Privacy Policy
Last updated: October 2026
1. Who We Are
Oitava (“we”, “us”, “our”) operates the investment portfolio tracking service at oitava.app. The service is operated by Maria Manuela Alves Gaspar Correia, NIF 155256920, a sole proprietor (Empresário em Nome Individual) registered in Portugal. We are the data controller for the personal data described in this policy.
Contact: [email protected]
2. Data We Collect
We collect the following personal data when you use Oitava:
- Account data — email address, hashed password, email verification status.
- Profile and preferences — display name, country, preferred display currency, application theme.
- Financial data you provide — portfolio names, brokerage, base currency, imported transactions (date, ticker, quantity, price, fees), watchlists, tax settings.
- Billing data — subscription status, Stripe customer and subscription identifiers. Full payment card details are handled exclusively by Stripe and are never stored on our servers.
- Technical data — IP address (used for rate limiting and bot protection; not logged to a persistent store beyond what our infrastructure providers retain).
3. How We Use Your Data
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide and operate the service | Performance of a contract (Art. 6(1)(b)) |
| Process payments and manage subscriptions | Performance of a contract (Art. 6(1)(b)) |
| Send transactional emails (verification, password reset, billing) | Performance of a contract (Art. 6(1)(b)) |
| Send earnings notifications and transcript alerts for companies you track (weekly digest and transcript available emails/in-app alerts) | Legitimate interests (Art. 6(1)(f)) — directly related to the portfolio tracking service you subscribed to. You can opt out at any time in Settings → Personal → Notifications. |
| Measure how the product is used (pages opened, features used, when the app is opened) to decide what to build and fix | Legitimate interests (Art. 6(1)(f)). We measure this on our servers, tied to your account, independently of the cookie banner. You can object at any time by emailing [email protected], and we will stop and delete your analytics profile. |
| Prevent abuse and enforce rate limits | Legitimate interests (Art. 6(1)(f)) |
| Monitor errors and maintain platform stability | Legitimate interests (Art. 6(1)(f)) |
| Comply with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not sell your data. We do not use your data for advertising or profiling.
4. Data Processors (Sub-processors)
We share your data with the following trusted third-party processors, each bound by data processing agreements:
- Stripe (USA, EU adequacy / SCCs) — payment processing and subscription management.
- Railway (USA, SCCs) — database and backend API hosting. Your portfolio and transaction data is stored here.
- Cloudflare Pages (USA, SCCs / EU adequacy) — frontend hosting, CDN delivery, and DDoS protection. Edge nodes may be located globally; user-identifying data is not persistently stored at the edge.
- Brevo (EU) — transactional email delivery (verification, password reset, billing notifications, earnings digests, and transcript alerts).
- PostHog (EU hosting). Product usage analytics. Records which pages you open and which actions you take in the app, linked to your account, so we can see what is used and what needs improving. No financial data (positions, balances, transaction amounts) is sent to PostHog.
- Sentry (USA, SCCs) — error monitoring and application diagnostics. Error reports may include anonymised stack traces and request metadata; we do not send financial data to Sentry.
- Cloudflare Turnstile (USA, SCCs) — bot protection on public forms.
5. Data Retention
We retain your personal data for as long as your account exists. If you delete your account, your portfolios, transactions, watchlists, saved charts, goals, settings and all other data you created are permanently deleted immediately. We keep only a minimal account record: your email address, your Google sign in ID if you used one, your Stripe customer and subscription IDs and subscription status, your signup date, and referral records. We keep it so that deleting and re-creating an account cannot be used to get a second free trial, and to keep our billing and referral records consistent. It has no fixed end date, and you can ask us to remove it too by contacting us (see section 6). If your trial expires or your subscription lapses your data is retained so you can reactivate at any time. You may request deletion at any time regardless of account status. Step by step instructions are on our delete account page.
Accounts that have been locked for an extended period may be subject to deletion after we provide prior notice to the registered email address. We will give you a reasonable opportunity to reactivate your account or export your data before any deletion occurs.
6. Your Rights
EU/EEA residents (GDPR) — you have the right to access, rectify, erase, restrict, and port your personal data, and to object to processing based on legitimate interests. You also have the right to lodge a complaint with your national data protection supervisory authority. As our operations are based in Portugal, our supervisory authority is the Comissão Nacional de Protecção de Dados (CNPD), cnpd.pt.
California residents (CCPA) — you have the right to know what personal information we collect, to request deletion, and to opt out of sale (we do not sell personal information).
To exercise any of these rights, use the self-service tools in Settings inside the app (data export and account deletion), or contact us at [email protected]. We will respond within 30 days.
7. Cookies
Oitava uses functional cookies necessary to operate the service, plus optional analytics cookies you can decline:
- Authentication cookie (httpOnly, Secure) — keeps you logged in. Session-scoped.
- logged_in indicator — a non-httpOnly cookie used by the frontend to detect login state. Contains no sensitive data.
- Analytics cookies (PostHog). Set only if you accept analytics in the cookie consent banner. They record detailed in-browser behaviour such as navigation and clicks. Declining them is free of consequence, the app works normally.
Declining analytics cookies stops the in-browser tracking described above. It does not stop the basic usage measurement we carry out on our own servers, which runs on legitimate interests and stores nothing on your device (see Section 3). To object to that as well, email [email protected].
We do not use advertising or cross-site tracking cookies.
8. International Transfers
Some of our processors are based outside the EU/EEA (see Section 4). Transfers to these processors rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or on an applicable adequacy decision.
9. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email at least 14 days before any material change takes effect. The current version is always available at this URL.
10. Contact
Privacy questions or requests: [email protected]