Privacy policy

1. Data controller

The controller responsible for processing your personal data is Bolsarex (hereinafter, "we" or "Bolsarex"), with a contact address at support@bolsarex.app.

2. Data we collect

When you use Bolsarex we collect only the data necessary to provide you with the service:

• Account data: email address and password (stored with a bcrypt hash).
• Portfolio data: the assets, transactions and alerts you enter manually. We have no access to your broker accounts.
• Usage data: access logs, app version and operating system, to diagnose errors and improve the service.
• Payment data: if you subscribe to the Pro plan, the payment is processed through the Apple App Store or Google Play. Bolsarex does not store credit card data.

3. Data processors (third parties)

To provide the service we rely on the following providers, who process personal data on our behalf under their own security safeguards and, where applicable, a data processing agreement:

• PostHog (EU): product analytics (app usage events) to understand how Bolsarex is used and improve the service.
• Sentry: technical error logging (crash reports) to diagnose and fix app issues.
• Resend: sending of transactional emails (account verification, password reset) to the address you provide.
• Google and Apple: if you sign in with your Google or Apple account, these providers confirm your identity (name and email) based on the permissions you grant them.
• Apple App Store / Google Play (via RevenueCat): management of Pro subscriptions, as described in point 2.

4. Purpose of the processing

We use your data to:

• Provide you with the investment portfolio tracking service.
• Send you notifications for the price alerts you have set up.
• Manage your subscription and handle support requests.
• Improve the app based on aggregated and anonymised usage data.

5. Legal basis

The processing is based on the performance of the service contract you accept when you register (art. 6.1.b GDPR). Sending of commercial communications, if any, is based on your express consent (art. 6.1.a GDPR).

6. Data retention

We keep your data for as long as your account is active. If you delete your account, we erase all your data within a maximum of 30 days, unless the law requires us to keep it for longer. See how to request the deletion of your account and what data is retained in each case.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, portability and restriction of processing at any time by writing to support@bolsarex.app. You also have the right to lodge a complaint with the Spanish Data Protection Agency (aepd.es).

8. Security

All communication between the app and our servers is encrypted with HTTPS/TLS. Session tokens are stored in the iOS Keychain or the encrypted Android Keystore. We do not sell or transfer your data to third parties for advertising purposes.

9. International transfers

Data is stored on servers located in the European Union. The processors listed in point 3 may involve transfers outside the EEA; in that case we ensure appropriate safeguards are in place in accordance with the GDPR (standard contractual clauses or another valid mechanism).

10. Changes to this policy

We may update this policy when necessary. If the changes are significant, we will notify you by email at least 15 days in advance. The date of the last update always appears at the start of the document.

11. Contact

For any questions about privacy, write to us at support@bolsarex.app. We respond within a maximum of 72 hours.