Privacy Policy

Who we are

AfroExch (part of the AfriComX network) is a Pan-African digital commodity exchange and cross-border settlement platform, operated by TranSecure Consulting Limited, a company registered in England and Wales (company no. 15101385), registered office 124 City Road, London, EC1V 2NX. For privacy questions or requests, contact privacy@afroexch.evolvpoint.com.

Information we collect

We collect the following categories of information as part of operating the exchange:

• Account information: email address, password (stored as a salted hash, never in plain text), display name, and account role.
• Business / participant information (KYB): legal entity name, participant type (e.g. exporter, importer, bank, government body), country of registration, and verification status — collected when you register an organization to trade on the exchange, and reviewed by our compliance staff.
• Trading and settlement data: listings, offers, and trades you create or participate in (commodities, quantities, pricing), wallet balances, ledger entries, and cross-border payment records (including ISO 20022 payment messages generated for settlement).
• Compliance and risk data: to meet anti-money-laundering and sanctions obligations, we screen trades and participants for sanctioned jurisdictions, export-controlled commodities, and fraud indicators (for example, circular trading patterns or newly-registered counterparties transacting at high value). This necessarily includes information about your trading counterparties as well as you.
• Security data: if you enable two-factor authentication, we store a TOTP secret (not your authenticator app itself); we also issue and track session tokens needed to keep you signed in securely.
• Trade documents: commercial invoices, packing lists, certificates of origin, and similar trade-documentation records associated with your trades, some auto-generated and some you add manually.
• Logistics data: shipment records you create (commodity, quantity, origin/destination country, carrier) and their tracking history.
• AI Copilot questions: if you use the AI Trade Copilot, the question you type — together with aggregated platform analytics as context — is sent to our AI provider, Anthropic, to generate a response. See "Third parties" below.
• Technical data: standard infrastructure logs (IP address, timestamps, request metadata) generated by our hosting provider as part of running the service.

How we use this information

We use the information above to:

• Operate your account and authenticate you securely;
• Match, price, and settle trades between participants;
• Meet legal and regulatory obligations, including sanctions screening and fraud prevention;
• Generate the trade documents and shipment records you request;
• Respond to AI Copilot questions you choose to ask;
• Maintain the security and reliability of the platform.

Platform-wide trading analytics shown on the dashboard (aggregate trade counts, most-traded commodities, average compliance risk) are aggregated figures and are publicly viewable — they are not tied to your individual identity in that view.

Who we share it with

• Other participants in a trade: when you trade with another participant, they see the trade terms and information necessary to complete settlement — this is inherent to how the exchange works.
• Anthropic (AI provider): AI Copilot questions and grounding analytics are sent to Anthropic to generate responses, if and only if you use that feature.
• netcup GmbH (infrastructure provider): our backend, database, and messaging infrastructure run on netcup's servers.
• Regulators and law enforcement where required by applicable law (e.g., sanctions or AML reporting obligations).

We do not currently send real emails or SMS messages to users — notifications shown in the app are recorded and displayed within the platform only. Anthropic and netcup are the only third parties that process platform data today; we do not use any payment processor, third-party KYC/AML vendor, analytics or crash-reporting SDK, or third-party file-storage service.

Data retention

We retain account, trade, and compliance records for 5 years from the end of your relationship with us (or from the date of the relevant transaction), in line with the customer due diligence and record-keeping requirements of the UK Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Where a longer period is required by other applicable law or an ongoing legal or regulatory matter, we retain the relevant records for that longer period.

Your rights

Depending on your jurisdiction, you may have rights to access, correct, or request deletion of your personal information, subject to our legal and regulatory retention obligations (in particular, AML/compliance records generally cannot be deleted on request while a retention obligation applies). To exercise these rights, contact privacy@afroexch.evolvpoint.com.

Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS/TLS), hashed passwords, encrypted signing keys for authentication tokens, and role-based access controls for compliance and administrative staff. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Children's privacy

AfroExch is a business-to-business commodity trading platform and is not directed at, or intended for use by, children. We do not knowingly collect information from children.

Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above.