Privacy Policy

1. Who We Are

PolygotLabs (Pvt) Ltd operates Nafa, the investing app at nafa.com.pk, and also publishes the PSX research tools at tickeranalysts.com. Both are products of the same company, and this policy covers your use of Nafa. We are the data controller for the personal information described here.

Nafa is not itself a broker. Brokerage services are provided by Chase Securities, an SECP-licensed securities broker and PSX TREC holder, and Chase Securities handles your information as a controller in its own right for the account it opens and operates for you.

2. Information We Collect

We collect information you give us, information generated as you use Nafa, and information we receive from the broker and market infrastructure that supports your account.

• Identity and KYC data — your name, CNIC details, date of birth, address, photo or liveness check, signature, and the supporting documents required to open a brokerage account under SECP and anti-money-laundering rules.
• Contact details — email address and mobile number, used to reach you and to verify it is you.
• Financial and account data — your linked bank account, deposits and withdrawals, orders, trades, holdings, cash balance, and account statements.
• Device and usage data — device model, operating system, app version, IP address, and how you move through the app, including the screens you open and the features you use.
• Support communications — messages you send us on WhatsApp, email, or the in-app Help Desk, and our replies.

3. How We Use Your Information

• Open, verify, and maintain your investing account, and carry out the KYC and AML checks the law requires.
• Place your orders, settle your trades, and show you accurate holdings, cash, and history.
• Process deposits and withdrawals to and from your linked bank account.
• Send you service messages — order confirmations, corporate action notices, security alerts, and account updates.
• Provide support, investigate issues you report, and correct data errors.
• Keep Nafa secure: detect, prevent, and act on fraud, abuse, and unauthorised access.
• Improve the app by understanding which features are used and where people get stuck.
• Meet our legal, regulatory, tax, and record-keeping obligations in Pakistan.

4. Cookies & Analytics

On our website and in the app we use cookies and similar technologies to keep you signed in, remember your preferences, and measure usage. We use third-party analytics providers, including PostHog and Google Analytics, to understand how Nafa is used and to improve it. We do not use your identity or financial data for advertising, and we do not sell it.

5. Who We Share It With

We do not sell your personal data. We share it only where it is needed to run your account or where the law requires it:

• Chase Securities, the SECP-licensed broker that holds your brokerage account and executes your trades.
• Market infrastructure — the Pakistan Stock Exchange (PSX), the Central Depository Company (CDC), which holds your shares in your own sub-account, and NCCPL, which clears and settles your trades.
• Regulators and authorities — the SECP, the FBR, and other bodies when we are legally required to report or respond.
• Service providers that help us operate, such as cloud hosting, identity verification, payment and Raast connectivity, communications, and analytics. They act on our instructions and may only use your data to provide that service.

6. Data Retention

We keep your account information for as long as your account is open. After it closes, we retain identity, transaction, and communication records for the period required by Pakistani securities, anti-money-laundering, and tax law — currently a minimum of five years — after which we delete or anonymise them.

7. Security

We use industry-standard safeguards to protect your information, including encryption in transit and at rest, access controls, and audit logging. Your shares are held in your own CDC sub-account in your name, not on our books. No system is perfectly secure, but we work continuously to protect your data and will notify you and the relevant authorities if a breach affects you.

8. Your Rights

You may ask us to access, correct, or export the personal data we hold about you, and you may ask us to delete it — subject to the records we are legally required to keep, described in section 6. You can close your account at any time. To exercise any of these rights, contact us using the details below.

9. Children's Privacy

Nafa is for adults. You must be 18 or older to open an account, and we do not knowingly collect personal information from children.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through the app or by email. The "Last updated" date above reflects the most recent revision.

11. Contact Us

If you have questions about this policy or your data, write to PolygotLabs (Pvt) Ltd at hello@tickeranalysts.com, or message us on WhatsApp. More ways to reach us are on the contact page.