SuiviBourse is a personal stock portfolio tracking tool. Protecting your data is a priority. This policy explains what data we collect, why, and how we protect it.
1. Data collected
We only collect data strictly necessary for the service to function:
Email address β used for authentication and account recovery. This is the only personal data we request.
Investment data β transactions, dividends, accounts, profiles, projections and preferences that you voluntarily enter in the application. This data does not contain any personal information within the meaning of GDPR (no name, address, real account number).
Proof of acceptance β the version of the terms of use and privacy policy you accepted, and the date of this acceptance.
Application messages β freeze and deletion notices, subscription events, updates to the terms; kept until the account is closed, can be archived, included in the export of your data.
Sign-in with Google β when you sign in with Google, Google passes on to our authentication service (Supabase), along with your email address, your name and your Google profile photo. This information is kept by the authentication service, but the application never reads it and never displays it.
Payment data β if you subscribe to the Premium plan, payment is handled entirely by Stripe. We never store your banking details. Only a Stripe customer identifier is kept to manage your subscription.
2. Data not collected
We do not collect:
Name, surname or postal address (except the profile information passed on by Google when you sign in with Google, see section 1)
Phone number
Tracking or advertising cookies
Browsing data for advertising purposes or resold to third parties
Location data
3. Data usage
Your data is used exclusively to:
Authenticate you and secure access to your account
Display and calculate your portfolio metrics
Generate the tax reports and exports that you request
Manage your subscription (via Stripe)
We do not use your data for any other purpose. No data is sold, rented or shared for commercial purposes.
Legal bases for processing: managing your account and subscription relies on performance of the contract; billing on our legal obligations; technical monitoring and security on our legitimate interest; sending non-essential emails on your consent.
4. Data sharing
Your data is not shared with any third party, except for the following technical subprocessors:
Supabase β database hosting and authentication. Servers in the European Union (AWS eu-west).
Vercel β web application hosting and cookieless anonymous audience measurement (Vercel Analytics), processed for our sole account. GDPR-compliant infrastructure.
Sentry β technical error monitoring, on our own instance and for our sole use, configured not to collect unnecessary personal data.
Stripe β payment (only if you subscribe to the Premium plan). PCI DSS Level 1 certified.
Some subprocessors (Vercel, Stripe, Sentry) may process data outside the European Union, in particular in the United States. These transfers are governed by appropriate safeguards (Data Privacy Framework or standard contractual clauses). The data you enter remains hosted in the European Union (Supabase, AWS eu-west).
5. Data security
We implement the following measures:
Communication encryption (HTTPS/TLS)
Secure authentication via Supabase Auth (passwords hashed with bcrypt)
Strict data isolation between users (systematic application-level filtering and Row Level Security at database level)
Identity verification on every API request
HTTP security headers
6. Data retention
Your portfolio data is kept for as long as you use your account. When you close your account, all your data is deleted immediately and irreversibly.
Exception, frozen data: if your account reverts to the free plan (end of the Premium subscription, payment failure or end of a complimentary Premium access), the accounts, brokers and profiles beyond the free plan limits are frozen with all their content, whichever profile entered it (including the kept profile), including the transactions entered by a frozen profile on an account that remains active. They are no longer displayed or editable and are permanently deleted 12 months after the freeze date (never less than 7 days after the warning email), unless you resubscribe before then, which restores them exactly as they were. Throughout the freeze, an in-app alert shows the deadline: you can hide it for 90 days (it reappears 7 days before the deadline) or request immediate deletion. A single warning email is sent to you before the deletion, 7 days before. Only frozen data is deleted, with no reassignment to another profile: the ceiling of your PEA and PEA-PME accounts and the taxation of your PEA, PEA-PME and CTO accounts (capital gains, tax cost basis) are then calculated on the remaining transactions only. Throughout the freeze, you can download the export of your portfolio data, frozen data included (Settings > My account > My data, or from the alert). Your message inbox keeps, until your account is closed, the notices related to the freeze and the deletion: dates, deadline, names and types of the accounts, brokers and profiles concerned, numbers of transactions and dividends deleted, without any amount.
Exception: where required by law, some data is kept longer. Billing documents related to your subscription are retained for the legal period (up to 10 years for accounting purposes), even after the account is closed.
7. Your rights (GDPR)
In accordance with the General Data Protection Regulation, you have the following rights:
Right of access β you can view your data directly in the application and download your portfolio data from Settings > My account > My data.
Right to portability β you can download your portfolio data (profiles, brokers, accounts, transactions and dividends) from Settings > My account > My data, and export your transactions as CSV from the Import/Export page; depending on your plan, your portfolio as PDF and your tax reports can also be exported.
Right to rectification β you can edit your data directly in the application.
Right to erasure β you can close your account at any time from Settings > My account. Deletion is immediate and irreversible.
Right to object and to restriction β exercisable by closing your account.
Right to lodge a complaint β you may file a complaint with the CNIL (www.cnil.fr) if you believe the processing of your data does not respect your rights.
During a freeze (section 6), frozen data can be neither viewed nor edited in the application: you access it by downloading your portfolio data (Settings > My account > My data), which includes it, and you can view and edit it again by resubscribing to Premium before its deletion.
8. Cookies
SuiviBourse only uses technical cookies necessary for authentication (Supabase session). No advertising, analytics or tracking cookies are used: our audience measurement (Vercel Analytics) and error monitoring (Sentry) run without cookies and for our sole use. A theme preference cookie (light/dark) is stored locally in your browser (localStorage).
9. Changes to this policy
Any change to this policy or to the terms of use results in a new version, dated at the top of this page. The next time you use the application, a window asks you to explicitly accept the new version before continuing.
10. Contact
For any questions regarding your personal data: contact@suivibourse.fr