Privacy Policy
Last updated: 23 September 2026
This Privacy Policy explains how Alfafolio S.L. ("Alfafolio", "we", "us") collects, uses and shares personal data when you use alfafolio.com and related services (the "Service"). It is designed to meet the EU General Data Protection Regulation (GDPR), EU ePrivacy (cookie) rules, and U.S. privacy laws, including the California Consumer Privacy Act as amended by the CPRA (CCPA) and similar state laws. The Service is hosted in the European Union and serves users in the EU, the United States and elsewhere.
1. Controller
The controller of your personal data is Alfafolio S.L., a company registered in Spain. Our registered address and company details are listed on our Imprint page. Contact: info@alfafolio.com.
2. What we process, why, and on what legal basis
• Account data — email address, display name, salted password hash, sign-in timestamps, and the version of the Terms you accepted. – Purpose: providing your account. – Legal basis: performance of a contract (Art. 6(1)(b) GDPR). • Sign-in with X (optional) — if you choose “Continue with X”, we receive your X account ID, name and username and, where you have allowed it, your email address and profile image from X. We never receive your X password and we do not post to X on your behalf. – Purpose: creating your account and signing you in. – Legal basis: performance of a contract (Art. 6(1)(b) GDPR). • Your content — watchlists, portfolios, alert rules, notes and preferences you save. – Purpose: the Service's core functionality. – Legal basis: Art. 6(1)(b). • Technical logs — IP address, user agent, request timestamps, error logs. – Purpose: security, abuse prevention (e.g. sign-in rate limiting) and reliability. – Legal basis: legitimate interests (Art. 6(1)(f)). • Advertising data — cookies and similar identifiers, IP address, device and browser information, and information about your visits to this and other websites, collected by Google and its partners when ads are shown. – Purpose: displaying, measuring and (where permitted) personalising ads that fund the Service, and preventing ad fraud. – Legal basis: your consent (Art. 6(1)(a) GDPR and ePrivacy rules). – You can refuse or withdraw consent at any time. • Consent records — your cookie and consent choices. – Purpose: respecting and proving your choices. – Legal basis: legal obligation (Art. 6(1)(c), Art. 7(1)). • Communications — the content of messages you send us. – Purpose: answering you. – Legal basis: legitimate interests (Art. 6(1)(f)). • Local storage on your device — see the Cookie & Local Storage Policy. We do not sell personal data for money and do not make automated decisions with legal or similarly significant effect. Financial data displayed in the Service (fund filings, holdings) is public information about institutions, not data about you.
3. Advertising (Google AdSense)
We use Google AdSense to show ads. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the Internet. • In the EEA, the UK and Switzerland, advertising cookies are only set after you consent through our consent banner (a Google-certified consent management platform using the IAB Transparency & Consent Framework). If you decline, Google may show limited, non-personalised ads. • You can change your choices at any time via the "Privacy settings" link in the site footer. • You can opt out of personalised advertising at Google Ad Settings (https://adssettings.google.com), and opt out of other vendors' use of cookies for personalised advertising at https://www.aboutads.info/choices (U.S.) or https://www.youronlinechoices.eu (EU). • Learn how Google uses information from sites that use its services: https://policies.google.com/technologies/partner-sites.
4. Recipients and processors
• Hosting: our hosting provider in Germany (EU), acting as our processor under Art. 28 GDPR. • Advertising: Google Ireland Limited and Google LLC and their certified ad partners, which act as independent controllers for their own advertising purposes. • Sign-in with X: if you use “Continue with X”, X Corp. and its affiliates authenticate you and share the account details described in section 2 with us. X acts as an independent controller under its own privacy policy (x.com/privacy). • Authorities, courts or advisers where required by law or to protect our legal rights. We do not share personal data with other third parties.
5. International transfers
Our own storage is in the EU. Google and its partners, and X if you sign in with X, may process data in the United States and other countries. Transfers to the U.S. rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on Standard Contractual Clauses (Art. 46). We will use the same safeguards for any future non-EU processor.
6. Retention
• Account data and your content: for as long as your account exists, then deleted or anonymised without undue delay. • Consent records: for as long as needed to demonstrate compliance; consent choices are refreshed at least every 13 months. • Security logs: a short rolling window (up to 30 days), then deleted. • Advertising cookies: set and controlled by Google and its partners, typically up to 13 months; you can delete them in your browser at any time.
7. Your rights (EU/EEA and UK)
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). Where processing is based on consent you may withdraw it at any time with future effect, including via "Privacy settings". Contact info@alfafolio.com to exercise any right; we respond within one month. You also have the right to lodge a complaint with a supervisory authority (Art. 77), in particular in your EU member state of residence.
8. Your U.S. state privacy rights
8.1 Your rights
If you live in California or another U.S. state with a comprehensive privacy law (such as Colorado, Connecticut, Virginia, Utah, Texas or Oregon), you have these rights: • Right to know and access the personal information we hold about you, and to receive a copy. • Right to correct and to delete your personal information. • Right to opt out of the "sale" or "sharing" of personal information and of targeted (cross-context behavioural) advertising. Allowing Google advertising cookies may count as a "sale" or "sharing" under these laws. Use the "Do Not Sell or Share My Personal Information" link in the site footer. We also honour Global Privacy Control (GPC) browser signals as a valid opt-out. • Right not to be discriminated against for exercising your rights. • Right to appeal a decision on your request by replying to our response.
8.2 Information we collect and share
In the past 12 months we collected these categories: identifiers (email address, IP address, cookie and device IDs); internet or network activity (logs, ad interactions); and inferences drawn by advertising partners. Sources: you, your device, and Google. We disclose them to our hosting provider (service provider) and, for advertising, to Google and its partners (third parties). We do not collect sensitive personal information for inferring characteristics about you, and we do not knowingly sell or share data of anyone under 16.
8.3 How to make a request
Send requests to info@alfafolio.com. We will verify your identity by confirming control of your account email and respond within 45 days. You may use an authorised agent with your written permission.
8.4 Do Not Track and Global Privacy Control
Our site does not respond to browser "Do Not Track" signals, but it does honour GPC as described above.
9. Security
Passwords are stored only as salted hashes; transport is encrypted (HTTPS); access to production systems is restricted. No method of storage or transmission is 100% secure. We will notify you and the competent authority of personal-data breaches where the GDPR or applicable U.S. law requires it (Art. 33–34 GDPR).
10. Children
The Service is not directed at children and may not be used by anyone under 18. We do not knowingly collect personal data from children under 13 (U.S. COPPA) or under 16 (GDPR). If you believe a child has provided us data, contact info@alfafolio.com and we will delete it.
11. Changes
We will announce material changes to this policy in the app and update the "Last updated" date above. The "version" stamp on the Legal page identifies the current revision.
12. Contact
Questions about this policy: info@alfafolio.com (Alfafolio S.L., see our Imprint for company details).