01Who we are

FolioCenter (“FolioCenter”, “we”, “us”) is a portfolio-tracking and performance-analytics service for retail investors, available at www.foliocenter.com and through the web application at app.foliocenter.com.

For the purposes of the GDPR, FolioCenter is the data controller of the personal data described in this policy.

02Scope of this policy

This policy covers personal data we process when you visit our marketing website, create an account, and use the FolioCenter application to track and analyse your portfolios. It does not cover third-party websites or services we link to (such as your broker, or market-data providers’ own sites), which have their own privacy policies.

03Data we collect

We collect only the data we need to run the service. This falls into the following categories:

Category	Examples
Account data	Email address, display name, and a securely hashed password. We never store your password in readable form.
Portfolio data	The holdings, transactions, cash movements, account balances, asset classifications and notes you enter or import. This data can reveal information about your finances, so we treat it as sensitive.
Imported files	Broker or bank statements and transaction exports (e.g. CSV or report files) that you upload so we can extract your transactions.
Subscription data	Your tier (Starter or Investor), subscription status, and billing history. Card details are handled by our payment processor — see section 8 — and are not stored by FolioCenter.
Technical data	IP address, browser and device type, language, and log data such as timestamps and pages or features accessed, used for security and to keep the service running.
Support data	The contents of messages you send us and our replies.

You are not required to provide portfolio data, but the service has little value without it. Providing accurate account data is necessary to create and secure your account.

04Broker imports & your credentials

FolioCenter imports your transactions from files you export from your broker and upload to us. We do not connect to your brokerage account, and we never ask for, receive, or store your broker login, password, or two-factor codes.

Once a file is processed, the transactions it contains become part of your portfolio data. You can delete an imported file’s data at any time from within the application.

05How and why we use your data

Under the GDPR we must have a lawful basis for each use of your data. Ours are:

Purpose	Legal basis (GDPR Art. 6)
Create your account and provide the tracking, import and analytics features	Performance of our contract with you
Calculate performance metrics such as TWROR and IRR from the data you provide	Performance of our contract
Manage Investor-tier subscriptions, billing and invoicing	Performance of our contract; legal obligation (accounting)
Keep the service secure, prevent abuse and fraud, and diagnose problems	Our legitimate interests in a safe, reliable service
Improve and develop features using aggregated or de-identified usage data	Our legitimate interests
Send service messages (e.g. security, billing, important changes)	Performance of our contract; legitimate interests
Send product news or marketing, where you have opted in	Your consent — withdrawable at any time
Comply with legal and regulatory obligations	Legal obligation

We do not use your portfolio data to make automated decisions that produce legal or similarly significant effects about you, and we do not sell your personal data.

06Market & reference data

To value your holdings and show prices, charts and corporate information, we retrieve market and reference data from third-party providers. These requests identify a security (for example by ISIN or ticker) — they do not reveal your identity, the size of your position, or any other personal information to those providers.

07Cookies & similar technologies

We use a small number of cookies and similar local-storage technologies:

• Strictly necessary — to sign you in, keep your session secure, and remember essential preferences such as your light/dark theme. These cannot be switched off.
• Analytics — where used, to understand which features are used so we can improve them. These are only set with your consent.

You can control non-essential cookies through our cookie banner and your browser settings. For full details, see our Cookie Policy.

08Who we share data with

We never sell your data. We share it only with service providers (“processors”) who help us run FolioCenter, and only as far as needed. Each is bound by a contract to protect your data and use it solely on our instructions. Our categories of processors are:

• Cloud hosting & infrastructure — to store your data and run the application.
• Payment processing — to take Investor-tier payments. The processor handles your card data directly; we receive only confirmation and limited billing details.
• Email delivery — to send account, security and (if you opted in) marketing messages.
• Market & reference data providers — as described in section 6.
• Error monitoring & analytics — where used, to keep the service reliable.

We may also disclose data where required by law, to enforce our terms, or to protect the rights, safety and property of FolioCenter, our users, or others. If FolioCenter is involved in a merger, acquisition or asset sale, your data may be transferred, and we will notify you before it becomes subject to a different privacy policy.

09International transfers

We aim to store and process your data within the European Economic Area (EEA). Where a processor is located outside the EEA, we ensure an adequate level of protection through an European Commission adequacy decision or Standard Contractual Clauses. You can ask us for details using the contact below.

10How long we keep data

• While your account is open — we keep your account and portfolio data so the service works.
• After you close your account — we delete or anonymise your portfolio data within a reasonable period, except where we must retain certain records (for example, invoices and accounting records, which Portuguese law requires us to keep for a defined period).
• Backups — residual copies may persist in secure backups for a limited time before being overwritten.

11How we protect your data

We take appropriate technical and organisational measures to protect your data, including encryption in transit (TLS), hashing of passwords, access controls limiting who can reach production data, and monitoring. No system can be guaranteed completely secure, but we work to protect your data and will notify you and the relevant authority of a breach where the law requires.

12Your rights

Under the GDPR you have the right to:

• Access a copy of the personal data we hold about you;
• Rectify data that is inaccurate or incomplete;
• Erase your data (“right to be forgotten”), subject to legal retention;
• Restrict or object to certain processing, including direct marketing;
• Port your data — receive it in a structured, machine-readable format. You can also export your portfolio data from within the application at any time;
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at privacy@foliocenter.com. We will respond within the time the law allows (normally one month). You also have the right to lodge a complaint with your supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD) — www.cnpd.pt.

13Children

FolioCenter is intended for adults managing their own investments and is not directed at anyone under 18. We do not knowingly collect data from children. If you believe a child has provided us data, contact us and we will delete it.

14Changes to this policy

We may update this policy from time to time. When we make material changes we will update the “Last updated” date above and, where appropriate, notify you by email or in the application. Continued use of FolioCenter after a change takes effect means you accept the updated policy.

15How to contact us

For any privacy question or to exercise your rights, email privacy@foliocenter.com. For general support, email support@foliocenter.com.

© 2026 FolioCenter. This Privacy Policy is provided for transparency and should be reviewed by qualified legal counsel before being relied upon. Bracketed placeholders must be completed before publication.