Privacy Notice
Privacy Notice - Allocaria
1. Who is responsible
The controller of your personal data is the operator of Allocaria, an individual based in the European Union ("we", "us"). Every question or request about your data goes to info@allocaria.com. We have not appointed a data protection officer.
2. What we process, why, and on what basis
| Data | Purpose | Legal basis (Art 6 GDPR) |
|---|---|---|
| E-mail address, password (stored only as a hash), display name, sign-in method (password or Google), two-factor secret and hashed backup codes, quick-unlock PIN (stored as a hash), role and plan status | create and run your account; sign you in; keep it secure | performance of the contract (b) |
| Portfolio data you enter or import (holdings, transactions, tax lots; for files you upload for import, the holdings read from them, not the files) | provide portfolio analytics, tax-free dates, reports | performance of the contract (b) |
| Profile and settings (tax residence, risk level, goals, starting capital) | personalise calculations and scenarios | performance of the contract (b) |
| Other records tied to your account, where you use the feature: username (the same as your sign-up e-mail), Google account id, goals, investment policy statement, watchlist, onboarding drafts, records of items you marked as done, alert preferences, trusted devices, push-notification tokens, daily usage counters, import review entries, in-app backup records, one-time token hashes (e-mail verification, password reset, sessions), your e-mail-marketing choice and interface language | provide the features you use; keep the account secure; limit abuse and cost (usage counters) | performance of the contract (b) / legitimate interest (f) |
| Notes you write next to your holdings: text of up to 500 characters per holding, at most 500 notes | keep your own remarks about a holding. Only you see them in the service: no other page, report or tool of the service reads a note, the AI assistant included, and the operator's admin console masks the text. A note is part of your data export and is deleted with your account. A note stays when you sell the position, but it is not shown until you hold that ticker again | performance of the contract (b) |
| A portfolio snapshot you choose to share: the share of each asset class in per cent, the number of your positions (and how many have no price) and the date; the model plan of your risk level (its name and its shares by asset class), which is ticked by default and which you can untick before you publish; and your portfolio health score with its verdict word, such as Good, only if you tick it. Never an amount, a ticker, the name of a security, a return, your name or your e-mail address | publish the snapshot at a private link you create. Anyone who has the link can see it, and search engines are asked not to list it. You choose whether the link works for 7, 30 or 90 days, and you can stop it earlier. Deleting your account deletes the snapshot at once. The snapshot is taken when you create the link and does not change afterwards. Like any page address, the link also appears in our web-server access log | performance of the contract (b): you ask us to publish it |
| Your split-calculator list: the stocks you added to it (ticker and company name), the split rule and the percentages you typed | keep your list between visits on this device. It is stored only in your browser (local storage), is never sent to our servers, and the amount you type is never saved. Pressing Sign out clears the list; an expired session, a password change or deleting your account does not, so it then stays in this browser until you remove the names yourself or clear this site's data | not applicable: we do not receive this data, it stays on your device |
| Questions to the AI assistant and the portfolio information used to answer them | answer your questions; the conversation stays in your browser tab and we do not store its text - we record only metadata (that a question was asked, its length, whether it came with context, and which engine answered) | consent (a), asked before the first question and withdrawable at any time |
| Text, screenshots or files you submit to AI import | read holdings from your statement or screenshot; processed in memory and not stored by us | explicit consent (a), asked every time |
| Your agreement to these documents and your 18+ confirmation: the version, time, IP address and browser | show that you agreed | legal obligation / legitimate interest (c, f) |
| Sign-in and security events: time, event type, IP address, browser (user agent), e-mail used | detect abuse and account takeover; rate-limit sign-in; audit | legitimate interest (f) - security |
| Audit log of account actions (hash-chained; includes the e-mail of the acting account and, for changes to your portfolio, the ticker, quantity and price involved) | a hash-chained record of changes, so that a later alteration can be detected | legitimate interest (f) |
| Web-server access log (IP address, URL path, browser details; one-time tokens in links are redacted) | operate and secure the service | legitimate interest (f) |
| Application and system logs of our servers (errors and, where enabled, requests with IP address) | find faults; operate and secure the service | legitimate interest (f) |
