Privacy Policy

Version 1.7 | Last updated: 2026-10-18

1. Introduction

Planfolio (“we,” “our,” or “us”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our portfolio tracking application.

The data controller within the meaning of Art. 4(7) GDPR is Surplexic GmbH, Eckenheimer Landstraße 24, 60318 Frankfurt am Main, Germany — info@surplexic.com.

2. Information We Collect

2.1 Personal Information

• Account Information: Email address, username, and authentication credentials (encrypted)
• Profile Data: User preferences and settings
• Terms Acceptance: Records of your acceptance of our Terms and Conditions

2.2 Financial Information

• Clear Transaction Data: Asset-Symbol of your transactions
• Encrypted Transaction Data: Amount, Date, Price, Fees of your Transactions (End-to-end encrypted and stored securely)
• Broker sync data (only if you connect a broker via SnapTrade): the accounts, holdings and transactions your broker reports through SnapTrade. They pass through our servers to your device without being stored, and are then end-to-end encrypted like all other portfolio data (see Section 4.1.I)
• AI assistant summary (only if you connect an AI assistant): a readable summary of the portfolios you choose to share. This is the only copy of your financial data that is not end-to-end encrypted (see Section 4.1.J)

2.2a End-to-End Encryption and Its Two Opt-in Exceptions

Your portfolio data is end-to-end encrypted on your device with a key only you hold. Surplexic, Google and any other provider cannot read it. This changes only if you actively switch on one of these optional features:

1. Broker sync (SnapTrade): your broker data is retrieved by SnapTrade. While it is retrieved and transferred, it is processed by SnapTrade under SnapTrade’s own terms and privacy policy. Once it reaches the Planfolio app it is end-to-end encrypted on your device.
2. AI assistant connector (Claude by Anthropic, ChatGPT by OpenAI): when you connect an AI assistant, the app creates a readable copy (summary) of the portfolios you select and shares it with the AI provider you chose. Once the AI assistant has read it, Anthropic’s or OpenAI’s terms and privacy policy apply.

If you use neither feature, no readable copy of your financial data exists outside your device.

2.3 Usage Information

• App Usage: Features used, pages viewed, and user interactions for service improvement
• Log Data: Error logs and performance data for service improvement

3. How We Use Your Information

3.1 Service Provision

• Provide and maintain the portfolio tracking service
• Calculate portfolio performance and analytics
• Display financial data and reports

3.2 Service Improvement

• Analyze usage to improve features
• Debug issues and optimize performance
• Develop new features and functionality

3.3 Communication

• Send important service notifications
• Respond to your inquiries and support requests
• Notify you of Terms and Privacy Policy updates
• Send product update emails, only if you opted in (see Section 3.4)

3.4 Product Update Emails (Opt-in)

If you choose “Yes, keep me posted” during setup or turn on “Product update emails” in Settings, we send you occasional emails with portfolio tips, new features and product news (about 1–2 per month).

• Legal basis: Art. 6(1)(a) GDPR and § 7(2) No. 2 UWG: your consent. Nothing is pre-selected; if you decline, you receive only service emails
• Data: email address, first name, app language, plan and onboarding status (to tailor the content), and a record of your consent (time, where you gave it, and the version of the consent text) as proof of consent
• Withdrawal: at any time, without giving reasons, via the unsubscribe link in every email or the toggle in Settings (Art. 7(3) GDPR). Withdrawal does not affect the lawfulness of emails sent before
• Measuring opens and clicks: our emails may contain a tracking pixel and tracked links that tell us whether an email was opened and which links were clicked. We use this only in aggregate to improve our emails. It is covered by your consent and ends when you unsubscribe
• Service emails (account, security, trial and subscription notices) are sent regardless of this choice, because they are needed to provide the service (Art. 6(1)(b) GDPR)

4. Information Sharing and Disclosure

4.1 Third-Party Processors

We use the following third-party processors (A–H, K and L) to provide the service. With each of these we have a Data Processing Addendum (Auftragsverarbeitungsvertrag, AVV) in place as required by GDPR Art. 28. The complete list of subprocessors is available on request at info@surplexic.com. Sections I and J describe optional features where data is passed to third parties that act as independent controllers under their own terms and privacy policies; they are used only if you switch them on.

