Privacy Policy

General

Recube Technologies LLP (“the LLP” or “Recube Technologies” or “we”) is the owner of the website www.investify.pk (“the Website”) and the Investify mobile application (“the App”; collectively and separately known as “the Service”). Recube Technologies is committed to protecting your privacy and we understand you want to keep your information private, safe and discrete. This Privacy Policy is designed to help you decide whether to use the Service and in what manner, and it describes how we collect, store and use information on individuals who use the Service.

The Services hereunder are offered by Recube Technologies LLP, registered at:
Recube Technologies LLP,
Garden East, Karachi,
Pakistan

Consent to use Information

This Policy is a legally binding agreement between you (“you” or “user”) and us. By visiting, accessing or using the Website or App, or providing information to us in any other format, you agree to and accept the terms of this Privacy Policy, as amended from time to time, and you consent to the collection and use of information in the manner set out in this Policy. We encourage you to review this Policy carefully and to periodically refer to it so that you understand it and its subsequent changes if any. IF YOU DO NOT AGREE TO THE TERMS OF THIS PRIVACY POLICY, PLEASE STOP USING THE SERVICE IMMEDIATELY AND WHERE RELEVANT UNINSTALL.

The definitions in the Terms and Conditions apply to this Privacy Policy unless stated otherwise. IN ADDITION TO THIS POLICY, PLEASE REVIEW OUR TERMS AND CONDITIONS WHICH ARE INCORPORATED HEREIN BY REFERENCE, TOGETHER WITH SUCH OTHER POLICIES OF WHICH YOU MAY BE NOTIFIED OF BY US FROM TIME TO TIME.

What Information Do We Collect?

We collect two types of data and information from you:

(1) Non-Personal Information – We retain some non-personally identifiable information (“Non-Personal Information”), such as your approximate geo-location, your web request, browser type, browser language, web pages you visit before or after visiting our Website or using the App, URLs, platform type, click numbers, landing pages, viewed pages and the order of those pages and time spent on pages. This information is collected and retained for security reasons and so that we can audit and statistically track usage, audit our affiliates, and calculate payments to third parties.

“Cookies” - Non-Personal Information may be collected, inter alia, through the use of cookies, so when accessing or using the Website, we may use one or more cookies. Cookies are small text files, placed on a user's device, which enable a website to remember user preferences. 

(2) Personal Information - “Personal Information” is information that may be of a private or sensitive nature, including your name, gender, phone number, e-mail address or mailing address, payment information and IP address. We collect your IP address as part of your use of the Service. We also collect the following Personal Information from you when you create an account (“Account”) on the Website or App which is required to access certain parts of the Service: your full name, email address, password, and phone number.

After you provide us with this information, we will retain it in our records and process it only in accordance with the provisions of this Privacy Policy. Please refer to the Who Else Receives this Information? section of this Privacy Policy to learn about sharing of Personal Information. 

In the future, you may also be able to create an Account using your credentials with a designated third party website or service such as Facebook, Google+ or Twitter (“Third Party Account”). Doing so will enable you to login to your Account via your Third Party Account. If you choose this option, a Third Party Account pop-up box will appear at the time of creating your Account which you will need to approve in order to proceed with the Account opening, and which will describe the types of information that we will obtain from and the types of activities that we may perform in connection with your Third Party Account. Such information may include (but not be limited to) your Personal Information stored on this Third Party Account, such as your user name, email address, profile picture, gender, date of birth and any other information which you have chosen to make profile on such Third Party Account. Please note that once your Account has been opened, the Personal Information we have access to via a Third Party Account is also dependent on your individual privacy settings in such Third Party Account and any privacy policies which are maintained by the providers of such Third Party Accounts.

We treat any Non-Personal Information which is specifically connected or linked to any Personal Information as Personal Information.

We collect and process the Personal Information referred to above based, where applicable, on your consent, where the processing is necessary for the performance of a contract between you and the LLP or where the processing is necessary for the purpose of fulfilling a legitimate interest pursued by us.

