Privacy Policy


This Privacy Policy explains how Nevlin Ltd., which develops and operates Nevlin™ ("Nevlin Ltd.", "we", "us" or "our"), handles the personal data of users of the website nevlin.com, our web funnels and the Nevlin app ("Website" or "Service"), which are sold to users by the Sellers described in Section 1.


Important Privacy Information

To use Nevlin, we ask for basic information such as your name, email address, date of birth, and a few onboarding answers about your trading/investing experience and goals, so we can personalise your learning path. We also automatically collect technical information from your device (IP address, device type, operating system, language and time-zone settings) to run the Service securely.

Because Nevlin is a paid subscription product, we also take steps to confirm that payments made on the Service are genuine. For every payment we run automated checks (such as card verification and fraud/sanctions screening). In specific situations — for example, a payment dispute, a refund request outside our normal window, or a mismatch between the cardholder's name and your account — we may ask you to confirm your identity, using methods chosen at our discretion, in order for you to continue using paid features. This protects you from unauthorized use of your card and helps us meet the requirements of our payment partners. Sections 2 and 3 below explain exactly what we may ask for and why.

For more on what we do with your data, your rights, and who controls it, please read on — or contact us at privacy@nevlin.com.

This Privacy Policy explains what personal data is collected when you use the Nevlin website located at nevlin.com and the mobile application and services provided through it (together, the "Service"), and how that personal data is processed.

The Service is intended only for adults aged 18 or over (see Section 6). If you do not want us to process your personal data as described in this Privacy Policy, please do not use the Service, and contact us if you would like us to delete your data or need help cancelling a subscription.

Key definitions

  • "GDPR" means the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
  • "EEA" includes all current member states of the European Union and the European Economic Area; for the purposes of this Policy, the EEA also includes the United Kingdom.
  • "Process", in respect of personal data, includes to collect, store, use, and disclose personal data to others.
  • "Personal data" means any information relating to an identified or identifiable natural person, as defined in Article 4(1) GDPR.
  • "Seller" means the company that sells you your subscription through our Website, web funnels or apps and bills a particular charge, as described in Section 1.


TABLE OF CONTENTS

1. Who Is Responsible for Your Personal Data

2. Categories of Personal Data we Collect

3. Purposes of Processing and Legal Bases

4. With Whom We Share Your Personal Data

5. How You Can Exercise Your Privacy Rights

6. Age Limitation

7. International Data Transfers

8. Changes to This Privacy Policy

9. US State Privacy Rights

10. Data Retention

11. How "Do Not Track" Requests Are Handled

12. Federal Privacy Notice

13. Contact Us



  1. Who Is Responsible for Your Personal Data

Nevlin Ltd., a company incorporated in the Republic of Cyprus with registration number HE 497956, having its registered office at Spyrou Kyprianou, 38, Germasogeia, Limassol, 4042, Cyprus ("Nevlin Ltd."), develops and operates the Service and is the controller of your personal data, except as described below.

Subscriptions bought through our Website, web funnels or apps (other than through the Apple App Store or Google Play) are sold to you by one of the following Sellers:

  • Nevlin Solutions Corp., a corporation incorporated under the laws of the State of Delaware, United States, with registration number 10788756 and registered office at 108 W. 13th Street, Suite 100, Wilmington, New Castle County, Delaware 19801, United States, our authorized distributor in the United States;
  • Nevlin Ltd.; and
  • Manticrest Ltd., a company incorporated in Hong Kong with registration number 81318400 and registered address at Unit 2904-05, 29/F, Universal Trade Centre, 3 Arbuthnot Road, Central, Hong Kong, an authorized distributor of the Service.

Before you pay, you accept our Terms and Conditions, which name every company that may bill you. The Seller of your first payment, and its country, is shown at checkout, where you agree that your saved card may be stored and charged for your subscription, including renewals, by any of these Sellers. The Seller of each charge is identified, together with the Nevlin brand, on your bank or card statement and named in the receipt for that charge. If you subscribe through the Apple App Store or Google Play, the Seller is the Nevlin company that publishes the app in that store.

Each Seller is a separate controller of the records of the charges it bills (such as the transaction reference, amount, date, card brand and last four digits, billing country and postal code, and any refund or chargeback), which it uses only to perform its sales contract with you, to meet card network and payment provider rules, for tax and accounting, to comply with the law, and to handle disputes and legal claims. Nevlin Ltd. keeps and processes these records on behalf of each other Seller. You can contact us at privacy@nevlin.com about data held by any of these companies.


