18 has provided information, contact us so we can investigate, restrict the account where appropriate and address deletion subject to applicable record-retention obligations.

Retention and deletion

Closing a connection or stopping a subscription does not automatically delete your account or its history. Account, billing, approval, trading and security records, and copies in backups, may remain after those actions. Routine security logs and backup copies have approved 90-day retention targets; a complete category-specific retention and legal-hold procedure has not yet been established. The approved interim target below still requires implementation; timed deletion has not yet been verified.

You can contact us to request deletion. We review requests against records needed for service operation, security, accounting, dispute handling and applicable legal obligations, and explain any records that must be retained. Newsletter suppression records may be retained to avoid sending unwanted marketing messages.

Interim retention approach

• Billing and payment records: retain records required for tax and accounting purposes for the period required by applicable law, and longer where required for an unresolved proceeding or lawful preservation obligation. No single tax period is applied to every category of personal information.
• Routine security logs: our approved retention target is 90 days. The deletion procedure is not yet implemented or verified. Records needed for an incident, dispute or legal hold may be retained longer while that purpose applies. Trading-approval and financial audit records are separate from routine security logs and are not automatically deleted under the routine-log retention window.
• Account and connection records: retain information needed while the account or connection is in use; review deletion requests after closure against the purposes and obligations above.
• Backups: backup copies have an approved retention target of 90 days. Deletion from active systems does not imply immediate deletion from backup copies. Backup expiry is to be implemented and verified with the backup/recovery process; records subject to a lawful preservation obligation may be retained longer while that obligation applies.

Your requests and choices

You may request access to, correction of, or deletion of your personal information by contacting us. We may need to verify your identity before acting on a request. You can withdraw marketing consent using the newsletter unsubscribe link or contact us about a launch list.

Changes and contact

Updates are identified by the date above. For privacy questions and requests, contact [email protected].