Privacy Policy
Last updated: July 2026
1. Who We Are
Oitava (“we”, “us”, “our”) operates the investment portfolio tracking service at oitava.app. The service is operated by Maria Manuela Alves Gaspar Correia, NIF 155256920, a sole proprietor (Empresário em Nome Individual) registered in Portugal. We are the data controller for the personal data described in this policy.
Contact: [email protected]
2. Data We Collect
We collect the following personal data when you use Oitava:
- Account data — email address, hashed password, email verification status.
- Profile and preferences — display name, country, preferred display currency, application theme.
- Financial data you provide — portfolio names, brokerage, base currency, imported transactions (date, ticker, quantity, price, fees), watchlists, tax settings.
- Billing data — subscription status, Stripe customer and subscription identifiers. Full payment card details are handled exclusively by Stripe and are never stored on our servers.
- Technical data — IP address (used for rate limiting and bot protection; not logged to a persistent store beyond what our infrastructure providers retain).
3. How We Use Your Data
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide and operate the service | Performance of a contract (Art. 6(1)(b)) |
| Process payments and manage subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Send transactional emails (verification, password reset, billing) | Performance of a contract (Art. 6(1)(b)) |
| Send earnings notifications and transcript alerts for companies you track (weekly digest and transcript available emails/in-app alerts) | Legitimate interests (Art. 6(1)(f)) — directly related to the portfolio tracking service you subscribed to. You can opt out at any time in Settings → Personal → Notifications. |
| Prevent abuse and enforce rate limits | Legitimate interests (Art. 6(1)(f)) |
| Monitor errors and maintain platform stability | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your data. We do not use your data for advertising or profiling.
4. Data Processors (Sub-processors)
We share your data with the following trusted third-party processors, each bound by data processing agreements:
- Stripe (USA, EU adequacy / SCCs) — payment processing and subscription management.
- Railway (USA, SCCs) — database and backend API hosting. Your portfolio and transaction data is stored here.
- Cloudflare Pages (USA, SCCs / EU adequacy) — frontend hosting, CDN delivery, and DDoS protection. Edge nodes may be located globally; user-identifying data is not persistently stored at the edge.
- Brevo (EU) — transactional email delivery (verification, password reset, billing notifications, earnings digests, and transcript alerts).
- Sentry (USA, SCCs) — error monitoring and application diagnostics. Error reports may include anonymised stack traces and request metadata; we do not send financial data to Sentry.
- Cloudflare Turnstile (USA, SCCs) — bot protection on public forms.
5. Data Retention
We retain your personal data for as long as your account exists. If you delete your account, all associated data is permanently deleted immediately. If your trial expires or your subscription lapses, your account is locked but your data is retained so you can reactivate at any time. You may request deletion at any time regardless of account status — see Section 6.
Accounts that have been locked for an extended period may be subject to deletion after we provide prior notice to the registered email address. We will give you a reasonable opportunity to reactivate your account or export your data before any deletion occurs.
6. Your Rights
EU/EEA residents (GDPR) — you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. You also have the right to lodge a complaint with your national data protection supervisory authority. As our operations are based in Portugal, our supervisory authority is the Comissão Nacional de Protecção de Dados (CNPD), cnpd.pt.
California residents (CCPA) — you have the right to know what personal information we collect, to request deletion, and to opt out of sale (we do not sell personal information).
To exercise any of these rights, use the self-service tools in Settings inside the app (data export and account deletion), or contact us at [email protected]. We will respond within 30 days.
7. Cookies
Oitava uses only functional cookies necessary to operate the service:
- Authentication cookie (httpOnly, Secure) — keeps you logged in. Session-scoped.
- logged_in indicator — a non-httpOnly cookie used by the frontend to detect login state. Contains no sensitive data.
- Analytics cookies (PostHog) — set only if you accept analytics in the cookie consent banner. Used to understand feature usage and improve the product. You can decline these at any time; declining only disables analytics, the app continues to work normally.
We do not use advertising or cross-site tracking cookies.
8. International Transfers
Some of our processors are based outside the EU/EEA (see Section 4). Transfers to these processors rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or on an applicable adequacy decision.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before any material change takes effect. The current version is always available at this URL.
10. Contact
Privacy questions or requests: [email protected]