  1. Categories of Personal Data we Collect

We process data (i) that you give us directly — for example, when you complete onboarding or contact support — and (ii) that we collect automatically when you use the Service.


2.1 Data you give us

  • Identifiers and onboarding data. Name, email address, date of birth, country, and your self-reported trading/investing experience level and learning goals, provided when you register and complete the onboarding questions.
  • Commercial information. When you subscribe, you enter your card or payment-account details into secure payment fields provided by our payment processors, on the merchant account of the Seller of that charge. We do not collect or store full card numbers; we may receive a secure payment token, the last digits of your card, and details of the plan, date, and amount of each transaction.
  • Support communications. Any information you provide through our "Contact us" form, in-app chat, or support emails, including the content of your message.
  • Job application data. We collect your resume and contact details solely for the purpose of evaluating your applications.
  • Identity verification data. If your account or a payment you make is selected for enhanced verification under the risk-based checks described in Section 3, we may ask you to provide: documents that identify you; and, in limited cases, proof of address or confirmation of the last four digits of the payment card used. We only request this where a specific risk indicator applies (for example, a payment dispute, an out-of-window refund request, or a mismatch between the cardholder's name and your account name) — it is not required from every user by default.


2.2 Data we collect automatically

  • Acquisition data. The referring URL or advertising campaign that brought you to the Service.
  • Device and location data. Language settings, IP address, time zone, device type and model, device settings, operating system and version.
  • Usage data. How you interact with lessons and courses, your progress and streaks, and your activity within the practice simulator, which uses virtual, non-withdrawable funds only — the simulator does not connect to any real brokerage or bank account.
  • Transaction data. Date, time, and amount of each transaction, and the type of payment method used.
  • Automated fraud and verification signals. For every payment we automatically generate certain technical signals, including address-verification (AVS) results, card-network fraud scores, a device fingerprint, and the outcome of automated sanctions and Politically Exposed Persons ("PEP") screening. These signals let us confirm that most payments are genuine without asking you for any documents.
  • Cookies and similar technologies. We use cookies, SDKs and similar technologies to operate the Service, remember your preferences, measure how the Service is used, and support advertising. A session cookie expires when you close your browser; a persistent cookie remains on your device for a set period. You can disable most cookies through your browser or device settings; some features may not work as intended if you do.


The sections below set out why we process your personal data, which categories of data are involved, and the legal basis we rely on under the GDPR. Because Nevlin Ltd. is established in the European Union, the GDPR applies to its processing of your personal data wherever you are located.


To provide the Service

We use your data to create and run your account, deliver lessons and courses, and operate the practice simulator (virtual funds only, no withdrawals). Data categories: Identifiers, onboarding data, usage data. Legal basis: Performance of contract; legitimate interest in protecting our legal rights after the relationship ends.


To communicate with you

We email you about your account, product updates, and important changes. You can unsubscribe from non-essential messages at any time. Data categories: Identifiers, contact data. Legal basis: Legitimate interest (customer engagement) or consent.


To personalise and measure advertising

We and advertising partners such as [e.g. Meta, Google, TikTok] use your data to show relevant ads and measure campaign performance. Data categories: Onboarding data, device/location data, advertising identifiers, cookies. Legal basis: Consent, or legitimate interest where consent is not required under applicable law.


To provide customer support

We use your data to respond to support requests, using tools such as [helpdesk / live-chat provider]. Data categories: Identifiers, contact data, usage data. Legal basis: Performance of contract; legitimate interest in resolving requests.


To research and improve the Service

We analyse how learners use lessons, courses and the simulator (for example, which topics are most engaging) using tools such as [e.g. Amplitude, Google Analytics], to improve our curriculum and product. Data categories: Device data, usage data. Legal basis: Legitimate interest (product improvement).


To send marketing communications

With your consent (or another applicable legal basis), we may tell you about new courses, features, or offers, using tools such as [e.g. ActiveCampaign]. Data categories: Identifiers, contact data. Legal basis: Consent, or legitimate interest where permitted.


To process your subscription payment

For subscriptions bought through our Website, web funnels or apps (other than through the Apple App Store or Google Play), we use payment processors such as [e.g. Solidgate, PayPal] to charge your chosen payment method on the merchant account of the Seller of each charge (see Section 1). Nevlin Ltd. operates the checkout and the payment integrations on behalf of each Seller, and the Seller of a charge handles refunds and chargebacks for that charge. If you cancel your subscription in the app or through support, no further charges are made by any Seller. We keep records of your acceptance of the Terms and Conditions and of your consent to recurring charges (including the version you accepted and technical logs), so that we can show them if a charge is disputed. If you subscribe through the Apple App Store or Google Play, Apple or Google processes the payment under its own terms. We never see or store your full card number. Data categories: Commercial/transaction data. Legal basis: Performance of contract, including disclosing to the Seller of a charge the data it needs to bill you and to handle refunds and chargebacks; legitimate interest in handling payments, disputes and each Seller's tax obligations.


