Privacy Notice

1. Data controller

[to be configured], located at [to be configured] (the "Controller"), is responsible for processing the personal data collected through VORZA, in accordance with the Mexican Federal Law on the Protection of Personal Data Held by Private Parties and other applicable rules. Version: 2026-11-06.

2. Personal data we process

• Identification and contact: name and email address.
• Authentication: password (stored only as an irreversible hash), sessions and devices.
• Financial and asset data: API keys of your exchanges or brokers (encrypted), balances, positions, orders, trade results, risk settings, payment history and blockchain transaction data.
• Technical data: IP address, device type and operating system, push notification identifier, language, and activity and security logs.

We do not collect sensitive personal data. Biometric unlock (fingerprint or face) is verified only on your device: VORZA never receives or stores biometric data.

3. Purposes

Primary purposes (required for the service):

• Creating, authenticating and managing your account.
• Connecting your exchanges or brokers and sending the orders you authorize, applying your risk settings and syncing your positions.
• Showing you history, statistics and performance.
• Processing and verifying payments and managing your account access.
• Sending operational notifications (signals, executions, risk, security and access alerts).
• Security, fraud prevention, auditing and handling requests.
• Complying with legal obligations and requests from authorities.

Secondary purposes (you may opt out): sending you announcements about the Platform and producing aggregated statistics to improve the service. To opt out, write to [email protected]; this does not affect the service.

4. Consent

By signing up and ticking the corresponding box you give your express consent to the processing of your financial and asset data for the primary purposes. You may revoke it at any time as described in section 6; revocation may mean we can no longer provide the service.

5. Disclosures and transfers

• To the exchanges and brokers you connect: we send your orders and read your account on your instruction, as a necessary part of the service.
• Processors acting on our behalf under confidentiality obligations: hosting and email providers, Google Firebase (push notifications) and AZ Payments (crypto payment processing).
• Competent authorities, when required by law.

We do not sell or rent your personal data. These transfers do not require your consent because they are necessary for our legal relationship with you or required by law. Some processors may host data outside Mexico with equivalent safeguards.

6. ARCO rights and withdrawal of consent

You may Access, Rectify or Cancel your data, Object to its processing, or withdraw your consent by sending a request to [email protected] including:

• Your name and the email of your account.
• A copy of an official ID (or proof of legal representation).
• A clear description of the right you wish to exercise and the data involved.

We will reply within 20 business days and, where applicable, implement the measure within the following 15 business days. You can also delete your account directly in the app (Profile → Security → Delete account).

7. Limiting use and disclosure

You can disable push notifications on your device and ask us not to send secondary-purpose communications by writing to [email protected]. In Mexico you may also register with PROFECO's Public Registry to Avoid Advertising (REPEP).

8. Retention

We keep your data while your account is active. When you delete it, we immediately erase your API keys and device tokens and delete or anonymize your identification data. Payment and trade records are kept, blocked, only for the periods required by tax and legal rules (generally five years) and then deleted.

9. Security

We apply administrative, technical and physical safeguards: AES-256 encryption of credentials, hashed passwords, encrypted connections (TLS), access control, audit logs and session revocation.

10. Cookies and similar technologies

The app does not use cookies or tracking technologies for advertising. The web admin panel only uses a technical session cookie.

11. Minors

VORZA is not directed to people under 18 and we do not knowingly collect their data.

12. Changes to this notice

Any change will be published in the app and at https://vorza.site/legal/privacy with the new version. If the change requires your consent, we will ask for it in the app.

13. Authority

If you believe your right to personal data protection has been violated, you may contact the competent data protection authority.