GDPR privacy notice

Controller and contact

The service operates as Novaulta.com. For personal-data requests, contact h.sag58@gmail.com. A postal address has not yet been published.

Data, purposes and legal bases

Google sign-in supplies your Google account ID, name, email, profile photo link and verification status. We process IP, browser and session metadata for access security, and last backup method/time plus a short sync lock to coordinate backups. We do not store your assets, liabilities, goals, monthly records or vault password on our server; the financial vault is encrypted on your device.

• Account access and backup status: GDPR Article 6(1)(b), performance of the service contract.
• Preventing unauthorized access and backup conflicts: Article 6(1)(f), our legitimate interest in security and data integrity.
• Cloud AI requires a separate provider-specific optional choice in Settings, which you can turn off. Acknowledging this notice at sign-in does not grant that choice.
• Google sign-in is required for an account. Cloud backup and AI are optional. We do not use advertising or behavioral analytics cookies.

Recipients and transfers outside the EU/EEA

Google handles authentication; Cloudflare hosts the service and D1 account database. If you choose a backup, the encrypted file goes to your own Google Drive or WebDAV account. Rate, market and inflation data providers, named in the privacy policy, may receive a requested symbol, currency, country or date and connection metadata, but not your quantities. If you separately enable cloud AI, your question and, only if you choose it, the previewed portfolio summary go directly from your browser to your chosen Google, OpenAI or Anthropic service, or, for an Ollama cloud model, through the Ollama service on your device to Ollama. These providers may process data outside the EU/EEA. Exact destination countries and legal transfer safeguards depend on provider and configuration; contact us for details.

Retention and deletion

Account and backup metadata remain while your account is active. A session ends six to seven days after you last used the service and, while you use it, is extended once a day; expired sessions, with the IP address and browser details they hold, are deleted within a day. Request counters kept with an IP address to limit abuse are deleted an hour after the last request, within a day at the latest. Sync locks expire after about two minutes. Deleting your account in Settings removes server account, session and backup metadata and withdraws the access you gave Novaulta in Google through Google's revoke endpoint. You can choose on the deletion screen to also delete the encrypted vault in this browser. Vaults on other devices and backups in your own cloud accounts are not automatically removed. Security logs and third-party records may follow the relevant provider's retention rules.

Your rights and complaints

You may request information, access, correction, erasure, restriction and, where applicable, portability, and object to processing based on legitimate interests. You can withdraw your optional AI choice in Settings; this does not affect processing already carried out. Send requests to h.sag58@gmail.com. You may also complain to the data protection authority in the EU/EEA country where you live, work or believe an infringement occurred. Novaulta does not make solely automated decisions about you with legal or similarly significant effects.