To enforce our Terms and prevent fraud generally

We use your data to enforce our agreements, investigate suspected misuse, and protect Nevlin and other users from fraud or abuse. Data categories: All categories. Legal basis: Performance of contract; legitimate interest.


To comply with legal obligations

We process, and where legally required disclose, your data to comply with applicable law, including tax, accounting, and lawful law-enforcement requests. Data categories: All categories. Legal basis: Legal obligation.


  1. With Whom We Share Your Personal Data

We share personal data with third parties that help us operate, provide, improve, and market the Service, and for the purposes set out in Section 3. The categories of recipients include:

  • Sellers of your subscription. Nevlin Ltd. shares with the Seller of each charge (Nevlin Solutions Corp. or Manticrest Ltd., see Section 1) only the data that Seller needs to bill you, to handle refunds and chargebacks, and to meet its tax and legal obligations: the records of that charge and, where needed to issue a refund or defend a chargeback, records of your use of and access to the Service. Your name and email address, and any identity verification data, are shared with a Seller only where needed for a specific dispute, request or claim. No Seller receives the financial information you enter in the Service, such as your answers about your income, savings or retirement goals. Each Seller may use the data it receives only for these purposes and may not sell it or use it for marketing. Our relationship with each Seller is governed by a data processing agreement.
  • Cloud hosting providers [Amazon Web Services].
  • Analytics providers [Meta, Google, Amplitude].
  • Marketing and advertising partners [Meta, Google, ActiveCampaign].
  • Payment processing providers [Solidgate, PayPal, ApplePay, GooglePay].
  • Communication providers [FreshDesk,OpenAI].
  • Law enforcement and other public authorities, to enforce our Terms, protect our rights or those of our users, or respond to lawful requests from courts, regulators, or government authorities.
  • Parties to a corporate transaction, such as a merger, acquisition, reorganisation, or asset sale, in which personal data may be a transferred business asset.


  1. How You Can Exercise Your Privacy Rights

Subject to applicable law, you have the following rights over your personal data:

  • Access, correction, and update. Request a copy of your personal data, or ask us to correct or update it.
  • Deletion. Request erasure of your personal data. We will honour this request except to the extent we are legally required, or reasonably need, to retain certain data — for example, identity verification records or transaction records, as described in Section 10.
  • Objection and restriction. Ask us to stop or limit certain processing, such as marketing.
  • Marketing opt-out. Unsubscribe from marketing emails at any time using the link in the email footer, or by contacting us.
  • E-privacy / cookie settings. Manage non-essential cookies and tracking through the privacy settings available in the Service's footer, menu, or profile section.
  • Ad personalisation settings. You can also limit personalised advertising directly through your device: on iOS and Android, in the device's advertising/privacy settings; on macOS and Windows, in the system privacy settings. Industry opt-out tools are also available through the Network Advertising Initiative, the Digital Advertising Alliance, and their EU/Canada equivalents.
  • Complaint to a supervisory authority. If you are based in the EEA, you may lodge a complaint with the data protection authority in the EU member state where you live, work, or where the alleged infringement occurred. Nevlin Ltd. is supervised by the Commissioner for Personal Data Protection of the Republic of Cyprus.
  • Data portability. Request your personal data in a commonly used, machine-readable format.

To exercise any of these rights, please contact us at privacy@nevlin.com, including for data held by any Seller.


  1. Age Limitation

Nevlin's Service relates to financial education and requires a valid payment method held in the user's own name. Accordingly, we do not knowingly provide the Service to, or process personal data of, anyone under 18 years of age (or the age of legal majority in their jurisdiction, if higher). If you become aware that anyone under this age has provided us with personal data, please contact us at privacy@nevlin.com.


  1. International Data Transfers

We may transfer personal data to countries other than the one in which it was originally collected, to provide the Service and for the purposes described in this Policy. Nevlin Ltd. is established in Cyprus, and our Service data is hosted by Amazon Web Services in the United States. Data about the charges a Seller bills is made available to that Seller: Nevlin Solutions Corp. in the United States and Manticrest Ltd. in Hong Kong. For these transfers we use the Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum where UK data protection law applies, and we assess the laws of the receiving country. For service providers certified under it, we may also rely on the EU-U.S. Data Privacy Framework. Before personal information of residents of Québec is communicated outside Québec, we carry out the assessment required by Québec law. You can ask us for a copy of the relevant safeguards at privacy@nevlin.com.


