Privacy Policy

The data controller is [LEGAL_NAME], with registered address at [POSTAL_ADDRESS]. For any question about this policy or about how your data is handled, you can contact us at [CONTACT_EMAIL].

IQWallet is operated as a private, individual-use portfolio intelligence tool. We have not appointed a Data Protection Officer because the scale and nature of the processing do not require one under Article 37 GDPR. If that changes, this section will be updated.

We collect only what is needed to run the service for you:

• Account data: your email address, and (if you sign in with Google) your name and public profile. We request from Google only the minimum to identify you. We never request access to your Gmail, Calendar, Drive, or any other Google service.
• Portfolio data you enter: positions, transactions, watchlist, cash, benchmark and display preferences, and any notes you add. This is the data the product exists to manage.
• Technical data needed for security: a session cookie to keep you signed in, your locale preference, and your IP address, used transiently to apply per-address rate limits and prevent abuse. We do not build a profile from it.
• Share-link access logs (only if you create a share link): the time of access, a coarse device category (desktop, mobile, bot, or unknown) and a country code derived from network headers. We do NOT store the IP address of viewers, nor anything that identifies a specific person.

We do not knowingly collect special categories of data (health, political opinions, biometrics, etc.). Please do not enter such data into free-text notes.

Each purpose has a defined legal basis under Article 6 GDPR:

• To provide the service (store and display your portfolio, compute returns and analytics, persist your preferences across devices): performance of the contract between you and us, Article 6(1)(b).
• To keep the service secure (authentication, session management, rate limiting, abuse and fraud prevention): our legitimate interest in operating a safe service, Article 6(1)(f).
• To generate an AI analysis of your portfolio: only when you explicitly request it, on the basis of your consent, Article 6(1)(a). You can decline simply by not requesting it, and each request is a fresh, deliberate action.
• To fetch market prices and reference data: performance of the contract and our legitimate interest in showing accurate figures, Articles 6(1)(b) and 6(1)(f). Only the ticker symbols you track are sent to the market data provider, never your identity.
• To comply with legal obligations (accounting, responding to lawful requests): compliance with a legal obligation, Article 6(1)(c).

We do not sell your data, and we do not use it for advertising or profiling. We share it only with the service providers (processors and sub-processors) strictly required to run IQWallet, each bound by a data processing agreement:

• Supabase: our database and authentication backend. It stores your account and portfolio data on our behalf. Project region: [SUPABASE_REGION].
• Vercel: our application hosting and content delivery provider, which processes requests so the app can run.
• Google: only if you choose Google sign-in, to authenticate you. Governed by Google’s own privacy policy.
• Twelve Data: market data provider, to retrieve price quotes and reference figures for the tickers you track. It receives ticker symbols, not your identity.
• Anthropic: only when you request an AI analysis. To generate it, a snapshot of your portfolio composition (tickers, weights and the computed metrics shown in the request) is sent to Anthropic’s model API. It is processed to produce your analysis and is not used by us to train models. This transfer happens solely on your explicit request.

We may also disclose data where legally required to do so, or to protect our rights, property or safety, or those of our users.

Some of the providers above are located outside the European Economic Area (for example, in the United States). When personal data is transferred outside the EEA, the transfer is protected by an appropriate safeguard under Chapter V GDPR: the European Commission’s Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework where the provider is certified. You may request a copy of the relevant safeguard using the contact details above.

• Account and portfolio data: for as long as your account exists. When you delete your account, this data is permanently removed from our active database.
• AI analyses you have generated: stored linked to your account so you can re-read them, and deleted when you delete your account.
• Share-link access logs: kept while the link is active and removed when the link is revoked or the account is deleted.
• Backups: residual copies in encrypted backups are rotated out within [BACKUP_RETENTION_DAYS] days of deletion.
• Data we are legally required to retain (for example, for accounting) is kept for the statutory period and then deleted.

IQWallet does not make automated decisions that produce legal effects on you or similarly significantly affect you within the meaning of Article 22 GDPR. The analyses, signals and AI outputs are informational decision-support: they do not execute trades, move money, or take any action on your behalf. Investment decisions are always yours. We do not profile you for advertising.

Under the GDPR you have the right to:

• Access your data and obtain a copy of it (Article 15). You can export your full portfolio data at any time from the Settings page.
• Rectify inaccurate data (Article 16). You can edit your portfolio data directly in the app.
• Erase your data (Article 17). You can delete your account from the Settings page, which permanently removes your profile, positions and transactions.
• Restrict or object to processing (Articles 18 and 21), and to data portability in a structured, machine-readable format (Article 20), provided by the export feature.
• Withdraw consent at any time where processing is based on consent (such as AI analysis), without affecting prior processing.

To exercise any right that is not self-service in the app, contact us at [CONTACT_EMAIL]. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country of your residence or workplace. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es).

• All traffic is encrypted in transit over HTTPS, with HTTP Strict Transport Security enforced.
• Each user’s data is isolated at the database level by row-level security policies, so one account cannot read or modify another account’s data.
• Passwords are handled by our authentication provider and are never stored by us in readable form. API access tokens are stored only as hashes.
• Privileged credentials are held server-side only and are never exposed to the browser.

No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the competent supervisory authority within 72 hours and, where the risk is high, inform you, in line with Articles 33 and 34 GDPR.

We use only strictly necessary cookies: a session cookie to keep you signed in, and a cookie that remembers your language preference. We use no analytics, advertising, or third-party tracking cookies, so no cookie consent banner is required. If we ever introduce non-essential cookies, we will ask for your consent first.

IQWallet is intended for adults managing their own investments and is not directed to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it.

If we make material changes to this policy we will update the date at the top and, where appropriate, notify you in the app or by email. Continued use of IQWallet after a change takes effect constitutes acceptance of the updated policy.