Privacy Policy

1. Data collected

We only collect data strictly necessary for the service to function:

• Email address — used for authentication and account recovery. This is the only personal data we request.
• Investment data — transactions, dividends, accounts, profiles, projections and preferences that you voluntarily enter in the application. This data does not contain any personal information within the meaning of GDPR (no name, address, real account number).
• Payment data — if you subscribe to the Premium plan, payment is handled entirely by Stripe. We never store your banking details. Only a Stripe customer identifier is kept to manage your subscription.

2. Data not collected

We do not collect:

• Name, surname or postal address
• Phone number
• Tracking or advertising cookies
• Browsing data for advertising purposes or resold to third parties
• Location data

3. Data usage

Your data is used exclusively to:

• Authenticate you and secure access to your account
• Display and calculate your portfolio metrics
• Generate the tax reports and exports that you request
• Manage your subscription (via Stripe)

We do not use your data for any other purpose. No data is sold, rented or shared for commercial purposes.

Legal bases for processing: managing your account and subscription relies on performance of the contract; billing on our legal obligations; technical monitoring and security on our legitimate interest; sending non-essential emails on your consent.

4. Data sharing

Your data is not shared with any third party, except for the following technical subprocessors:

• Supabase — database hosting and authentication. Servers in the European Union (AWS eu-west).
• Vercel — web application hosting and cookieless anonymous audience measurement (Vercel Analytics), processed for our sole account. GDPR-compliant infrastructure.
• Sentry — technical error monitoring, on our own instance and for our sole use, configured not to collect unnecessary personal data.
• Stripe — payment (only if you subscribe to the Premium plan). PCI DSS Level 1 certified.

Some subprocessors (Vercel, Stripe, Sentry) may process data outside the European Union, in particular in the United States. These transfers are governed by appropriate safeguards (Data Privacy Framework or standard contractual clauses). The data you enter remains hosted in the European Union (Supabase, AWS eu-west).

5. Data security

We implement the following measures:

• Communication encryption (HTTPS/TLS)
• Secure authentication via Supabase Auth (passwords hashed with bcrypt)
• Strict data isolation between users (systematic application-level filtering and Row Level Security at database level)
• Identity verification on every API request
• HTTP security headers

6. Data retention

Your data is retained as long as your account is active. If your account is closed, all your data is deleted immediately and irreversibly.

Exception: where required by law, some data is kept longer. Billing documents related to your subscription are retained for the legal period (up to 10 years for accounting purposes), even after the account is closed.

7. Your rights (GDPR)

In accordance with the General Data Protection Regulation, you have the following rights:

• Right of access — you can view all your data directly in the application.
• Right to portability — you can export your transactions and tax reports from the Import/Export page, or download your portfolio data from Settings > Account > My data. The rest of your data remains viewable directly in the app.
• Right to rectification — you can edit your data directly in the application.
• Right to erasure — you can close your account at any time from Settings > Account. Deletion is immediate and irreversible.
• Right to object and to restriction — exercisable by closing your account.
• Right to lodge a complaint — you may file a complaint with the CNIL (www.cnil.fr) if you believe the processing of your data does not respect your rights.

8. Cookies

SuiviBourse only uses technical cookies necessary for authentication (Supabase session). No advertising, analytics or tracking cookies are used: our audience measurement (Vercel Analytics) and error monitoring (Sentry) run without cookies and for our sole use. A theme preference cookie (light/dark) is stored locally in your browser (localStorage).

9. Changes to this policy

In case of a substantial change, users will be informed via a banner in the application. The last updated date is shown at the top of this page.

10. Contact

For any questions regarding your personal data: contact@suivibourse.fr