A. Firebase Authentication (Google Ireland Limited)

• Purpose: account authentication, password reset, session management
• Data: email address, hashed password, pseudonymous Firebase User ID, sign-in timestamps
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you
• Transfer: data is stored on Google’s EU infrastructure; transfers to the United States, where they occur, are based on the EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework

B. Firebase Realtime Database (Google Ireland Limited)

• Purpose: storing your portfolio data (transactions, holdings, preferences)
• Data: portfolio data stored end-to-end encrypted using a key derived from your password and recovery key — Google cannot read this content
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you
• Transfer: see Section 4.1.A

C. Firebase Cloud Functions (Google Ireland Limited)

• Purpose: server-side logic such as account deletion, broker sync (Section 4.1.I) and the AI assistant connector (Section 4.1.J)
• Data: limited to the data needed for the specific function call. Unencrypted portfolio content is processed only for the two opt-in features in Sections 4.1.I and 4.1.J, and only as described there
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract with you
• Transfer: see Section 4.1.A

D. Firebase App Check (Google Ireland Limited)

• Purpose: anti-abuse and platform integrity (verifies requests come from a genuine, unmodified instance of the Planfolio app)
• Data: anonymized device attestation tokens issued by Apple App Attest; no user-identifying data
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest in preventing abuse and securing the service
• Transfer: see Section 4.1.A

E. Firebase Crashlytics (Google Ireland Limited) — see Section 4.4 for full disclosure

F. Broker statement import (when broker import is used)

• Purpose: parsing of broker transaction statements (PDF/CSV) you upload to import into Planfolio
• Data: only the broker statement file you yourself select; the file is parsed entirely on your device — its contents are not transmitted to Surplexic servers, Firebase Cloud Functions, or any third party as part of the parsing step. Only the resulting transactions you confirm are then saved to your encrypted portfolio (see Section 4.1.B)
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract; the import is initiated by you
• Note: this is a local file parser, not an API integration with the broker. The file import does not connect to your broker account (for the optional broker connection, see Section 4.1.I). You are responsible for complying with your broker’s own terms (see ToS § 4.3)

G. Market data providers

• Purpose: asset prices, fundamentals, dividend data
• Data: no personal or user data is shared; only asset symbols are queried

H. Apple (App Store / In-App Purchase)

• Purpose: subscription billing and Apple-side subscription management
• Data: subscription status; payment data handled exclusively by Apple, not by us
• Legal basis: Art. 6(1)(b) GDPR — performance of the contract; Apple acts as a separate controller for payment data

I. Broker sync via SnapTrade (only if you connect a broker) (SnapTrade Inc., Toronto, Canada)

• Purpose: read-only connection to your broker account so your holdings and transactions can be imported automatically
• How it works: you sign in to your broker through SnapTrade’s connection portal. Your broker login credentials go to SnapTrade and your broker; we never see or store them. The connection is read-only: no orders or transfers can be made through it
• Data: SnapTrade retrieves your broker accounts, balances, holdings and transactions from your broker. Our Cloud Functions forward this data to your device without storing it; the app then end-to-end encrypts it before saving it to your portfolio (Section 4.1.B). We store only what is needed to keep the connection working: a SnapTrade user ID and access secret, which broker accounts you linked, and one-way hashes of broker account identifiers (to prevent abuse of free trials)
• SnapTrade’s role: SnapTrade acts as an independent controller for the data it retrieves from your broker. While you use the broker sync, SnapTrade’s own terms of service and privacy policy apply (https://snaptrade.com/privacy-policy). We have no influence on how SnapTrade processes your data
• Legal basis: Art. 6(1)(b) GDPR — the sync is a feature you request; Art. 6(1)(a) GDPR — your consent when you connect a broker
• Transfer: SnapTrade is based in Canada, which benefits from an EU adequacy decision (Art. 45 GDPR). Any onward transfers by SnapTrade are governed by its privacy policy
• Ending it: disconnect a broker in the app at any time. When you delete your Planfolio account we also delete your SnapTrade user and all connections

J. AI assistant connector (only if you connect an AI assistant) — Claude (Anthropic PBC, USA; Anthropic Ireland Limited for EU users) and ChatGPT (OpenAI OpCo, LLC, USA; OpenAI Ireland Ltd for EU users)