Data Collection and Processing Details

Depending on how you use the Service, we may process the following categories of information:

• IP address: including the full, unmasked Internet Protocol address where required for advertising, security, fraud prevention, attribution or related technical purposes.
• Device identifiers: browser, device, app-instance, advertising and similar online identifiers, together with browser and operating-system details.
• Precise location data: such as latitude, longitude, postcode or similarly granular location information where enabled, permitted and covered by the required consent.
• Cookies and network information: browser language, cookies, local storage, network details and related online identifiers.
• Usage and service activity: the pages, screens, features and actions you use, including traffic and usage patterns.
• Push-notification tokens: the browser or device token needed to deliver notifications when you enable them.

These details help us keep you signed in, remember preferences, provide the Service across devices, diagnose errors, measure performance, prevent abuse and fraud, protect accounts and systems, and improve the Service.

Processing of IP Addresses, Device Identifiers and Location Data

To provide a secure, high-performance and relevant advertising environment, we and our authorized advertising technology partners, including Google Ad Manager, demand-side platforms and bidding partners, may collect and process the full, unmasked Internet Protocol (IP) address of your device, together with device identifiers, app-instance identifiers, browser information and related network data.

We use this information for the following purposes:

• Security and Fraud Prevention: identifying and mitigating invalid traffic, botnets, click farms and non-human engagement.
• Precise Geolocation: using device or network information to determine granular location, such as neighbourhood or postcode, for relevant content and advertising where permitted.
• Ad Delivery and Attribution: frequency capping advertisements and measuring whether an advertisement led to a specific action.

Where applicable under GDPR, UK GDPR or similar law, our legal bases and consent requirements include:

• Security, fraud prevention and debugging: processing may rely on legitimate interests, including IAB TCF Special Purpose 2.
• Precise geolocation and personalized advertising: processing occurs only where the required explicit consent has been obtained through the applicable consent-management platform, including the relevant IAB TCF Feature 3 signal.

You may withdraw that consent using the privacy or cookie settings made available through the Service.

For advertising and bidding, information may be shared with the following recipients:

• Ad Technology Providers and Demand-Side Platforms: the full IP address and related technical information may be shared in real time with authorized advertising technology providers, demand-side platforms and other bidding partners.
• Permitted uses: recipients may use the information only for the disclosed advertising, measurement, security and fraud-prevention purposes and under their applicable privacy terms.
• Google disclosure: for more information about how Google uses information from sites or apps that use its services, see Google's partner-services privacy information.
• Vendor disclosures: the applicable consent-management platform provides the relevant vendor and partner disclosures.

We may use Google/Firebase Analytics, PostHog, Cloudflare Web Analytics or similar providers to measure page views, usage, errors, performance and feature adoption. We may also use advertising and measurement technologies to show, measure or personalize advertisements and offers, where permitted by applicable law and your settings. These providers may process device, browser, network, location and usage information under their own privacy policies. We do not sell your Personal Information for money; any sharing for advertising or measurement is subject to the purposes, choices and disclosures described in this Policy.

What is the Purpose of Collecting this Information?

In order to access our services, users may be asked to fill in a form, providing some personal information to the LLP. Answers to questions on Personal Information are all mandatory. Failure to complete mandatory fields or providing incorrect Personal Information may prevent us from fully providing the requested information or services. Please note that you are under no legal obligation to provide us with your Personal Information, however you may not be able to enjoy our services or access the Site if you fail to do so.

The collection and processing of Personal Information is aimed at providing you with the Service (including setting up your account), to send you marketing offers on products or services we think may be relevant to you, and to fulfill other purposes as provided in this privacy policy.

Non-Personal Information is collected for research and statistical purposes, to enable us to develop, customize and improve the Service, based on your preferences, usage and interactions with the Service, to process your requests for information, and to provide you with the most relevant services and offers.

We may cookies in conjunction with third parties to collect user information. Your Personal Information is collected to enable us to provide you with features, capabilities, offers and marketing materials we or our marketing partners think you may be interested in.

In addition to the above, your Personal Information allows us to provide you with technical assistance and support.

Who Else Receives this Information?

We may share or transfer information, including Personal Information, internally within our organization, for the purposes outlined above.

