Privacy Policy

1. Data controller

PortFolk is currently operated by an individual. The data controller is Domenico Cantarero, reachable at domenico.cantarero@hotmail.com.

2. Data we collect

We collect the following personal data:

• Username and email required for registration; when using Google OAuth, the name, email and profile image associated with the Google account.
• Password stored as a bcrypt hash, unless Google OAuth is used exclusively.
• Portfolio, asset and transaction data entered by the user.
• Display preferences and account settings.
• IP address and user-agent at login for account security, with history limited to the last 20 logins.
• Subscription data; card details are processed by Stripe and are never stored on PortFolk servers.
• Only with consent: technical and usage data through Google Analytics, such as pages, events, device type and approximate source location.
• Days on which you use the service: the date only, recorded at sign-in and when the session is renewed, with no detail of the pages visited.
• If you turn on the monthly summary: your choice and the date you turned it on.
• If you create a sharing link: a picture of the portfolio in percentages (allocation, returns and, if you choose, the main positions and your username), with no amounts.

3. Purposes

• Provide portfolio tracking and analytics.
• Manage authentication, security, payments and transactional email.
• Prevent abuse through anti-bot controls and anomalous-login detection.
• Only with consent, measure aggregate use of the website and app to improve content, features and the registration journey.
• Measure in aggregate how many users come back to the service in the weeks after signing up.
• Send the monthly portfolio summary by email, only to those who turn it on.
• Publish the portfolio pictures you choose to share through a link.

4. Marketing communications

PortFolk may send offers and product updates only with explicit, optional consent. Declining does not prevent account creation or use, and consent can be withdrawn at any time.

5. Monthly summary and sharing links

• The monthly summary is an optional email on how the portfolio did over the previous month. It is off for everyone: it starts only if you turn it on, in Settings or from the invitation on the Dashboard, and we keep the date you turned it on as a record of your consent.
• You can turn it off at any time in Settings or from the link at the foot of every email, without signing in.
• A sharing link is a public page you create: anyone who has it can see it, but it is not indexed by search engines, it holds percentages only and never amounts, and it stays as it was when created.
• You can delete a link at any time; links are also deleted with the account.

6. Legal basis

• Performance of a contract or pre-contractual steps (Art. 6(1)(b) GDPR), including features the user asks for such as sharing links.
• Legitimate interest for security, abuse prevention, protection of rights and aggregate measurement of days of use to improve the service (Art. 6(1)(f) GDPR).
• Compliance with legal obligations where applicable (Art. 6(1)(c) GDPR).
• Consent for optional marketing, analytics and the monthly summary (Art. 6(1)(a) GDPR).

7. Retention

Data is kept for the lifetime of the account and as needed for security, service continuity and legal obligations. After account deletion, removal or anonymisation starts without undue delay, subject to technical processing times and backups.

Email verification tokens expire after 24 hours, password-reset tokens after 1 hour, and login history is limited to the last 20 events. Days of use are kept for the lifetime of the account; sharing links until you delete them or until the account is deleted.

8. Providers and transfers

We do not sell personal data. To provide the service we may use Neon/Vercel Postgres, Render, Vercel, Resend, Cloudflare, Google OAuth, Stripe and, with consent, Google Analytics.

Some providers may process data outside the EEA. Where this happens, safeguards under Arts. 44 et seq. GDPR apply, such as adequacy decisions or Standard Contractual Clauses.

9. Security

• Passwords stored exclusively as bcrypt hashes.
• Communications protected by HTTPS/TLS and sessions using expiring tokens.
• Email verification, anti-bot captcha and notifications for anomalous logins or password changes.

10. GDPR rights

You may request access, correction, deletion, objection, restriction and portability, or withdraw optional consent, by writing to domenico.cantarero@hotmail.com. You may also lodge a complaint with the Italian Data Protection Authority.

11. Cookies and local storage

PortFolk uses localStorage and, in limited cases, first-party technical cookies required by the service. Google Analytics loads only after consent and is not used for advertising or portfolio profiling.

You can change your choice through “Analytics preferences” in the footer and remove cookies and local data through browser settings.