1. Who we are
OptFolio (“we”, “us”) provides portfolio analytics software. This Privacy Policy explains how we collect, use, and protect personal data when you use the Service.
2. Data we collect
Account data (name, email, authentication identifiers via our auth provider), portfolio and holdings data you enter or import, billing identifiers from our payment partner, usage logs (e.g. feature access, AI query counts), device/browser technical data, and optional LLM configuration (API keys stored encrypted at rest).
3. How we use data
To provide and improve the Service, authenticate users, enforce plan limits, process subscriptions, secure systems, comply with law, and communicate service-related notices. We do not sell your personal data.
4. Legal bases (where applicable)
Performance of a contract, legitimate interests in operating a secure product, consent where required (e.g. optional marketing), and legal obligations.
5. Sharing
We share data with processors who help run the Service (e.g. hosting, authentication, database, payments, error monitoring) under contractual safeguards. We may disclose data if required by law or to protect rights and safety.
6. International transfers
Processors may store or process data outside your country. Where required, we use appropriate safeguards for cross-border transfers.
7. Retention
We retain data for as long as your account is active and as needed for legitimate business and legal purposes, then delete or anonymise it according to our retention schedule.
8. Security
We use industry-standard measures including encryption in transit (TLS), access controls, and encryption of sensitive secrets such as user-supplied API keys at rest. No method of transmission or storage is 100% secure.
9. Your rights
Depending on applicable law, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Contact us to exercise rights. You may also lodge a complaint with a data protection authority where applicable.
10. Children
The Service is not directed to children under 18. We do not knowingly collect personal data from children.
11. Changes
We may update this policy and will post the revised version with an updated date. Material changes may be communicated via the Service or email.