  1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by other reasonable means, and you will have an opportunity to review the revised Policy before it takes effect. Where the law requires your consent to a change, we will ask for it.


  1. US State Privacy Rights

This section applies to residents of California, United States, and of other US states with comprehensive privacy laws, and provides additional detail required under the California Consumer Privacy Act ("CCPA") and California's Shine the Light law.

For these laws, Nevlin Ltd. is the "business" for your personal information, and each Seller is a separate business only for the records of the charges it bills. Disclosures to a Seller are made to perform your purchase contract with it and are not a "sale" or "sharing" of your personal information. Information covered by our federal privacy notice (Section 12) is exempt from these laws to the extent provided by law.

  • Shine the Light. California residents may ask us once a year what personal information, if any, we share with third parties for those third parties' own direct marketing purposes. We do not share your personal information with third parties for their own direct marketing purposes within the meaning of that law.
  • Sensitive personal information. Identity verification data described in Section 2 and financial information you enter in the Service may constitute "sensitive personal information" under the California Privacy Rights Act. We collect and use it only for the purposes of providing the Service and the identity-verification and fraud-prevention purpose described in Section 3, and we do not sell or share it.
  • Right to opt out of sale/sharing. We use advertising pixels and similar technologies from Meta, Google and TikTok, which may be a "sale" or "sharing" of personal information (identifiers, device data, usage data and inferences) for targeted advertising under US state laws. You can opt out through the "Your Privacy Choices" link in the footer of the Website and in the app settings, or by emailing privacy@nevlin.com. We treat a Global Privacy Control or other recognized opt-out preference signal sent by your browser as a valid request to opt out for that browser or device.
  • Your rights and appeals. Subject to the law of your state, you have the right to know, access, correct and delete your personal information, to opt out of its sale, sharing or use for targeted advertising, and to appeal our decision on your request by emailing privacy@nevlin.com with the subject line "Privacy appeal". We will not discriminate against you for exercising these rights.


  1. Data Retention

We retain personal data for as long as reasonably necessary to achieve the purposes set out in this Policy, including for as long as you hold an account with us, and as needed to comply with our legal obligations, resolve disputes, and enforce our agreements. Two specific periods apply:

  • Identity verification data (Section 2.1) is retained for five (5) years from the date of verification, in line with international good practice for payment fraud-prevention records, after which it is securely deleted unless a longer period is required by law or to resolve an ongoing dispute.
  • Commercial and transaction data is retained by the Seller of each charge for as long as required under applicable accounting and tax law and card network rules, in principle for no longer than seven years after the end of the tax year of the charge. Support correspondence about a charge may be kept as part of those records for the same period.

Even after you submit a deletion request, a limited subset of data needed to meet these retention obligations may be kept until that obligation is satisfied.


  1. How "Do Not Track" Requests Are Handled

Except as otherwise described in this Policy, the Service does not currently respond to browser "Do Not Track" signals. Please refer to the privacy policies of the third-party services we use (Section 4) to see whether they honour such signals. We do honour Global Privacy Control signals as described in Section 9.


  1. Federal Privacy Notice

If you are a consumer in the United States, we also provide a privacy notice in the standard federal format used under the Gramm-Leach-Bliley Act ("GLBA"). We provide it because we ask you about your personal financial situation and offer educational content on managing personal finances. That notice describes the categories of nonpublic personal information we collect, the reasons we share it, whether you can limit that sharing, and how we protect it. The notice is given by the Seller that has the customer relationship with you, and it names each company that may bill you.

The notice is available at https://legal.nevlin.com/glba-privacy-notice and is also made available to you at the time you become a customer and annually thereafter where required.

Where the GLBA notice and this Privacy Policy address the same information, the GLBA notice governs with respect to the nonpublic personal information it covers. Nothing in this Privacy Policy limits the rights you have under the GLBA or under the privacy rules of your state.


Date of last revision: November 7, 2026


  1. Contact Us

NEVLIN SOLUTIONS CORP., a corporation incorporated under the laws of the State of Delaware, United States, with the registration number 10788756, having its registered office at 108 W. 13th Street, Suite 100, Wilmington, New Castle County, Delaware 19801, United States


Email: privacy@nevlin.com


© NEVLIN LIMITED 2026 All rights reserved.