Privacy Policy

1. Who we are

Myfinfolio (“Myfinfolio”, “we”, “us”) is a portfolio-tracking service operated by Controlplus services bv, a company incorporated in Belgium, VAT BE 0466.057.482 (the “Controller”). We are responsible for the personal data processed through the website myfinfolio.io and the Myfinfolio application (together, the “Service”).

For any privacy question or request you can contact us at privacy@myfinfolio.io.

2. What data we collect

• Account data: e-mail address, authentication identifiers, password hash (or Google account identifier when you sign in with Google).
• Profile data: optional name, country, preferred language and home currency, notification preferences.
• Portfolio data: the shares and crypto positions you enter, including ticker, quantity, purchase price, purchase currency and purchase date, and any price alerts you configure.
• Billing data: subscription status, plan, billing period and payment references. Card details are processed by Stripe and are never stored by us.
• Technical data: IP address, device and browser information, log data and error reports needed to operate and secure the Service.

We do not knowingly collect data from children under 16 and we do not collect special categories of personal data.

3. Why we process your data and on what legal basis

• To provide the Service (accounts, portfolio valuation, weekly summaries, annual tax overviews, alerts) — performance of our contract with you (Art. 6(1)(b) GDPR).
• To take payments and manage subscriptions — performance of a contract and compliance with accounting and tax obligations (Art. 6(1)(b) and (c) GDPR).
• To secure and improve the Service (logging, fraud and abuse prevention, diagnostics) — our legitimate interests (Art. 6(1)(f) GDPR).
• To send service e-mails such as the weekly portfolio summary — performance of our contract; you can switch these off at any time in Settings.

4. Who we share data with

We never sell your personal data. We share it only with processors that help us run the Service, under a data-processing agreement:

• Hosting, database and authentication infrastructure providers;
• Stripe, for payment processing and subscription management;
• Market-data and exchange-rate providers, which receive ticker symbols only;
• Our e-mail delivery provider, for account and summary e-mails;
• Public authorities, where we are legally required to disclose information.

5. International transfers

Some of our providers may process data outside the European Economic Area. Where that happens, the transfer is covered by an adequacy decision of the European Commission or by the Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

6. How long we keep your data

We keep your account and portfolio data for as long as your account exists. After you delete your account we remove or anonymise your data within 30 days, except where we must keep records longer — in particular invoices and accounting records, which Belgian law requires us to keep for seven years.

7. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, where processing is based on consent.

Write to privacy@myfinfolio.io to exercise any of these rights. You also have the right to lodge a complaint with the Belgian Data Protection Authority (Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussels).

8. Cookies and local storage

We use strictly necessary cookies and browser local storage to keep you signed in and to remember your language, home currency and display preferences. We do not use advertising cookies or third-party tracking for marketing purposes.

9. Security

Data is transmitted over encrypted connections and stored with access controls that restrict every record to the account that owns it. Passwords are stored only as cryptographic hashes. No system is perfectly secure, but we review our safeguards regularly and will notify you and the supervisory authority of any breach that requires it.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced in the application or by e-mail before they take effect. The date at the top of this page always shows the current version.