Privacy notice

EvoRayn Privacy Policy

Purpose This Privacy Policy explains how NOVAROS TECHNOLOGIES (PTY) LTD collects, uses, stores, discloses and protects personal information when you use EvoRayn. We aim to process personal information lawfully, fairly, transparently and only to the extent reasonably necessary for legitimate purposes.
Responsible party For South African privacy law, the responsible party is: NOVAROS TECHNOLOGIES (PTY) LTD Registration: 2026/386456/07 8 Meerlust Street Pinelands Cape Town Western Cape 7405 South Africa Privacy enquiries: privacy@evorayn.com
Scope This Policy applies to:

evorayn.com;
EvoRayn mobile applications;
EvoRayn accounts;
practice accounts;
AI features;
connected-account functionality;
customer support;
related EvoRayn services. Independent brokers and financial institutions process information under their own privacy notices.

Information we collect 4.1 Account and identity information We may process:

name;
email address;
account ID;
authentication status;
encrypted or securely hashed authentication information;
linked identity-provider identifier;
account creation date;
age or age confirmation. 4.2 Profile and suitability information Where you choose or are required to provide it:
age;
employment information;
investment objectives;
risk tolerance;
trading experience;
investment experience;
strategy preferences;
trading preferences. EvoRayn does not currently require users to provide income, net worth or expected investment amount as core profile information. 4.3 Connected financial-account information If you connect a broker or trading provider, EvoRayn may receive:
provider name;
account identifier;
account type;
balances;
buying power;
equity;
positions;
orders;
trade history;
transaction history;
realised and unrealised profit/loss;
instrument information;
account capabilities;
account connection status. We do not take custody of the assets reflected in those accounts. 4.4 Trading and strategy information We may process:
instruments viewed;
watchlists;
trade ideas;
orders prepared;
orders transmitted;
strategy settings;
strategy activation status;
automated-trading instructions;
stops and limits;
risk controls;
paper trades;
performance information. 4.5 AI information We may process:
prompts;
questions;
selected market context;
portfolio context;
analysis requests;
AI-generated responses;
model metadata;
feedback on generated responses. Where necessary to answer a request, relevant portfolio or market information may be included in a request to an AI-processing provider. 4.6 Device and technical information We may automatically receive:
device type;
operating system;
app version;
IP address;
language;
time zone;
device/application identifiers;
crash information;
security events;
authentication events;
API logs;
network diagnostics. EvoRayn does not ordinarily collect precise GPS location. Approximate location may sometimes be inferred from an IP address for security, legal compliance or geographic feature restrictions. 4.7 Subscription information We may process:
plan;
entitlement;
trial status;
renewal status;
transaction identifier;
purchase date;
store/provider;
expiry date. Where Google Play processes your purchase, EvoRayn generally does not receive your full payment-card number. 4.8 Support communications If you contact us, we process the content of your request and information needed to respond.

Information we do not ordinarily collect EvoRayn does not currently require direct collection of:

identity-document images;
passports;
selfies for KYC;
proof of residential address for brokerage KYC;
precise GPS location;
income;
net worth. A connected broker may separately require these categories.

Why we process personal information We use personal information to:

register and authenticate accounts;
operate EvoRayn;
connect broker accounts;
display portfolio information;
provide market analysis;
tailor analytical outputs;
operate practice trading;
run user-authorised automated strategies;
maintain watchlists;
calculate performance;
manage subscriptions;
provide support;
deliver service notifications;
secure accounts;
prevent abuse and fraud;
investigate incidents;
improve reliability;
meet legal obligations;
enforce our Terms;
manage disputes;
obtain user feedback;
send marketing only where lawfully permitted.

Legal bases Depending on the jurisdiction and processing activity, processing may be based on:

performance of our contract with you;
your consent;
legitimate interests;
compliance with legal obligations;
protection of legal rights;
another lawful basis recognised by applicable law. Where consent is required, you may withdraw it subject to the consequences described at collection.

Automated processing EvoRayn is an AI-powered product. Personal information may be processed automatically to:

analyse portfolios;
evaluate risk preferences;
rank opportunities;
generate research;
create alerts;
calculate confidence indicators;
generate trade ideas;
apply user-configured strategies. Where applicable law restricts decisions based solely on automated processing that produce legal or similarly significant effects, EvoRayn will implement the required safeguards or not make that functionality available. The existence of an AI recommendation does not guarantee its accuracy or suitability.

Artificial-intelligence providers EvoRayn may use specialised AI infrastructure or third-party AI providers. When an external AI service is used, we seek to send only information reasonably necessary for the relevant task. Where commercially available and appropriate, we configure or contract with providers so private user information is not used to train their general public models. Novaros does not use private portfolio information, private trading history or private prompts to train a general-purpose EvoRayn model without separate express permission.
Brokers and connected services When you connect an account: you direct EvoRayn to communicate with the provider; the provider may disclose authorised account data to EvoRayn; EvoRayn may return authorised instructions to the provider; the provider remains responsible for its own privacy practices. Disconnecting an account stops future access through that integration, but previously obtained information may remain until deletion or the expiration of applicable retention periods.
Service providers We may use service providers for functions such as:

cloud hosting;
databases;
authentication;
security;
infrastructure;
crash reporting;
email;
push notifications;
subscription management;
payments;
AI inference;
market data;
customer support. They may process information only for legitimate service purposes and subject to contractual or legal requirements appropriate to their role. A current subprocessor list may be made available at evorayn.com.

