Privacy Policy

1. Account Registration & Identity Data

When you register for an Oroviax account, we collect your email address, your chosen display name, and your account password. Passwords are never stored in plain text; they are hashed immediately using the industry-standard Argon2 cryptographic hashing algorithm before being written to our database.

During registration and sign-in, we also process one-time verification codes (OTPs), account creation and login timestamps, and basic IP-based rate-limiting logs to protect your account against unauthorized access. We use your registration email strictly for essential platform communications — such as signup OTP verification, password recovery, and status updates on your MT5 account connections — as well as responding to support enquiries you submit. We never sell or rent your personal details to third parties.

2. MT5 Credential Storage, Read-Only Scope & Deletion

Read-Only Investor Scope: When you connect an external broker account to Oroviax for performance tracking, we collect only your MT5 account number (login ID), your broker server name, and your read-only Investor Password. Oroviax strictly prohibits and never requests, accepts, or stores master trading passwords. Because investor credentials are read-only at the broker level, Oroviax can never execute trades, modify orders, hold client funds, or process deposits and withdrawals.

Encryption at Rest: All read-only MT5 credentials and synchronization tokens are encrypted prior to database storage using Fernet symmetric encryption (AES-128-CBC with HMAC-SHA256 authentication). We also generate a keyed cryptographic fingerprint (HMAC-SHA256) to identify duplicate account connections without exposing raw credentials in network responses or application logs.

Credential Deletion & Retention: You remain in full control of your linked MT5 credentials at all times:

• If an MT5 connection submission is declined or rejected during verification review, the submitted investor password ciphertext is automatically and permanently wiped from our database immediately upon rejection.
• If you disconnect an MT5 account or request its removal, the stored investor credentials and synchronization session are permanently deleted, and all automated read-only data pulls for that account cease immediately.
• You may also revoke Oroviax's read-only access at any time directly inside your broker's MT5 terminal by changing your Investor Password.

3. Hosting, Infrastructure & Service Providers

To deliver real-time strategy analytics and portfolio verification securely, Oroviax relies on carefully selected infrastructure providers acting as data processors under strict security obligations:

• Cloud Application & Database Hosting: Our backend API, encrypted PostgreSQL database, and scheduled synchronization workers are hosted on dedicated cloud server infrastructure protected by TLS/HTTPS encryption in transit, firewall isolation, and restricted administrative access.
• Web Interface Delivery: The public website and client portal frontend are hosted and served over encrypted global edge networks via Vercel.
• MT5 Read-Only Gateway: Encrypted read-only MT5 connections are synchronized through MetaApi strictly to retrieve historical closed trades, balance operations, and account equity snapshots from your broker's MT5 server.
• Transactional Email Delivery: Essential account verification codes (OTPs) and MT5 connection status notifications are dispatched via Resend.

4. Cookies & Browser Storage

Oroviax uses only strictly necessary first-party cookies and local browser storage required for authentication, security, and core interface functionality:

• Authentication & Session Security: When you sign in, we use a secure, HttpOnly refresh-token cookie and short-lived session tokens to keep you authenticated and protect your session against cross-site request forgery (CSRF) and script injection.
• Interface Preferences: We use browser storage (localStorage and sessionStorage) solely to remember functional UI settings, such as whether your portal navigation sidebar is collapsed or expanded.
• No Advertising or Tracking Cookies: Oroviax does not use third-party advertising cookies, cross-site behavioral tracking pixels, or third-party marketing analytics cookies.

5. Your Data Protection Rights & Contact

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to request access to the personal data we hold about you, request correction of inaccurate information, request complete deletion of your account and stored MT5 data, or object to processing. To exercise any of these rights or ask a question about this Privacy Policy, please reach out to us via our Contact page.