Privacy Policy

This Privacy Policy explains how Portvara ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our platform at portvara.com. We are committed to handling your data responsibly and in accordance with applicable data protection laws.

1. Data We Collect

We collect the following categories of personal data:

• Account data: Your email address and name, provided when you sign up.
• Investment preferences: Risk appetite, sectors of interest, target markets, and experience level that you provide during onboarding.
• Portfolio data: Holdings, allocation percentages, entry prices, stop-loss levels, and other portfolio information you enter into the platform.
• Chat history: Messages you send to and receive from Invest Bot and other AI features.
• Usage data: Pages visited, features used, and interaction patterns, collected for analytics and service improvement.
• Technical data: IP address, browser type, device information, and session data collected automatically.

2. How We Use Your Data

We use your personal data to:

• Personalise AI-generated analysis and recommendations based on your portfolio and risk profile.
• Send you Daily Brief emails and important account notifications.
• Improve the accuracy, performance, and features of the platform.
• Maintain the security of your account and the platform.
• Comply with legal obligations.

We do not sell your personal data to third parties. We do not use your data to train general AI models without your explicit consent.

3. Data Storage

Your data is stored on Supabase (PostgreSQL), a managed database service with infrastructure located in the EU and US. All data in transit is encrypted using TLS. Data at rest is encrypted using AES-256 encryption provided by our infrastructure partners.

4. Third-Party Services

We use the following third-party services to operate Portvara:

• Supabase: Database and authentication.
• AI model providers (via the Lovable AI gateway, including OpenAI): Generate the chat responses, briefs and analysis. Your questions and the relevant portfolio context needed to answer them are sent to these providers to produce a response.
• Perplexity: Live web research used to ground market and news analysis.
• Finnhub: Market data and financial information.
• Resend: Transactional and notification emails.
• Stripe: Payment processing for subscriptions.
• Vercel / Cloudflare: Hosting and edge delivery.

Each of these providers has its own privacy policy. We only share the minimum data necessary for each service to function.

5. Data Retention

Account data (your profile, portfolio, and preferences) is retained for as long as your account is active. Chat history with Invest Bot is retained for up to 12 months. If you delete your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance reasons.

6. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correct: Ask us to correct inaccurate or incomplete data.
• Delete: Request deletion of your account and personal data.
• Restrict: Ask us to limit how we use your data in certain circumstances.
• Portability: Request a machine-readable export of your data.
• Object: Object to processing of your data where we rely on legitimate interests.

To exercise any of these rights, email us at ronnybaroudi@gmail.com. We will respond within 30 days.

7. Cookies

Portvara uses cookies and similar storage mechanisms to operate the platform. We use:

• Essential cookies: Required for authentication, session management, and core functionality. These cannot be disabled.
• Analytics cookies: Help us understand how the platform is used so we can improve it. These are only set with your consent.

When you first visit Portvara, you will be shown a cookie consent banner. You can choose to accept all cookies or essential cookies only. You can update your preference at any time by clearing your browser's local storage.

8. Security

We take the security of your data seriously. All data is encrypted in transit using TLS and at rest using AES-256. Access to production databases is restricted to authorised personnel only, protected by multi-factor authentication. Row-level security is enforced at the database level so that each user can only access their own data.

9. Children

Portvara is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us immediately and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "last updated" date at the top of this page. Continued use of Portvara after any changes constitutes your acceptance of the revised policy.