Disclosure to other parties We may disclose information: To service providers Where necessary to operate EvoRayn. To your broker Where necessary to retrieve information or transmit instructions you authorised. Where legally required To regulators, courts, law-enforcement agencies or other authorities where required by lawful process. To protect rights and safety Where reasonably necessary to detect fraud, secure the Services, investigate wrongdoing or protect users. In a corporate transaction If Novaros undergoes a merger, financing, acquisition, restructuring or sale, information may transfer subject to applicable law and appropriate confidentiality safeguards.
No sale of personal information Novaros does not sell users' personal information for money. We do not use private broker-account information or trading history for third-party behavioural advertising. If our practices materially change, we will update this Policy and provide any opt-out or consent mechanism required by law.
Marketing Service and transaction communications are separate from marketing. Without needing marketing consent, we may send communications necessary for:

authentication;
security;
transactions;
account changes;
outages;
subscriptions;
legal notices;
material service changes. Promotional communications are sent only where permitted by applicable law and consent requirements. You may withdraw marketing consent without losing access to ordinary service communications.

Cookies and similar technologies Our website may use:

essential cookies;
authentication storage;
security technologies;
preferences;
performance or analytics technologies. Where legally required, non-essential cookies will be used only after appropriate consent. A separate Cookie Notice may be provided as web functionality expands.

International transfers EvoRayn operates internationally and may rely on providers located outside South Africa or your country. Personal information may therefore be processed across borders. Where required, we use appropriate safeguards, which may include:

contractual data-protection obligations;
recognised standard contractual clauses;
transfer mechanisms approved by applicable law;
adequacy mechanisms;
consent where legally appropriate.

Security We use technical and organisational measures appropriate to the nature of the information processed. These may include:

encryption in transit;
encryption at rest where appropriate;
secure credential handling;
access controls;
audit logging;
token-based authentication;
secret-management controls;
production access restrictions;
monitoring;
backups;
security testing. No online system is perfectly secure. You should use a secure device, strong password and any available account-security features.

Retention We retain personal information only as long as reasonably necessary for:

providing EvoRayn;
security;
fraud prevention;
legal obligations;
accounting;
disputes;
enforcement. While your account is active, core information is retained as needed to operate it. When you delete your account, we remove or anonymise user information from active production use unless continued retention is legally required. Because secure backup systems cannot always delete individual records instantaneously, deleted information may remain in restricted backups until the backup naturally expires. Our target maximum backup-aging period for deleted ordinary account data is 90 days, subject to technical and legal exceptions. Minimal transaction, legal, security or dispute records may be retained for longer where required by law or reasonably necessary to establish, exercise or defend legal claims.

Account deletion You can request deletion through EvoRayn's account controls where available, or by contacting: privacy@evorayn.com Deletion of EvoRayn does not automatically delete:

your Google account;
broker accounts;
data independently retained by brokers;
records another provider must retain under law.

Accuracy and correction You should keep profile information current. You may request correction of inaccurate personal information.
Your privacy rights Depending on applicable law, you may have rights to:

be informed about processing;
access personal information;
receive a copy;
correct inaccurate data;
request deletion;
object to certain processing;
restrict processing;
withdraw consent;
request data portability where applicable;
object to certain direct marketing;
complain to a regulator;
request safeguards relating to certain automated decisions. Rights are subject to lawful exceptions.

South African users Where POPIA applies, you may exercise rights provided under South African data-protection law. You may also lodge a complaint with the Information Regulator of South Africa. We will not prevent you from exercising a right granted by POPIA.
European Economic Area and UK Where GDPR or UK GDPR applies, we will process personal data under an applicable lawful basis and recognise relevant statutory rights, including access, correction, deletion, objection, restriction and portability where applicable. Where required, additional safeguards will apply to automated decision-making and international transfers.
California and certain US residents Where EvoRayn is subject to the California Consumer Privacy Act or similar US state legislation, qualifying users may have rights such as:

right to know;
right to access;
right to delete;
right to correct;
right to opt out of qualifying sale or sharing;
right to limit certain uses of sensitive information;
right not to be discriminated against for exercising privacy rights. Novaros does not sell personal information for money. Additional jurisdiction-specific notices may be introduced as required.

Children EvoRayn is restricted to persons aged 18 or older. We do not knowingly provide accounts to children. If we discover that an ineligible minor has created an account, we may close it and delete associated information.
Data breaches If a security incident compromises personal information, we will investigate and provide legally required notifications to affected individuals and authorities.
Changes to this Policy We may update this Policy to reflect:

product changes;
legal developments;
provider changes;
security improvements;
new processing activities. Material changes will be communicated where appropriate.

Contact Privacy requests: privacy@evorayn.com General support: support@evorayn.com NOVAROS TECHNOLOGIES (PTY) LTD 8 Meerlust Street Pinelands Cape Town Western Cape 7405 South Africa