We also share Personal and Non-Personal Information with trusted third parties, when this is required in order to provide, maintain or improve our services and operation. This includes analytics providers, advertising technology providers, Google Ad Manager, demand-side platforms and authorized bidding partners. We share information with these parties for advertising, attribution, security, fraud prevention and measurement, including providing advertisements and offers we or third parties think may be relevant to you where permitted by law and your choices. These third parties may be located in countries that may provide a different level of protection of privacy than in your jurisdiction.

We share your Personal and Non-Personal Information with (i) third parties which provide services to the LLP in order to allow or enable us to provide you with our Service, including analytics, email services providers and data verifiers; (ii) third parties who provide the LLP services in relation to the operation of the Website or App; (iii) any auditors, contractors or other advisers auditing any of the LLP’s business processes; and (iv) any potential purchasers or investors in the LLP.

If you open an account with us, other users of the Website or App may be able to view the following personal information about you (to the extent that you have provided it to us): your name, display username (nickname), picture and general geographic location (country).

If you have chosen to share Personal Information with us through one of our forms, we may share it with any or all of our third party providers, which may provide you with an offer of their services. Please note that this third party may be considered a “controller” of your Personal Information and the processing of such Personal Information will be subject to such provider's privacy policy.

Any processing performed by any of our third party service providers (“Recipients”) will, where required by law, be governed by a data processing agreement in the form required by law, preserving any and all of your statutory data protection rights and obligating the Recipients to respect the Personal Information and handle it in accordance with the relevant laws. The Recipients are required to maintain the confidentiality of such information and to use your Personal Information only in the course of providing the aforementioned services and only for the purposes that Recube Technologies dictates.

We may also share your Personal Information and other information in special cases if we have a good reason to believe that it is necessary to: (i) comply with law, regulation, subpoena, request by an applicable authority or court order; (ii) detect, prevent or otherwise address fraud, security, violation of our policies or technical issues; (iii) enforce the provisions of this Privacy Policy or any other agreements between you and Recube Technologies, including investigation of potential violations thereof; or (iv) protect against harm to the rights, property or safety of the LLP, its partners, its affiliates, users or the public.

Advertisements

We may use third-party advertising technology to serve advertisements when you access the Service. This technology may use information about your use of the Service, including IP address, cookies, device or app-instance identifiers and related technical data, to deliver, measure, attribute or personalize advertisements. Advertising partners may include Google Ad Manager and its authorized bidding partners, demand-side platforms and other advertising technology providers.

Direct Marketing

We may share your full name, email address and phone number with certain broker(s) (the “Broker”) in the event that you have granted permission to receive promotional materials from such Broker at the time of registration or at a later stage during the use of Website or App. The Broker may periodically use your full name, email address and phone number for the purpose of providing you with promotional materials if your permission was granted at the time of registration or during the use of the Website or App. Please note that in order to send you promotional materials, the Broker may assign you with a username and password which will allow you access to the Broker's site through an account. You may contact the Broker at any time to remove the account.

User Rights and Retention

You have the right to access, correct, update or object to the use of your Personal Information by making a written request to Recube Technologies by using our Contact Us options in the App or Website. Your requests will be dealt with in a prompt and professional manner and in accordance with applicable law.

Opt-Out Options and User Controls

You can control optional processing and exercise your rights through the following controls:

• Global users: withdraw consent for precise tracking, precise geolocation or personalized advertising through the privacy or cookie settings provided by the Service, or by changing your browser or device advertising controls.
• California and other US residents: request to opt out of the sale or sharing of Personal Information by emailing Do Not Sell or Share My Personal Information.
• Marketing: use the unsubscribe link in the relevant message or contact us or the relevant broker to withdraw promotional permission.
• Access, correction and deletion: request access, correction, restriction, deletion or objection to processing by emailing privacy@investify.pk or support@investify.pk.

You can also control or opt out of non-essential cookies and similar technologies through your browser or device settings, including by deleting existing cookies and blocking new ones. Some essential cookies, local storage and similar technologies are required for sign-in, security, preferences and core features; blocking them may prevent parts of the Service from working. We may need to verify your identity before completing a request, and some information may be retained where required for legal, security, fraud-prevention or dispute-resolution purposes.

