1. Data categories
- Account and access data.
- Portfolio data supplied by you: portfolios, currencies, transactions, positions, targets, watchlists and related preferences.
- Technical and security data: session identifiers, request identifiers, timestamps and operational or security logs linked to a user or portfolio when necessary.
- Contact data and message contents when you voluntarily email us.
Where it comes from and what is required
Most data comes directly from you; access and security records are generated while you use the service, and Google supplies basic account data only when you choose that sign-in method. Minimum account data is required to create an account. Portfolio data is optional, but the related features cannot work without the records needed for their calculations.
2. Purposes and legal bases
Provide the requested service
We create and protect your account, keep portfolios separate, calculate and display their information, and send transactional messages. The legal basis is performance of the service requested by you (Article 6(1)(b) GDPR).
Security and service reliability
We prevent abuse, diagnose failures and preserve the integrity of accounts and data. The legal basis is the controller's legitimate interest in operating a secure and reliable service (Article 6(1)(f) GDPR), subject to the corresponding balancing assessment.
Legal obligations and consent
Data may be processed where a legal obligation applies. Consent will only be used for optional purposes that are presented separately, and it can be withdrawn without affecting prior lawful processing.
3. Recipients and international transfers
Data is not sold. Access may be given, only as needed, to providers supporting hosting and databases, transactional email, authentication and market information. Google receives or provides data only if you choose Google sign-in. The final processor and international-transfer inventory, applicable safeguards and copies or references to them must be confirmed by the operator before production publication.
4. Retention
Account and portfolio data is kept while the account is active and afterwards only for the period needed to meet legal obligations or resolve claims. Short-lived verification, recovery and session data expires according to its operational purpose. Logs and backups follow restricted retention schedules. Exact production periods must be approved and published by the operator; until then, this notice is provisional.
5. Your rights
You may request access, rectification, erasure, restriction, objection and portability where applicable, and withdraw consent at any time. Account erasure is available directly in account settings after email confirmation; you may also use the privacy channel on the contact page. We may request proportionate information to verify your identity. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD).
6. Automated decisions
Investment Tracker does not make automated decisions about you that produce legal effects or similarly significant effects. Portfolio calculations and projections are informational tools, not individual investment decisions.
7. Cookies and local storage
The public pages do not currently use analytics or advertising cookies. The browser stores language, theme, translation cache and whether this notice has been seen. Essential session and CSRF protections are used when needed for account access and security. If optional analytics or advertising technologies are introduced, they must remain disabled until valid consent is obtained.
8. Applicable regulation
This notice follows the information duties in the General Data Protection Regulation. You can consult the official text published in the Official Journal of the European Union through the Spanish Official State Gazette.