• Purpose: let an AI assistant you use answer questions about your portfolio
• What is created: when you connect an assistant, the app creates a readable copy (summary) of the portfolios you select and uploads it to our servers. This copy is not end-to-end encrypted. It is stored on Google’s EU infrastructure (Section 4.1.A), encrypted at rest with a key managed in Google Cloud KMS, and is technically accessible to our server systems so it can be served to the assistant
• Data in the summary: portfolio name and currency, open positions (security names and identifiers, quantities, values, weights), totals and performance, allocation, quality scores, dividend outlook and health-check results; only if you enable it, your 200 most recent transactions. It does not contain your name, email address, broker names, account numbers or encryption keys. It is linked to your Planfolio user ID
• Connection data: the name and redirect address of the assistant you connected, which portfolios and permissions you granted, timestamps, and hashed access tokens
• Sharing with the AI provider: the assistant fetches data from the summary whenever you ask it about your portfolio. Once the AI provider has received the data, it — like everything else you type into the assistant — is processed by Anthropic or OpenAI as an independent controller under their own terms and privacy policies (Anthropic: https://www.anthropic.com/legal/privacy; OpenAI: https://openai.com/policies/privacy-policy). Their retention and whether they use conversations for model training depend on your account settings with them; we have no influence on this
• Legal basis: Art. 6(1)(a) GDPR — your explicit consent on the consent screen in the app. You may withdraw consent at any time by disconnecting the assistant (Art. 7(3) GDPR)
• Transfer: the transfer to the AI provider happens at your request. Anthropic and OpenAI may process data in the United States; their safeguards (e.g. EU Standard Contractual Clauses, EU-US Data Privacy Framework) are described in their privacy policies
• Ending it: disconnecting an assistant revokes its access immediately; disconnecting the last assistant deletes the summary from our servers. Removing a portfolio from the shared selection deletes its summary. Deleting your account deletes all connector data. Data the AI provider already received is subject to its own deletion rules
• Availability: Pro subscribers and active trials only; if your subscription ends, the assistant no longer receives portfolio data

K. Loops (Loops, Inc., USA)

• Purpose: sending service emails (welcome, trial and subscription notices) and, only with your consent, product update emails (Section 3.4)
• Data: email address, first name, pseudonymous user ID, app language, plan, trial dates, onboarding status, consent status, and email open/click events
• Legal basis: Art. 6(1)(b) GDPR for service emails; Art. 6(1)(a) GDPR for product update emails
• Transfer: transfers to the United States are based on the EU Standard Contractual Clauses and, where the recipient is certified, the EU-US Data Privacy Framework

L. Postmark (ActiveCampaign, LLC, USA)

• Purpose: sending account emails (email verification, password reset, email change)
• Data: email address, the email content, delivery status
• Legal basis: Art. 6(1)(b) GDPR: performance of the contract with you
• Transfer: transfers to the United States are based on the EU Standard Contractual Clauses and, where the recipient is certified, the EU-US Data Privacy Framework

4.2 Legal Requirements

We may disclose your information if we are required to do so by law or in response to valid requests by public authorities.

4.3 Business Transfers

In the event of a merger, acquisition, or sale, your information may be transferred as part of the business assets.

4.4 Crash Diagnostics (Firebase Crashlytics)

When the app crashes or encounters an internal error, an automatic diagnostic report is sent to Firebase Crashlytics, a service operated by Google Ireland Limited. The report contains only technical information:

• Stack trace of the error
• Device model and iOS version
• App version and build number
• A non-personal cohort label (subscription tier: free / trial / pro)
• A pseudonymous installation identifier managed by Google (within the meaning of Art. 4(5) GDPR — cannot be linked to your identity outside this app, but may persist for the installation lifetime)

We do not transmit any of the following to Crashlytics: your name, email address, account ID, portfolio holdings, transactions, or any other identifiable information. The diagnostic report is not linked to your Planfolio user account on our side.

Legal basis (GDPR Art. 6(1)(f) — legitimate interest): processing this data is necessary to detect, debug, and fix bugs in the app, which is essential to providing a stable and secure service. Because no personal data is collected for this purpose, we do not require your separate consent.

Retention: Crash reports are automatically deleted after 90 days by Crashlytics’ default retention policy.

Right to object (GDPR Art. 21): you may object to this processing at any time by contacting us at info@surplexic.com. Future reports from your device will then no longer be processed for this purpose.

International transfers: Google Ireland Limited acts as our processor under a Data Processing Addendum. Transfers to the United States are made on the basis of the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

4.5 Improving Security Matching During Imports

When an import or broker sync can’t identify a security automatically and you pick, skip or merge it by hand, we store a record of that case. We use these records only to improve automatic matching for future imports. A record contains:

• the security identifiers and description supplied by your broker or file (for example symbol, name, ISIN, exchange, currency and security type)
• the candidates we offered, and the security you picked or whether you skipped it
• the import source (broker or file format), app version and your country setting
• a one-way hash of your user ID, and how often and when the case occurred

We do not store amounts, share counts, prices, fees, trade dates or account numbers in these records. The records are stored in Firebase Realtime Database (Section 4.1.B), and only our administrators can read them.

Legal basis (GDPR Art. 6(1)(f) — legitimate interest): improving how reliably imports recognise securities.

Retention: we keep a record for as long as the case is useful for improving matching.

Right to object and erasure (GDPR Art. 17, 21): you may object or ask us to delete your records at any time by contacting info@surplexic.com.