Data Retention

We keep Personal Information only for as long as reasonably necessary for the purposes described in this Policy. Our usual retention periods are:

• Account, profile, portfolio and watchlist information: while your Account remains active and, after a verified account-deletion request, normally deleted or anonymized within 90 days.
• Authentication, security, fraud-prevention and server logs: normally up to 12 months, unless a longer period is needed to investigate abuse, enforce our Terms or comply with law.
• Analytics, cookie and device-usage information: normally up to 14 months, subject to the settings and retention rules of the relevant analytics provider.
• Advertising IP addresses and related technical data: advertising partners typically anonymize or delete this information within 9 to 18 months, subject to their applicable retention policies and legal requirements.
• Support, payment, accounting, tax and dispute records: normally up to 7 years where needed for legal, accounting, tax or dispute-resolution obligations.

When a retention period expires, we delete, anonymize or securely isolate the information unless we are required or permitted by law to keep it longer. Backups may take additional time to be overwritten through the normal backup cycle.

Children's Information

Our Service is not intended for minors below the age of 16 years or otherwise below the legal age for providing consent that is not subject to authorization by the holder of parental responsibility, in accordance with the laws in the jurisdiction your reside (“Age of Consent”), and we will not knowingly collect Personal Information from children. If we become aware that a user is under the age of Age of Consent, we will remove their information from our files. We reserve the right to request proof of age at any stage so that we can verify that children are not using the Service.

Updates or Amendments to the Privacy Notice

We reserve the right to change this Privacy Notice at any time, so please re-visit this page frequently. Changes to this Privacy Notice are effective as of the stated “Last modified” date, and your continued use of the Service after that date will constitute acceptance of, and agreement to be bound by, those changes.

Security and Confidentiality

The LLP treats your Personal Information in strict confidentiality, and the server in which this data is to be stored includes the necessary industry-standard security measures to prevent accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access. However, we cannot completely guarantee the security of your information, which might be accessed, disclosed, modified, or destroyed, and it should be emphasized that you share this information at your own risk.

Automated Abuse Protection (Cloudflare Turnstile)

To protect signed-in features of the Website and App against automated abuse, we use Cloudflare Turnstile, an invisible verification service provided by Cloudflare, Inc. Turnstile runs only for signed-in users, requires no action from you, and processes limited device and network information (such as your IP address and browser characteristics) solely to distinguish people from automated programs. This processing is governed by the Cloudflare Turnstile Privacy Addendum; see also Cloudflare's Privacy Policy.

Links to Other Websites

This Privacy Policy applies only to the Service, and to our web tools which are integrated or implemented in other third party websites. The Policy does not apply to third party websites, linked to our Website. Third party websites or services may have their own privacy policies and we advise you to read them carefully. Inclusion of a link to a third party website or service is not a recommendation of such a website or service. Third party sites may contain information or services that are illegal or that some people may find inappropriate or offensive. Before using third party sites and services or before making a purchase, we recommend that you read and understand the privacy policies and terms and conditions of such third party websites and services, and the warranties for purchased products. You are knowingly and voluntarily assuming all risks of using third party sites to purchase products and services. You acknowledge and agree that we shall have no liability whatsoever with respect to such third party sites and your use of them.

Assignment

Subject to applicable law, we may transfer or assign your information, without any notice, and without a need to receive your consent, to any third party as a result of change of control, consolidation, merger, acquisition or reorganization. You acknowledge that in the event of bankruptcy, insolvency or receivership, we may have no control over the use and transfer of your Personal Information.

Updates to this policy

This Privacy Policy is subject to modifications. Please check the “Last Modified” heading at the bottom of this document to see when this Privacy Policy was last updated. Any changes to this Privacy Policy will become effective when we post the revised Privacy Policy on the Website. In case of material changes to this Privacy Policy, we will provide a notice in the Website. Your use of the Website or the Service, or your provision of personal information following any changes means that you accept the updated Privacy Policy.

Last modified: October 15, 2026

Community features (stock discussions)

This section explains what we collect and keep when you use the stock discussions and other community features (the “Community”). It is in addition to the rest of this Privacy Policy. Where it differs from the general retention periods above for Community data, or from anything above about what other users can see of your name, picture or country, this section applies for the Community. It is read together with our Community Guidelines and the Community section of our Terms and Conditions.

