Privacy Policy

01Who is responsible

The data controller is Virtuous Audacity, Lda, a company incorporated in Portugal. Full identification is in section 09 at the bottom of this page.

This policy covers the website at jpintostocks.com and the analysis service provided through it. It does not cover any other site you may reach from a link here.

For anything in this policy, write to legal@jpintostocks.com. No Data Protection Officer has been appointed, as the service does not meet the conditions in Article 37 of the GDPR that would require one.

02What we collect

Three things, and nothing beyond them.

Your account

• Your email address, which is how you sign in and how we contact you. Authentication is handled for us by Supabase.
• Authentication metadata kept by Supabase alongside the account: the date the account was created, sign-in timestamps, and the IP address used to sign in.
• Your password is never visible to us. It is stored by Supabase as a cryptographic hash, which cannot be reversed into the original password.

What you save in the service

• The ticker lists you build — the symbols you choose to follow.
• Any positions you record for your own reference. These are entries you type in yourself. We do not connect to any broker, and we cannot see any real account you may hold elsewhere.

Basic usage logs

• Standard technical request logs generated by the hosting and delivery layer: IP address, date and time, the page requested, browser type. These exist to keep the service running and to investigate abuse and faults.
• The landing page only loads Cloudflare Web Analytics, which counts visits without cookies and without building a profile of you. It is not loaded on the signed-in pages.

What we do not collect

• No card, bank or payment details — see section 03.
• No address, phone number, date of birth or identity document.
• No advertising or cross-site tracking cookies.
• No automated decision-making that produces legal effects concerning you, and no profiling of you as a person. The service analyses securities, not users.

03Payment data never reaches us

What we do receive from Paddle is limited to what we need to know whether your subscription is active: the email address used at checkout, the subscription status, and a Paddle order reference. Paddle processes your payment data as an independent controller under its own privacy policy, which applies alongside this one.

Billing and refund questions go to billing@jpintostocks.com — see the Refund and Cancellation Policy.

04Why we are allowed to process it

Every piece of data above has a legal basis under Article 6 of the GDPR.

Where we rely on legitimate interests, you have the right to object. See section 07.

05How long we keep it

To close your account and have its data deleted, write to support@jpintostocks.com or legal@jpintostocks.com. Note that invoicing records are retained regardless, because the law requires it — this is the one exception to erasure, and it is explained again in section 07.

06Who else touches your data

We use a small number of established providers. Each is bound by a data processing agreement, or acts as an independent controller where noted.

Third-party content loaded by your browser

We keep this list as short as we can. Typefaces and the Supabase client library are served from our own domain, not from a font service or a public CDN, specifically so that your IP address is not handed to them just for loading a page.

Two things are still fetched from elsewhere:

• TradingView — the price charts, on the dashboard and portfolio pages. Loading a chart tells TradingView your IP address and browser.
• Cloudflare Web Analytics — visit counting, on the landing page only, without cookies and without building a profile of you. It is not loaded on any signed-in page.

Transfers outside the EEA

Some of these providers are established outside the European Economic Area, or may process data on servers outside it. Where that happens, the transfer relies on the European Commission's Standard Contractual Clauses, or on an adequacy decision where one applies. You can ask us which mechanism covers a specific provider.

We do not sell personal data, and we do not share it for advertising. Beyond the providers above, data is disclosed only where the law requires it.

07Your rights

Under the GDPR you have the following rights over your personal data.

• Access — to be told whether we hold data about you, and to receive a copy.
• Rectification — to have inaccurate data corrected and incomplete data completed.
• Erasure — to have your data deleted, subject to the invoicing records we are legally required to keep.
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another provider where technically feasible.
• Objection — to object to processing based on legitimate interests, on grounds relating to your particular situation.
• Restriction — to have processing limited while a dispute about accuracy or lawfulness is resolved.

To exercise any of them, write to legal@jpintostocks.com. We reply within one month. Exercising these rights is free; we may charge a reasonable fee only for requests that are manifestly unfounded or excessive, and we will say so before charging anything.

We may need to confirm who you are before acting, so that we do not disclose your data to someone else.

Complaints

If you believe we have handled your data unlawfully, please raise it with us first — most things are a misunderstanding we can fix quickly. You also have the right to complain to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or to the supervisory authority of the EU country where you live.

08Security, and changes to this policy

Access to the service is over encrypted connections (HTTPS). Passwords are stored only as hashes. Access to the production systems is limited to those who need it. No system is perfectly secure, and we do not claim otherwise — but if a breach occurs that is likely to result in a risk to your rights, we will notify the CNPD within 72 hours and tell you directly where the law requires it.

If this policy changes, the revised version is published on this page with a new date at the bottom. Where a change materially affects your rights, we will tell you by email before it takes effect.

09Company identification