Privacy Policy

1. Who Is Responsible for Your Data

The controller of personal data processed through Investing Aura (the “Platform”) is G.P.S.C. Mansi-Kontaxis, an individual resident in Greece, European Union, who operates the Platform (“we”, “us”). For any privacy question or to exercise your rights, contact privacy@investingaura.com.

This Policy explains how we process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and applicable national law.

2. What Data We Collect

• Account data: your email address and a securely hashed password. If you sign in with Google, we receive your email address, name, and profile picture from Google; we do not receive your Google password.
• Subscription data: whether you have Premium access and the customer identifier that our payment provider (Paddle) assigns to you.
• Your content: financial model inputs, scenario names, saved portfolios, life event configurations, and other information you choose to save. Please avoid entering information you do not want stored; the tools work with hypothetical figures.
• Usage analytics: pages viewed, features used (for example, which calculator you completed or when an upgrade prompt was shown), referring page, and browser and device type. See Section 5.
• Technical logs: IP address, browser type, request time, and error information recorded by our hosting and database providers for security and reliability.
• Communications: the content of emails you send us and our replies.

We do not collect or store your payment card or bank details. Payments are handled entirely by Paddle (see Section 6).

3. Why We Use Your Data and Our Legal Bases

• To provide the Platform — creating and authenticating your account, saving your content, and providing Premium access you have purchased. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To send service emails — account confirmation, password reset, security notices, and important changes to the Platform or these policies. Legal basis: contract (Art. 6(1)(b)).
• To understand and improve the Platform — aggregate, cookieless usage analytics. Legal basis: our legitimate interest in improving the Platform (Art. 6(1)(f)).
• To keep the Platform secure — preventing fraud, abuse, and attacks, and diagnosing errors. Legal basis: legitimate interests (Art. 6(1)(f)).
• To answer your messages and handle requests. Legal basis: legitimate interests (Art. 6(1)(f)) or contract, as applicable.
• To comply with the law and to establish, exercise, or defend legal claims. Legal basis: legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)).

We do not send marketing emails without your consent. We do not sell or rent your personal data, do not use it for advertising, and do not use your financial inputs for profiling, credit scoring, or automated decisions that have legal or similarly significant effects on you.

4. Cookies and Similar Technologies

We use only strictly necessary cookies, set by our authentication provider (Supabase), to keep you signed in. These cookies are required for the Platform to work and do not require consent. We do not use advertising or cross-site tracking cookies.

5. Analytics

We use PostHog (hosted in the European Union) to understand how the Platform is used. PostHog is configured in cookieless mode: it does not place cookies or use your browser’s local or session storage. Instead of a persistent identifier, visits are counted using a privacy-preserving hash calculated on PostHog’s servers, which changes daily and cannot be used to recognise you across days. Your IP address is used only to calculate this hash and is then discarded; it is not stored with analytics events or used to determine your location. Session recording is disabled. You may object to this processing at any time by contacting us (see Section 9).

6. Who We Share Data With

We share personal data only with the service providers we need to run the Platform. Those acting as our processors process data only on our instructions under data processing agreements:

• Supabase, Inc. (USA) — database hosting and user authentication;
• Vercel, Inc. (USA) — website hosting and technical logs;
• PostHog, Inc. (data hosted in the EU) — cookieless product analytics;
• Cloudflare, Inc. (USA) — domain name services and routing of emails you send us;
• Google LLC (USA) — our email inbox, where messages you send us are stored.

The following receive data as independent controllers under their own privacy policies:

• Paddle.com Market Limited (UK) — our Merchant of Record. Paddle collects your payment, billing, and tax information directly at checkout and processes it under the Paddle Privacy Policy. Paddle shares with us only what we need to provide your access (such as your customer identifier and the status of your purchase).
• Google LLC — if you choose to sign in with Google, under the Google Privacy Policy.

We may also disclose data where required by law or to a competent authority, and to a company that we establish or a successor that takes over the Platform, in which case this Policy will continue to apply to your data.

7. International Transfers

Some of the providers above are based in, or may access data from, countries outside the European Economic Area. Transfers to the United Kingdom rely on the European Commission’s adequacy decision. Transfers to the United States rely on the EU–U.S. Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses. You can ask us for more information about these safeguards.

8. How Long We Keep Data

• Account data, subscription data, and your content: for as long as your account exists. When you ask us to delete your account, we delete or anonymise this data within 30 days, except where we must keep it longer to comply with the law or to establish, exercise, or defend legal claims.
• Usage analytics: no longer than 24 months.
• Technical logs: a short period, typically no more than 30 days.
• Emails with you: as long as needed to handle your request, and no longer than 24 months afterwards.

Invoices and payment records are kept by Paddle as Merchant of Record in line with its own legal obligations.

9. Your Rights

Under the GDPR, and subject to its conditions and exceptions, you have the right to:

• Access the personal data we hold about you and receive a copy (Art. 15);
• Rectify inaccurate or incomplete data (Art. 16);
• Erase your data, including deleting your account (Art. 17);
• Restrict our processing in certain circumstances (Art. 18);
• Data portability — receive data you provided in a machine-readable format (Art. 20);
• Object to processing based on our legitimate interests, including analytics (Art. 21);
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, including deleting your account, email privacy@investingaura.com from the email address linked to your account. We will respond within one month, which may be extended where the law allows. We may ask you to verify your identity before acting on a request.

10. Right to Lodge a Complaint

We would appreciate the chance to address any concern first, so please contact us. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, your place of work, or the place of the alleged infringement.

11. Security

We use appropriate technical and organisational measures to protect your data, including encrypted connections (HTTPS/TLS), row-level security on our database so that each user can access only their own data, and restricted administrative access. No system is completely secure, but if a personal data breach occurs that is likely to put your rights at risk, we will notify you and the competent authority as the law requires.

12. Children

The Platform is not intended for anyone under 18, and we do not knowingly collect their personal data. If we learn that we have collected data from a person under 18, we will delete it promptly.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email or through a prominent notice on the Platform at least 14 days before they take effect. The “Last updated” date above shows when this Policy was last revised.

14. Contact

For all privacy and data protection enquiries: privacy@investingaura.com