Privacy Policy

1. Introduction

Welcome to Portfolio. This Privacy Policy details how we collect, use, and manage your personal data when you use our application to track your stock portfolio, generate tax reports, and receive AI-driven investment insights.

2. Information We Collect

To provide our comprehensive services, we collect the following types of information:

• Account Information: Email address, name, and profile picture (if using Google OAuth authentication).
• Tax & Identity Data: Your JMBG (Unique Master Citizen Number), residential address, municipality code, phone number, and bank account details required to generate accurate Serbian (PPPPD) or international tax declarations.
• Financial Data: Your investment portfolios, trading history, CSV import data, and external API credentials (such as encrypted IBKR Flex Web Service Tokens).
• Investment Profile: Your risk tolerance, investment horizon, base currency, and general financial goals used to tune our AI engine.

3. How We Use Artificial Intelligence

We utilize third-party Artificial Intelligence providers (e.g., OpenAI, Google Gemini, Anthropic) to provide portfolio analysis and rebalancing suggestions. Only anonymized portfolio contexts (such as ticker symbols and aggregated weights) and your stated investor profile are shared with these APIs. We do not send your personally identifiable information (Name, JMBG, Email) to third-party AI models.

4. Security & Data Management

Your data is securely stored within our infrastructure. Highly sensitive elements, such as external integration tokens (e.g., Interactive Brokers Flex Tokens), are stored using AES-256 encryption. We strictly restrict internal access to user financial data and never sell your profile to advertisers.

5. Your GDPR Rights

We fully comply with the General Data Protection Regulation (GDPR) standards, granting you complete control over your data. Inside your Profile Settings, you have the right to:

• The right to access: You can export your data in JSON format directly from your Settings page at any time.
• The right to erasure ("Right to be Forgotten"): You can permanently and irrevocably wipe your account and all associated data, trades, and portfolios via the "Delete My Account" action.

6. Cookies and Local Storage

We exclusively use "strictly necessary" cookies and local storage tokens. These serve to authenticate your active session, verify CSRF boundaries, and persist UI preferences like Theme modes and Localization selections. We do not employ third-party tracking scripts for behavioral advertising.