| Anonymous visit counter: the page you open (as a route pattern, never a query string or a ticker), the interface language, the kind of device (phone, tablet or computer), the kind of source you came from (direct, a search engine, a social network or another site - never the address of the referring page), whether you were in the signed-in area, whether your country is one where ratings are not offered, and a hash of your IP address and browser that changes every day. The IP address and the browser string themselves are not stored, no cookie is used, and a browser that sends "Do Not Track" or Global Privacy Control is not counted; you can also switch the counting off for your browser in section 7 ("Do not count my visits") | know how many people use the service, which pages and languages matter and who is on the site now | legitimate interest (f) |
| A request for access, while sign-up is by invitation: the e-mail address and the few words you may add, and the language of the page you sent it from | decide on your request and, if it is accepted, write to you once with the sign-up link | steps at your request before a contract (b) / legitimate interest (f) |
| E-mail we send you: address verification, password reset, security notices about your account, welcome, and any digest you switch on | operate the account; send what you asked for | performance of the contract (b) / your choice |
| E-mail address, source and language on the waitlist | tell you when Allocaria opens to more people or when Pro launches; every message carries an unsubscribe link | consent (a) |
| What you write to us (support and privacy requests) | answer you | legitimate interest (f) / contract (b) |
To apply the list of countries in section 6 of the Terms, our server looks up the country of your IP address in a local database (DB-IP Lite, a country database licensed CC BY 4.0, from https://db-ip.com); the lookup happens on our server, the address is not sent to anyone else for it, and the result is not stored. We do not use advertising trackers or third-party analytics, and we do not sell your data. We do not take payments today; if paid plans start, we will update this notice before any billing data is collected. We do not make decisions with legal or similarly significant effects about you solely by automated means: ratings, estimates and scenarios inform you and you decide.
3. Who receives your data
| Recipient | What for | Data | Where | Safeguards |
|---|---|---|---|---|
| Hetzner Online GmbH | hosting of the service and its backups | all data | Germany | Hetzner processes the data on our behalf on servers in Germany, so hosting involves no transfer outside the EEA |
| Brevo (Sendinblue SAS) | sending service e-mails | your e-mail address, the message and its one-time link | France (hosting by OVH in France and Google Cloud in Belgium) | Brevo is our processor under the data processing agreement that forms part of its terms (Art 28 GDPR); its own sub-processors may transfer data outside the EEA under Standard Contractual Clauses and supplementary measures and, where applicable, the EU-U.S. Data Privacy Framework |
| Google (Sign-in with Google), only if you choose it | sign in | Google account id and e-mail address (Google also sends your name and picture, which we do not store) | United States / worldwide | Google handles the sign-in under its own terms and privacy policy; from its answer we keep only the account id, the e-mail address and whether Google has verified it |
| Google (Gemini API), only when you use the AI assistant or AI import | AI assistant and AI import | your questions, the portfolio facts needed to answer them (tickers, weights, sectors and signals, not money amounts), and the text, screenshots or files you submit for import | United States / worldwide | paid plan: Google's data processing addendum applies, Google does not use the content to improve its products, and it keeps prompts and responses for a limited period only to detect and prevent abuse; free plan: no data processing addendum applies and Google's terms allow it to use the content to improve its products and let human reviewers read it (the terms also say that customers in the European Economic Area, Switzerland and the United Kingdom get the paid plan's data terms for unpaid use as well, but we do not rely on that); the consent window tells you which plan is in use and warns you before anything is sent |
Market-data vendors, named in the Trust Center, supply data to us; our servers ask them for market data only (for example tickers and dates) and they receive nothing about you. We disclose data to authorities only where the law requires it.
Social networks and e-mail, only if you share a link. When you post a share link on a social network or messenger, that network's preview robots fetch the shared page and its picture and process them under the network's own terms; a network may keep its copy of the preview after you stop sharing the link, and we cannot recall it. When you press a share button, your browser opens the network's share page, or your e-mail program, with the link and, for most of them, a short fixed line of text. The button that opens your device's own share sheet (shown only where your device offers one) hands the link, a short fixed line of text and, where the device allows it, the card's picture to the app you pick there.
4. International transfers
Hetzner processes your data in Germany and Brevo in France and Belgium, inside the EEA; Brevo's own sub-processors may transfer data outside the EEA, which Brevo's terms cover with Standard Contractual Clauses and supplementary measures and, where applicable, the EU-U.S. Data Privacy Framework. Google may process data in the United States and other countries when you use Sign-in with Google or the AI features. For Sign-in with Google, Google acts under its own terms and privacy policy. For the AI features we rely on Google's data processing addendum on the paid plan; on the free plan no such addendum applies, and the transfer then rests on your explicit consent (Art 49(1)(a) GDPR), which we ask for before anything is sent.
