Last updated: October 24, 2026

Privacy Policy

This statement is based on the visible project code. The legal provider, actual retention periods, processor agreements and international transfers must be checked and completed by the site operator.

Which data is processed?

• Account: email address, user ID, authentication and session data through Supabase Auth.
• Membership and payment: Stripe Checkout processes payment and subscription data. The implementation uses SEPA Direct Debit. Through the webhook, Kapitalshare receives an email address, Stripe customer and subscription IDs, plan, status and billing period. Stripe processes bank details; the browser and Supabase do not store them.
• Portfolio: assets, transactions, notes, quantities, prices, dates, currencies, FX rates, dividends, fees and taxes entered by the member. This information may reveal financial preferences or behavior.
• Referrals: only after the optional choice in the cookie banner, a referral code and timestamp may be stored in local browser storage for up to 90 days and sent with checkout.
• Technical data: hosting, security, network and error log data may be processed by hosting and infrastructure providers. Actual data and retention periods depend on the production configuration.

Purposes and legal bases

Account and membership data are needed to perform the agreement, grant access and manage payments and membership status. Portfolio entries are processed to provide the dashboard calculations and cross-session synchronisation requested by the member. Security and error data may be needed for legitimate interests such as fraud prevention and secure operation; document the balancing test and retention period. Referral storage is optional and used only when you choose it. The operator must determine and record the actual legal basis for each processing activity.

Recipients and services

• Supabase: authentication, database and server functions. Project region: [confirm region, contract, subprocessors and international transfers].
• Stripe: payment checkout, SEPA Direct Debit, recurring payments and payment status. See Stripe’s Privacy Policy. Confirm processor/controller roles and retention periods.
• Financial Modeling Prep: the backend may search for instruments and retrieve price and FX data for signed-in members. The API key remains server-side. Verify what search terms or data the provider receives, its contractual role and any transfers.
• TradingView: the trading page loads an external chart widget. The browser connects to TradingView, which may process technical data such as IP address, browser information and usage. The current implementation does not request prior consent or provide an alternative.
• Discord: member pages load the Discord server widget in an iframe. Discord may receive technical data when the iframe loads. The current implementation does not request prior consent or require a click to activate it.
• Google Fonts: pages load fonts from Google Fonts, which may cause the browser to connect to Google. Self-host the fonts or assess transfer and information obligations.
• esm.sh: browser and edge functions load open-source libraries through esm.sh. The provider may receive technical request data.

Enter the actual hosting provider, contracting parties, subprocessors, regions, transfer mechanisms and any other analytics or advertising providers used in production.

International transfers

External providers may process data outside the European Economic Area. For each recipient, determine whether a transfer takes place, which safeguard applies (such as an adequacy decision or standard contractual clauses), and where people can read that information. This cannot be fully determined from the source code.

Retention periods

Account, payment and contract data are retained as long as needed to provide the service and afterward in line with applicable statutory record-keeping and limitation periods. Portfolio entries remain until the member deletes them or the account is deleted, subject to legal retention duties and backups. Referral code storage expires after 90 days. The cookie choice remains in local storage until replaced or cleared. Set and publish specific retention periods for account, support, server log, payment and backup data.

Your rights

Depending on the legal basis and statutory exceptions, you may request access, rectification, erasure, restriction, data portability and objection, and withdraw consent. Contact [enter privacy contact details]. You may also lodge a complaint with the Dutch Data Protection Authority. Erasure may be restricted where data is needed for legal obligations or claims. Respond within the applicable GDPR time limit.

Access to the member area is controlled in the frontend by membership status. Verify that the database and server rules enforce the same restriction for every table and function and that no portfolio or income data is exposed.

Automated decisions and profiling

The visible application calculates portfolio summaries from entered data but does not use an automated decision with legal or similarly significant effects on a person. Check whether production referral or fraud features change this.

Security and children

The code uses Supabase authentication and database policies; actual security depends on published RLS rules, account settings, hosting and operational management. The provider must document safeguards, breach response and data processing agreements. Enter the intended minimum age and any approach for children’s data.

Changes

This statement will be updated after material changes, and people will be informed separately where required. Version date: October 24, 2026.