5. Data Security

5.1 Security Measures

• Authentication credentials are securely stored by Firebase Auth
• Data transmission is protected with HTTPS/TLS encryption
• Secure authentication and authorization systems
• Regular security assessments and updates
• Access controls and monitoring
• All your financial transaction data is end-to-end encrypted and stored securely. It can only be read by you; we do not have access to your unencrypted financial data.
• Exceptions you opt in to: if you connect a broker via SnapTrade, your broker data is processed by SnapTrade under its own policy until it reaches your device (Section 4.1.I). If you connect an AI assistant, a readable, server-side-encrypted (not end-to-end encrypted) copy of the portfolios you select is created and shared with the AI provider you chose (Section 4.1.J).

5.2 Data Retention

We retain personal data only for as long as needed for the purpose for which it was collected, then delete it. Specific retention periods per category:

Where applicable law requires longer retention (e.g., tax law, AML, legal hold), we retain the minimum data necessary to comply for the legally required period and restrict its processing.

6. Your Rights and Choices

6.1 Account Management

• Update your personal information through the app
• Delete your account and associated data

7. GDPR Rights (EU Users)

If you are a resident of the European Union, you have additional rights under the General Data Protection Regulation (GDPR):

7.1 Your Rights

• Right of Access (Art. 15 GDPR): Request copies of your personal data
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate data
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal data
• Right to Restrict Processing (Art. 18 GDPR): Request limitation of data processing
• Right to Data Portability (Art. 20 GDPR): Request transfer of your data in a structured, commonly used, machine-readable format
• Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests
• Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you may withdraw that consent at any time without affecting the lawfulness of prior processing

To exercise these rights, contact us at info@surplexic.com. We will respond within 30 days as required by Art. 12(3) GDPR.

7.2 Right to Lodge a Complaint (Art. 77 GDPR)

You have the right to lodge a complaint with a data protection supervisory authority if you believe your personal data has been processed in violation of the GDPR. The supervisory authority responsible for Surplexic GmbH is:

Der Hessische Beauftragte für Datenschutz und Informationsfreiheit
Postfach 3163
65021 Wiesbaden
Germany
Telefon: +49 611 1408-0
E-Mail: poststelle@datenschutz.hessen.de
Web: https://datenschutz.hessen.de

You may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or place of the alleged infringement.

7.3 Legal Basis for Processing

• Contract (Art. 6(1)(b) GDPR): Processing necessary for providing our services (account, portfolio data, subscription management)
• Consent (Art. 6(1)(a) GDPR): Where you have given explicit consent (e.g., marketing emails, optional features such as the broker sync and the AI assistant connector)
• Legitimate Interests (Art. 6(1)(f) GDPR): For service improvement, fraud prevention, and automatic crash diagnostics (see Section 4.4)
• Legal Obligation (Art. 6(1)(c) GDPR): Where required to comply with applicable law (e.g., tax, AML, court orders)

8. Children’s Privacy

Our service is not intended for children under 18 years of age. We do not knowingly collect personal information from children under 18.

9. International Data Transfers

Your data may be transferred to and processed in countries other than your own. We ensure appropriate safeguards are in place for international transfers (see Section 4.1 for the applicable mechanisms, including EU Standard Contractual Clauses (SCCs) per Art. 46(2)(c) GDPR and the EU–US Data Privacy Framework where the recipient is certified).

10. Tracking Technologies on Mobile

Planfolio is a mobile application and does not use cookies. We also do not use the Apple Advertising Identifier (IDFA) or any cross-app/cross-site tracking technologies. The App Tracking Transparency (ATT) framework is therefore not required.

The only technical identifiers we rely on are:

• Firebase Installation ID: a pseudonymous, app-scoped identifier (Art. 4(5) GDPR) managed by Google for crash reporting and authentication. It cannot be linked to your identity outside this app.
• Apple’s anonymized device identifiers used by App Check (Apple App Attest) for anti-fraud and platform integrity. These cannot be used to track you across apps.

We do not run any web analytics, marketing pixels, or third-party advertising SDKs in the app.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new Privacy Policy in the app and updating the “Last updated” date.

12. Contact Information

If you have questions about this Privacy Policy or wish to exercise your privacy rights, please contact us at:

• Privacy / GDPR / data protection: info@surplexic.com (please use subject line “GDPR Request”)
• General product support: support@planfolio.io
• Website: https://planfolio.io/privacy

13. Data Protection Contact

Surplexic GmbH is not required to appoint a Data Protection Officer under § 38 BDSG (fewer than 20 employees regularly processing personal data, no core activity requiring systematic large-scale monitoring or processing of special-category data).

For all data protection inquiries and to exercise your GDPR rights, please contact:

Surplexic GmbH — Data Protection
Eckenheimer Landstraße 24
60318 Frankfurt am Main
Germany
Email: info@surplexic.com

By using Planfolio, you acknowledge that you have read and understood this Privacy Policy.