5. How long we keep data
| Data | Kept |
|---|---|
| Account, portfolio, profile, any saved assistant files and other account data | while your account exists; after you delete the account, sign-in stops immediately and the data is erased automatically after 30 days |
| Notes next to your holdings | while your account exists, until you delete the note; a note of a position you sold stays, hidden, until you hold that ticker again and delete it, or until your account is erased (automatically 30 days after you delete the account) |
| Shared portfolio snapshots | The link works for the 7, 30 or 90 days you chose. Stop sharing deletes the snapshot and ends the link at once. An expired snapshot is no longer shown and is deleted from our database the next time any link is created on the service. Deleting your account deletes your snapshots at once. They are part of your data export, without the secret part of the link. |
| Split-calculator list | not kept by us: it stays only in your browser on this device, until you press Sign out, remove the names or clear this site's data |
| Records of your agreement to these documents | while your account exists; after erasure only the kind of agreement, its version and time remain, without e-mail, IP address or browser details |
| Sign-in and security events | while your account exists; after erasure only the event type and time remain, without e-mail, IP address or browser details |
| Audit log of account actions | kept as a hash-chained record without a fixed end date; it is not erased with the account: it keeps the e-mail of the acting account, its entries about changes to your portfolio can contain the ticker, quantity and price involved, and it is not part of the account export (write to us for a copy of the entries about you) |
| Files and screenshots uploaded for AI import | not stored by us: they are processed in memory and sent to the AI provider; the holdings read from them are kept as part of your portfolio data |
| Web-server access log | rotated by size and age: at most ten files of 10 MB are kept, and a file older than 90 days is removed |
| Application and system logs | kept on the server until the log is rotated or the service container is replaced (for example at a software update); there is no fixed time limit |
| Anonymous visit counter | 90 days, then deleted. The salt behind the daily hash is random, is kept for one day only and is deleted when the next day's salt is made, so a hash of one day cannot be recomputed afterwards or linked to the next day |
| Requests for access | an open request until we decide on it; a declined request is deleted after 90 days and an accepted one after 365 days |
| Backups | a daily copy of the database is kept for 14 days on the same server; copies taken before software updates are kept longer - at least the ten newest, with no fixed end date; there is no off-site copy; erased data disappears from the daily copies as they expire and stays in the update copies until we remove them; we do not restore an erased account from a backup |
| Log of service e-mails at our e-mail provider | the provider keeps a log of the service e-mails it sends for us (recipient address, time, delivery status and a preview of the message with its one-time link); its default is no time limit and we have not shortened it, so this log is not erased with your account - write to us and we will ask the provider to delete the entries for your address; the links stop working once used or expired (24 hours for address confirmation, 2 hours for a password reset) |
| Subscription and billing records | kept after erasure for accounting; they hold only plan status and payment-provider identifiers, with no name or e-mail address (we take no payments today) |
| Waitlist e-mail | until you unsubscribe or ask us to delete it, or the waitlist closes |
| What you write to us | as long as needed to handle your request and any follow-up |
6. Your rights
You can access and export your data (account settings), correct it, delete your account (settings), object to processing based on legitimate interests, restrict processing, and withdraw consent at any time: the AI assistant has a switch in its panel, you can decline AI import each time, and every waitlist message has an unsubscribe link. You can stop sharing a portfolio snapshot at any time with one button (Stop sharing, on the Share page; the link stops working at once), and you can edit or delete the notes of the positions you hold, and the entries you typed yourself, at any time. A note of a position you sold is hidden until you hold that ticker again; to have it deleted sooner, write to us or delete your account. You can also write to info@allocaria.com; we answer within one month and may ask you to confirm your identity first. You can lodge a complaint with a data-protection authority, in particular in the country where you live or work (the authorities are listed at edpb.europa.eu).
8. Security
HTTPS with HSTS; passwords and sign-in tokens stored only as hashes; optional two-factor sign-in; rate-limited sign-in; sessions end on password change; access checks per account. We hold no security certification and have had no external security audit. We do not separately encrypt stored data beyond the hosting provider's protection, and the two-factor secret is stored as issued. If a breach affects your personal data we will tell you and the authorities as the law requires.
9. Children
The service is for adults (18+). We ask you to confirm that you are 18 or older when you sign up, and we do not knowingly collect data of minors.
10. Changes
We will update this notice when our processing changes. A new version is published on this page with its version number and the date from which it applies, and it takes effect on that date. A person who has never agreed to this notice is asked to accept it in a window before continuing.