Privacy Policy

1. Controller

The data controller is the company currently in Gründung (in formation). Contact for privacy matters: privacy@alphaflow.one. Full controller details are in the Imprint.

2. What we collect

• Account data — email, name, and (for email sign-ups) a securely hashed password; or your Google/Apple account identifier if you use OAuth.
• Portfolio data — the broker statement files (CSV) you upload and the positions, transactions, and history derived from them. This can reveal financial information about you.
• Profile & preferences — optional details you enter (tax residency, goals, notes) and your app settings (display, notifications).
• Usage & technical data — feature usage counters, log and error data (for reliability), and IP-derived rate-limiting counters.
• Product-usage analytics — when you’re signed in, we record first-party analytics about which pages you open and how long you actively spend on each, tied to your account, to understand and improve the product. This uses no cookies, contains no financial details, stays in our own database, and is never shared with any third party or used for advertising.
• Billing data — if you subscribe, our payment provider processes your payment details; we store only your plan, status, and a provider reference — never card numbers.

3. Why, and on what legal basis

• To provide the service (account, portfolio analytics, notifications you enable) — performance of a contract, Art. 6(1)(b).
• Security, rate limiting, error monitoring, and first-party product-usage analytics — legitimate interests in a safe, working, and continually improved service, Art. 6(1)(f).
• Billing — contract and legal accounting obligations, Art. 6(1)(b) and (c).
• Optional AI features and integrations (AI chat/analysis, Telegram) — your consent / your request, Art. 6(1)(a), which you can withdraw at any time.

4. Processors and third parties

We use the following processors, each under a data-processing agreement. Personal data is only shared as needed to run the service:

• Vercel — application hosting.
• Neon — managed PostgreSQL database (your account and portfolio data).
• Upstash — rate-limiting / ephemeral cache.
• Resend — transactional and notification email.
• Mollie — payment processing (EU, Netherlands).
• Sentry — error monitoring (EU region endpoint).
• Anthropic — AI features; when you use the AI chat/analysis, relevant portfolio context is sent to generate a response (US).
• Google / Apple — only if you choose OAuth sign-in.
• Telegram — only if you connect it for notifications.
• Market-data providers (e.g. Yahoo Finance) — receive ticker symbols only, never your personal or portfolio data.

Where a processor is outside the EU/EEA (e.g. Anthropic in the US), transfers rely on EU Standard Contractual Clauses or an adequacy decision.

5. Retention

We keep your data while your account is active. When you delete your account, we erase your account and all associated data (portfolios, positions, transactions, alerts, history) — see “Your rights” below. Some records (e.g. billing) may be retained where the law requires.

6. Your rights

Under the GDPR you can, at any time:

• Access & portability — download everything we hold in a machine-readable file (Account → Download my data).
• Erasure — delete your account and all data (Account → Delete my account).
• Rectification — correct your profile details in Settings.
• Object / restrict / withdraw consent — e.g. turn off AI features or notification channels.
• Complain to your data-protection authority.

7. Security

Data is encrypted in transit (TLS) and at rest. Access is scoped to your account; passwords are hashed with bcrypt; sessions are httpOnly. We apply the principle of data minimisation and least privilege.

8. Not investment advice

AlphaFlow’s analytics and AI “signals” are informational only and are not personal investment advice or a recommendation to buy or sell any security. See the Terms.

9. Changes

We’ll post any changes here and update the date above. Material changes will be notified in-app or by email.