Privacy policy

1. Data controller

The controller responsible for processing your personal data is Bolsarex (hereinafter, "we" or "Bolsarex"), with a contact address at support@bolsarex.app.

2. Data we collect

When you use Bolsarex we collect only the data necessary to provide you with the service:

• Account data: email address and password (stored with a bcrypt hash).
• Portfolio data: the assets, transactions and alerts you enter manually. We have no access to your broker accounts.
• Usage data: access logs, app version and operating system, to diagnose errors and improve the service.
• Visits to this website. We measure, anonymously, how many people visit bolsarex.app, where they come from (the referring domain and any campaign tags in the address), which page they view, whether they click the download buttons and, in the calculator, that a report was produced and which brokers the files came from. We use no cookies and store nothing in your browser, we do not identify you or link you to your app account, and we never send amounts, file names or file contents. We honour your browser's Do Not Track and Global Privacy Control signals. The data is processed by PostHog (EU).
• Payment data: if you subscribe to the Pro plan, the payment is processed through the Apple App Store or Google Play. Bolsarex does not store credit card data.

3. Data processors (third parties)

To provide the service we rely on the following providers, who process personal data on our behalf under their own security safeguards and, where applicable, a data processing agreement:

• PostHog (EU): product analytics (app usage events) to understand how Bolsarex is used and improve the service.
• Sentry: technical error logging (crash reports) to diagnose and fix app issues.
• Resend: sending of transactional emails (account verification, password reset) to the address you provide.
• Anthropic (US): artificial intelligence provider that interprets the format of broker files we do not recognise (in the app's import and in the web calculator). It receives only the header and a few lines of the file, as explained in point 10.
• Google and Apple: if you sign in with your Google or Apple account, these providers confirm your identity (name and email) based on the permissions you grant them.
• Apple App Store / Google Play (via RevenueCat): management of Pro subscriptions, as described in point 2.

4. Purpose of the processing

We use your data to:

• Provide you with the investment portfolio tracking service.
• Send you notifications for the price alerts you have set up.
• Manage your subscription and handle support requests.
• Improve the app based on aggregated and anonymised usage data.

5. Legal basis

The processing is based on the performance of the service contract you accept when you register (art. 6.1.b GDPR). Sending of commercial communications, if any, is based on your express consent (art. 6.1.a GDPR).

6. Data retention

We keep your data for as long as your account is active. If you delete your account, we erase all your data within a maximum of 30 days, unless the law requires us to keep it for longer. See how to request the deletion of your account and what data is retained in each case. Data from the web calculator, which is used without an account, has its own retention periods, described in point 10.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, portability and restriction of processing at any time by writing to support@bolsarex.app. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

8. Security

All communication between the app and our servers is encrypted with HTTPS/TLS. Session tokens are stored in the iOS Keychain or the encrypted Android Keystore. We do not sell or transfer your data to third parties for advertising purposes.

9. International transfers

Data is stored on servers located in the European Union. The processors listed in point 3 may involve transfers outside the EEA; in that case we ensure appropriate safeguards are in place in accordance with the GDPR (standard contractual clauses or another valid mechanism).

10. Capital gains calculator (free web tool)

The calculator at bolsarex.app/calculadora-plusvalias is used without creating an account. This is what happens with what you upload to it:

• Your file is read in your browser. The calculation runs on your device: the full file and the result are not sent to our servers.
• Brokers we do not recognise. If you upload a CSV whose format we cannot identify, your browser sends our server its header and, at most, the first 16 lines, and we forward them to Anthropic so it can tell us what each column is. Those lines may include data about your transactions (dates, securities, amounts) and, if the file has them at the top, the account holder or account number. They are sent as they are because the AI needs them, and we do not store them in that form.
• What we store from them. Only the structure of the format, already masked: on the server we replace every digit with a 9 and email addresses and IBAN numbers with a placeholder. Lines before the header are stored without any letters, and if we cannot identify the header reliably we keep no letters from the other lines either. In the header and in the rows, letters are kept (column names, transaction type, security name). We also store the column mapping the AI returns and how many times we have seen that format.
• When a file cannot be read (for example a PDF, or a known broker whose format has changed) we send only the broker's name, if we recognised it, and a code for the reason it failed; never the content of the file. We store only a counter per broker and reason.
• What for. To add compatibility with more brokers and to detect when one changes its format. We do not use it for anything else or link it to any person.
• How long. 90 days from the last time we receive that same format; each new receipt renews the period. After that it is deleted automatically.
• Your IP address. To limit the number of AI reads per person per day we store, for about 25 hours, only a code derived from the IP (a hash with a key that changes every day), not the IP itself. The server's access logs (point 2) do record the IP and browser of each request.

This processing is based on our legitimate interest in offering the tool, preventing abuse and improving its compatibility (art. 6.1.f GDPR). You can object by writing to support@bolsarex.app.

11. Changes to this policy

We may update this policy when necessary. If the changes are significant, we will notify you by email at least 15 days in advance. The date of the last update always appears at the start of the document.

12. Contact

For any questions about privacy, write to us at support@bolsarex.app. We respond within a maximum of 72 hours.