This Privacy Policy explains how Chart Stalker (Pty) Ltd (Reg. 2022/298579/07), trading as Plug 'n Play Trading Tech and operating the Aura Terminal platform ("we", "us", "our", "Aura"), collects, uses, stores, and protects your personal information in compliance with the Protection of Personal Information Act 4 of 2013 ("POPIA") and other applicable South African legislation.
Chart Stalker (Pty) Ltd is an authorised Juristic Representative of 1st Fintech Capital (Pty) Ltd (FSP 51478, Reg. 2020/936466/07). By using Aura Terminal, you consent to the practices described in this policy.
When you register for an Aura Terminal account, we collect:
If you connect a broker account via our MetaTraderAPI.dev bridge, we access your trading data (account balance, equity, open positions, and trade history) and can execute trades that you explicitly initiate from Aura Terminal. We never auto-trade: every order, modification, and close is triggered by a deliberate tap inside the app, and close actions go through a confirmation pill by default.
Broker credential storage. So that you do not have to re-enter your MT5 master password on every visit, we store it encrypted using AES-256-GCM (the standard used by banks and password managers). The encryption key lives only in our hosting provider’s secure environment variables, never in the database, never in source control, and never in application logs. This means that a compromise of our database alone cannot reveal your password — an attacker would need to compromise both our database and our hosting provider’s secret store. Each encrypted credential has a unique initialisation vector and authentication tag, so even two users with the same password have entirely different ciphertext. You can delete your stored credentials at any time by clicking Disconnect in the MT5 panel, which wipes all four credential columns from the row. We also maintain an internal kill-switch that allows us to disable decryption platform-wide without a code deploy in the event of a suspected key compromise.
In accordance with Section 13 of POPIA, we process your personal information for the following lawful purposes:
Under POPIA Section 11, we process your personal information based on: (a) your consent, provided at registration and through explicit opt-in mechanisms; (b) contractual necessity, to fulfil our obligations under the Terms of Service; (c) legitimate interest, for platform security, fraud prevention, and service improvement; and (d) legal obligation, to comply with financial services regulations, FICA, and tax requirements.
We retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy, subject to applicable legal requirements:
We do not sell your personal information. We share data with the following categories of third parties, strictly as necessary to operate our services:
Your referrer (the person whose affiliate link you used to sign up) may see your name, email, and phone number if you consented to referral data sharing during registration.
Aura Terminal uses essential cookies and localStorage for session management, theme preferences, and authentication. We do not use third-party advertising trackers. Campaign tracking uses first-party URL parameters (e.g., ?tag=campaign-name) to measure the effectiveness of marketing campaigns. No data is shared with advertising networks.
As a data subject under POPIA, you have the following rights, which you may exercise at any time by contacting our Information Officer:
You may unsubscribe from marketing emails at any time using the unsubscribe link in every email, or by toggling your preferences in your Aura Terminal settings.
Aura Terminal is not intended for use by persons under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have collected data from a child under 18, we will delete it immediately. If you believe a minor has provided us with personal information, please contact us at the details below.
Your personal information may be transferred to and processed in countries outside South Africa, including the United States (Supabase, Vercel) and the European Union (MetaAPI). In accordance with POPIA Section 72, we ensure that any such transfers are subject to adequate safeguards, including contractual obligations on the receiving party to maintain comparable levels of data protection.
We implement appropriate technical and organisational measures to protect your personal information, in accordance with POPIA Section 19:
Your account manager and authorised team members may view your account interface for the purpose of providing technical support and account management services. This access is read-only — no changes can be made to your account during these sessions. All access is logged in an immutable audit trail. You may request a record of all access sessions by emailing babongilefx@gmail.com with the subject "POPIA Access Request".
In the event of a data breach that may compromise your personal information, we will notify the Information Regulator and affected data subjects as soon as reasonably possible, in accordance with POPIA Section 22. Notification will include the nature of the breach, the categories of data affected, and the measures taken to address it.
For any privacy-related queries, requests, or complaints, please contact our designated Information Officer:
If you are unsatisfied with our response, you may lodge a complaint with the Information Regulator of South Africa.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use of Aura Terminal after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.
This privacy policy is governed by the laws of the Republic of South Africa, including the Protection of Personal Information Act 4 of 2013 (POPIA), the Electronic Communications and Transactions Act 25 of 2002 (ECTA), and the Financial Intelligence Centre Act 38 of 2001 (FICA). Plug 'n Play Trading Tech (Pty) Ltd is an authorised Financial Services Provider (FSP 51478).