Privacy Policy | L2 Signals Services

1. Who is responsible for your data

L2 Signals Services is the controller for the personal data described here. Contact l2signalslab@gmail.com or @aotayoL2 on Telegram for any privacy question or request. This policy is written to be consistent with applicable Nigerian data-protection law, including the Nigeria Data Protection Act 2023, and with other laws that genuinely apply to you.

2. Data we collect

Contact and identity: the email address you give at checkout, and — when you send proof or ask for support — your name, Telegram username or ID, phone or WhatsApp number and any other details you choose to provide.
Payment records: payment method, amount, currency, date, status, plan and the transaction reference, bank narration or crypto transaction hash. We do not receive or store full card numbers, CVV codes, wallet seed phrases or bank passwords.
Subscription and access records: start and end dates, grace period, renewal status, invite status, membership notes and the Telegram identity linked to the subscription.
Consent records: the legal-document versions you accepted, the product and price shown, the timestamp in UTC, and the consent state. This is the audit record of what you agreed to before a payment was initiated.
Technical and security data: server logs, truncated or hashed IP address, user agent, request time, rate-limit counters and error diagnostics. We use these to keep the service available and to detect abuse.
Communications: the content of enquiries, support messages and project briefs you send us.
Custom project data: information you provide about a project, such as requirements, strategy rules, documents or datasets. A separate agreement may add confidentiality terms for that material.

We do not ask for your broker password, MT5 investor password, card PIN or wallet recovery phrase. Do not send them to us through any channel.

3. Why we process it and on what basis

To provide the service you bought — verifying payment, applying access, managing membership, delivering signals and handling renewals or cancellation. This is necessary to perform our contract with you.
To keep an auditable consent record — evidence that the applicable terms, risk disclosure and founding-member conditions were accepted before payment. This is necessary for the contract and for demonstrating compliance.
To answer enquiries and provide support — responding to your message and resolving payment or access issues.
To secure and improve the service — preventing fraud, abuse, duplicate payment claims and attacks; diagnosing errors; maintaining availability. This is based on our legitimate interest in operating a safe service, balanced against your rights.
To meet legal and accounting obligations — retaining payment and tax records where the law requires it, and responding to lawful requests.
With your consent — where we specifically ask for it, such as an optional communication. You can withdraw consent at any time; withdrawal does not affect processing that already took place.

We do not sell personal data, run advertising profiles, or use your payment data for automated decisions that produce legal or similarly significant effects.

4. Payment providers and third-party processors

We use service providers that process data on our behalf or as independent controllers for their own regulated functions. The main ones are:

Paystack — hosted checkout for card, bank transfer and USSD. Paystack processes the payment instrument; we receive the transaction reference, amount, currency, status and customer email.
Blockchain networks and wallets — for crypto payments. A transaction hash and wallet address are public and permanent by design. We use them to verify your payment; we do not control the public ledger.
Banks — for Nigerian bank transfers. We receive the narration or reference you send us and the credit shown on the receiving account.
Firebase / Google Cloud — authentication-free database and server-side storage for payment, consent, membership and signal records.
Vercel and Render — website hosting and background workers, which process request logs and serve the site.
Telegram — delivery of signals and member support. Your use of Telegram is governed by Telegram's own terms and privacy policy.
Email providers — used to receive and reply to messages you send to our published contact email.

We share only what is necessary for the relevant function. A provider may process data outside Nigeria; where that happens, we rely on the provider's contractual safeguards and apply appropriate measures. We do not claim a certification or adequacy mechanism that we have not verified.

5. Cookies and local storage

The website uses local storage for preferences such as the light or dark theme. We do not set advertising cookies or sell audience data. Server logs and rate-limit counters are used for security and reliability. If analytics or additional cookies are introduced, this policy and any required consent control will be updated before they are used.

6. When we share data

We share personal data only as needed: with the processors above; with professional advisers such as an accountant or lawyer under confidentiality; with a payment provider during a dispute or chargeback; with authorities where we are legally required to do so or where necessary to investigate fraud or protect a person; and as part of a genuine reorganisation or sale of the business, subject to appropriate safeguards.

We do not share your contact details with other members, and we do not publish your payment details. If a member-facing case study is ever published, it will use only information you expressly agree to share.

7. How long we keep data

Payment, consent and membership records are kept for as long as the subscription or business relationship lasts and then for the period needed for accounting, tax, dispute and legal purposes. Consent records are kept with the payment record they relate to, because their purpose is to evidence what was accepted. Support messages are kept while the issue is open and for a reasonable period afterwards. Technical logs are kept for a short operational period unless they are needed for a security investigation.

When data is no longer needed, it is deleted or aggregated. Some records may need to be retained to comply with a legal obligation or to establish, exercise or defend a legal claim; in that case we limit access and retain only what is necessary.

8. How we protect data

We use encrypted transport (HTTPS), server-side access controls, least-privilege service credentials, restricted administrative access and rate limiting on public payment routes. Payment secrets are kept in server-side environment variables and are never included in browser code. Consent and payment writes happen on the server; a browser flag alone is not accepted as proof.

No system is completely secure. If a personal-data breach occurs that is likely to result in a risk to your rights, we will investigate, take steps to contain it and notify the relevant authority and affected people where the law requires.

9. Your rights

Subject to applicable law, you may ask to access your personal data, correct inaccurate data, delete data that is no longer necessary, restrict or object to certain processing, receive data in a portable format where that right applies, and withdraw consent where processing is based on consent. You also have the right to complain to the Nigeria Data Protection Commission or another competent supervisory authority.

Send a request to l2signalslab@gmail.com. We may need to verify your identity before acting, and we will respond within the period required by applicable law. A request that would require us to delete a record we must keep for a legal obligation may be limited to that extent, and we will explain why.

10. Children

The service is intended for adults. It is not directed to children, and we do not knowingly collect personal data from a child. If you believe a child has provided data, contact us and we will take appropriate steps to remove it.

11. Automated processing

We do not use your personal data for automated decision-making that produces legal or similarly significant effects. The signal engine processes market data, not your personal circumstances. Position sizing and trading decisions remain yours.

12. Changes to this policy

We may update this policy when our practices or the law change. The current version and effective date are shown at the top of this page. Material changes will be communicated through the website or the official channel. Where a change requires your consent, we will ask for it rather than assume it.

13. Contact and related documents

Privacy questions and requests: l2signalslab@gmail.com or @aotayoL2 on Telegram. Read this policy with the Terms of Service, Subscription Terms and the Acceptable Use Policy.