What is public

• Your community handle, display name and avatar (chosen from a fixed set; there is no photo upload), any badge shown beside your name (such as the “Official” badge on the Investify account, the blue tick or “Top commenter”), the date you joined, and counts such as approved comments and likes received.
• Your approved comments and replies: the text, the stock, the time, any view you chose (bullish, bearish or neutral), @mentions and the number of likes. Anyone can read them without an Account.
• The price of the stock when you posted, shown with each approved comment.
• Search engines may index some comments and profiles (see “Search engines” below).

A community profile shows whether the member has verified a phone number (as a blue tick), but never the number itself.

Your Account name, email address, phone number, network address and the list of comments you have liked are not shown publicly. Who liked a comment is never shown. Comments that are pending, rejected or hidden are visible only to you and to our moderators. Please do not put personal information about yourself or others in a comment, because the text of your comment is public once approved.

What we store that is not public

• Every version of each comment you submit or edit, with the time and the stock, your likes, reports you file about comments or members (reason and optional note), the members you block (with the comment you blocked from and an optional note) and the members who block you, the version of the Community Terms you accepted and when, and notifications.
• Moderation records: the decision on each comment, reason codes, short explanatory notes, the structured answer returned by the automated checks, appeals, rejections, violations and any restrictions or bans on your profile.
• Network address data (see below) and verification records (see below).
• An audit log of actions taken by our moderators, which includes the moderator’s email address.

Our moderators can see more than other users do, including your Account email address, your handle and display name, the full text of your comments (including deleted ones), reports against them or against your profile, how many members have blocked your profile, the moderation records, and the masked and hashed network address data. The person you report is never told that it was you, although moderators can see who sent a report. The person you block is never told either.

Network (IP) addresses

When you post, reply, create or update your community profile, or request a verification code, we read your IP address in order to apply rate limits, stop spam and ban evasion, link rule violations to the right network, and apply network bans. We do not save the raw IP address in the community database. We store:

• a hash of the address (HMAC-SHA256, using a secret key that we keep), and
• a masked form for moderators: the first two parts of an IPv4 address (for example 203.0.x.x), or only part of the network prefix of an IPv6 address.

IPv6 addresses are grouped by their /64 network prefix, because one connection controls a whole prefix, so the hash of an IPv6 address identifies a network and not a single device. A hash is not anonymous. It is pseudonymous information, because someone with our secret key and our database could test guesses of an IPv4 address against it. We therefore treat it as personal information. Hashes and masked forms are never public. They are stored with your comments, with your community profile (the most recent one used), with violation records, with network ban records and with verification requests. Moderators can see the masked form, and the hash in comment, profile and ban views. For security, our servers may also handle the full address briefly in memory, for example to apply rate limits, as described in the rest of this Privacy Policy.

Email and phone verification

You can verify your Account email address, or a Pakistani mobile number, to be able to post sooner. A verified number or email also lets us make sure that the same number or email is not verified on many Accounts, and that a number linked to a permanently banned profile cannot be used to start a new Account.

• What we store: the email address or phone number you ask us to verify (kept in readable form in our database, and saved when you request a code, even if you do not finish verifying), a keyed hash of it, a masked version used for display (for example +92 3** *****67), and the time it was verified.
• Codes: a six-digit code is sent to you and is valid for 10 minutes, with a limited number of attempts. We store only a keyed hash of the code, and clear it when you verify successfully.
• Send log: a short record that a code was sent (channel, provider, a hash of the destination and a hash of your IP address). It is deleted automatically after 2 days.
• How long we keep verification records: while your Account exists. When you delete your Account we delete them, except that a phone number linked to a permanently banned profile is kept so that it stays blocked.
• Who can see them: your masked number or email is shown to you in Settings. Our moderation tools do not show the number. The stored number can be seen by personnel who operate our database.

