1. Data controller
| Controller | [Legal name / trade name] |
|---|---|
| Tax ID (NIF/CIF) | [NIF/CIF] |
| Address | [Registered postal address] |
| Privacy contact | [[email protected]] |
2. Data we collect
- Account data: email address, display name and an encrypted (hashed) password. If you sign in with Google, we receive your email address, name and profile identifier from Google.
- Usage and workspace data: the companies you analyse or follow, your Signals preferences, settings and technical logs (e.g. session activity and, for security, IP address and timestamps). If you use Portfolio, we also store the transactions you enter (such as symbol, buy/sell type, shares, date, price, fees, taxes, notes and trade currency), together with the holdings and performance figures calculated from them.
- Pro waitlist: if you choose to join, we store the email address you submit and the signup source. There is currently no public paid checkout. If payments are introduced later, this Policy will be updated to identify the processor and billing data involved before payment processing begins.
- Communications: any information you send us by email or through support.
We do not knowingly process special categories of data. Public company figures are not your personal data. Portfolio transactions and the account-specific holdings or performance calculated from them are personal workspace data and remain associated with your authenticated account.
3. Purposes and legal basis
- Provide the Service (create your account, authenticate you, run analyses, maintain your followed companies and Signals preferences, and calculate the private Portfolio view from transactions you choose to enter) — legal basis: performance of a contract (Art. 6.1.b GDPR).
- Manage the Pro waitlist and notify you about availability when you request it — legal basis: your consent, which you can withdraw. Any future paid subscription processing will be documented before checkout is introduced.
- Security and abuse prevention (protect accounts, logs) — legal basis: legitimate interest (Art. 6.1.f).
- Service communications (essential notices about your account) — legal basis: performance of a contract. Any commercial communications, if introduced, would rely on your consent and can be withdrawn at any time.
4. Retention
We keep your account data for as long as your account is active. If you delete your account, we erase or anonymise your data within a reasonable period, except where we must retain certain records (e.g. invoices) to comply with legal obligations, and only for the period required by law.
5. Recipients and processors
We do not sell your personal data. We share it only with providers that process data on our behalf under a data-processing agreement, including:
- Google — sign-in with Google (authentication), when you choose it.
- Cloudflare — content delivery, DNS and secure connection to the site.
- Payment processor (future) — none is used for a public checkout today; any processor will be identified before paid subscriptions launch.
- Email provider — to send you service messages.
We may also disclose data when legally required to do so by a competent authority.
6. International transfers
Some providers (e.g. Google, Cloudflare) may process data outside the European Economic Area. Where that happens, the transfer is protected by appropriate safeguards under the GDPR, such as the European Commission's Standard Contractual Clauses or an adequacy decision.
7. Your rights
You may exercise the following rights free of charge by contacting [[email protected]]:
- Access, rectification and erasure of your data.
- Restriction of, and objection to, processing.
- Data portability.
- Withdrawal of consent at any time (without affecting prior processing).
We may ask you to verify your identity. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es) if you believe your rights have not been respected.
8. Security
We apply appropriate technical and organisational measures to protect your data, including password hashing, encrypted connections (HTTPS) and access controls. No system is completely secure, but we work to reduce risks and to react to any incident.
9. Minors
The Service is intended for users aged 18 or over. We do not knowingly collect data from minors; if we become aware that we have, we will delete it.
10. Changes
We may update this Privacy Policy. We will post the new version here with its date and, where the changes are significant, we will let you know through the Service.