Privacy Policy

This Privacy Policy explains what information Portfonia collects, how it is used, and the choices you have. It covers the Portfonia web application and the reports it emails you.

Account information: your email address and authentication credentials, handled by our authentication provider.

Holdings and investment data: positions, brokers/custodians, and quantities you upload, plus any investment-style questionnaire responses you provide.

Usage information: basic session and activity data needed to operate the Service securely (for example, sign-in timestamps and idle-timeout enforcement).

We use your data solely to generate and deliver your portfolio reports and to operate, secure, and improve the Service. We do not sell your data, and we do not use your holdings to build or improve any third-party product.

Holdings data is encrypted at rest. Access to production systems is restricted, and administrative actions are logged.

No system is perfectly secure, and we cannot guarantee absolute security, but protecting your data is treated as a first-class engineering requirement, not an afterthought.

Generating a report involves sending portions of your data to third-party large-language-model providers for analysis. By default, every such call is configured to opt out of the provider using your data for model training.

A narrow, owner-approved exception applies to two specific, non-analytical processing steps: public-market search-query generation, and translating a finished report into your display language. These two steps are routed directly to a single named provider's own first-party API instead of through the training opt-out described above, because that is the only way to reach that specific low-cost model. That provider's standard API terms permit using submitted data to improve its models, so this exception accepts that risk for those two steps only — it is not backed by a no-training data agreement. To limit the exception's reach, the routing is hard-pinned with no automatic fallback to a different provider if it becomes unavailable. The translation step does process report text derived from your holdings, since it translates the finished report itself; the search-query step does not, since it only uses public market/macro themes.

We retain your account and holdings data for as long as your account is active. Some operational records (for example, upload-job metadata) are automatically purged after a short retention window. You may request full deletion of your account and associated data at any time (see "Your Rights" below).

You can review and update your holdings and profile information directly in the Service. You can request permanent deletion of your account and all associated data by contacting us; deletion removes your local records and your authentication account.

We use session cookies to keep you signed in and to enforce automatic sign-out after a period of inactivity. We do not use third-party advertising or tracking cookies.

The Service is not directed to, and not knowingly used by, anyone under 18. We do not knowingly collect information from minors.

This service currently targets users in mainland China, Hong Kong, and Singapore, in addition to the regional eligibility restriction described in our Terms of Service. The applicable data-protection law for each of those target regions is still under legal review; this section will be completed once that review is finished.

We may update this Privacy Policy as the Service evolves. Material changes will be reflected on this page with an updated effective date.

Questions about this Privacy Policy, or requests regarding your data, can be sent to info@portfonia.com.