Who else receives Community data

• AI moderation provider (OpenAI): before a comment appears, the text of the comment, the stock symbol, whether it is a reply, the detected script (such as English or Urdu) and up to 280 characters of the comment you replied to are sent to OpenAI for a moderation check. For handles and display names, only the handle and display name are sent. We do not send your name, email address, phone number, IP address or Account identifier. Comment text may still contain personal information if you wrote it, so please do not include any. OpenAI processes this data under its terms and privacy policy, and may do so outside Pakistan.
• Email delivery: verification codes sent by email go through the email service we use to send Investify mail, and contain your email address and the code.
• WhatsApp and SMS: if you verify a phone number, your number and the code are sent by WhatsApp using the Meta WhatsApp Cloud API, or by SMS through a messaging provider, when those channels are enabled. These providers receive the number and the code.
• Hosting: our servers and database are run with infrastructure providers, mainly located in Germany.
• Authorities and legal requests: we may preserve and disclose Community data to courts, law enforcement and regulators in Pakistan (for example the Pakistan Telecommunication Authority or the National Cyber Crime Investigation Agency) where required by law or lawful order, or where we believe in good faith it is necessary to protect rights or safety or to handle legal claims.

This is in addition to the recipients described in “Who Else Receives this Information?” above.

Automated decisions

Comments are first checked by automated rules and then by an AI service. These checks can reject a comment, hold it for review by a person, or approve it. Repeated rejections add up on your profile and can lead automatically to a temporary and then a permanent restriction on posting. Automated checks make mistakes. You can appeal a rejected comment, and a person decides appeals. You can also write to us at support@investify.pk if you think a restriction is wrong.

How long we keep Community data

Some Community data expires automatically. Other data does not currently have an automatic deletion date, and we keep it for moderation, abuse prevention, resolving disputes and legal claims, and to meet legal requests.

• Notifications (for example replies, mentions and moderation outcomes, with the first part of a comment as an excerpt): deleted automatically after 90 days.
• Network address activity records (hash, masked form, your Account and any violation score and bans): deleted automatically 180 days after the last activity, unless the record belongs to a permanent ban, in which case it is kept. This is separate from the hashes stored on comments, profiles and violation records, which have no automatic deletion date.
• Verification send log: deleted automatically after 2 days.
• Moderation work queue records: deleted automatically 30 days after the review is closed.
• Verification records: kept while your Account exists (see above).
• Comments, earlier versions of comments, rejected and hidden comments, the hashed and masked network addresses stored with them, your community profile, reports, likes, violation records and the moderator audit log: no automatic deletion date at present. We keep them until we delete them.
• Network bans: kept until a moderator removes them, including after they have expired.

If you delete a comment or your Account

• Deleting a comment removes it from public view. Our caches can take some time to refresh. We keep the text, earlier versions and related records in our systems, where our moderators can still read them, for the purposes above. Copies held by search engines or other people are outside our control.
• Deleting your Account aims to remove your profile and comments from public view (your comments then show as “Deleted user”) and deletes your blocks (the members you blocked and the members who blocked you), your notifications and your email and phone verification records (except as stated above for a permanently banned profile). We do not currently erase the text of your comments, your earlier handle and display name, the hashed and masked network address data stored on comments, profiles and violation records, or the moderation and audit records from our database. This differs from the general periods described under “Data Retention” above, and the Community data described here is kept as set out in this section.

If you want us to remove or correct specific Community content or data, write to support@investify.pk with the link and what you want changed. We will consider each request, subject to our legal obligations and our need to handle abuse and legal claims.

Search engines

Approved comments are public. Comments that are long enough and pass our quality checks may be shown in the pages that search engines index, together with your handle and display name. A stock’s discussion page, a single comment page, or a community profile is indexed only when it has enough of such comments. Other comments are loaded in the page for readers. Pages for comments that do not meet this are marked so search engines are asked not to list them, but anyone with the link can open them. When a comment is deleted or rejected it disappears from our pages within a short time, but search engines and other caches can keep a copy until they next visit.

Your choices

In Settings, under Community, you can edit your profile, see your comments and their status, appeal a rejected comment, see and undo the members you blocked, and manage verification. You can delete your own comments from the discussion. To request access to, correction of, or removal of Community data, or to ask a question about this section, email support@investify.pk. We will update this section if the law or our practices change.