Privacy Policy

Last updated: [TODO: date]

In short: we collect only what the bot needs to work: your Telegram identity, the tickers you follow, your settings and, if you pay, a record of the payment. We do not sell your data, we do not show ads, this website has no cookies or tracking, and your personal data is never sent to an AI provider: our AI runs on our own servers and only reads public SEC filings.

This policy applies to all users, wherever they live. Because we are established in the EU, we process everyone's personal data under the EU General Data Protection Regulation (GDPR).

1. Controller

[TODO: company name] S.R.L., [TODO: registered office], Romania, fiscal code [TODO: CUI]. Email: support@portfowhisper.com. We have not appointed a data protection officer, as we are not required to; write to the address above with any privacy question.

2. What we collect and why

Telegram account data: when you write to the bot, Telegram sends us your messages together with your Telegram user ID and chat ID, your first name and, if you have set them, your last name, username and app language. We store these messages to process your commands reliably. We use the IDs to create your account and send you alerts. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
Your settings and usage: the tickers you follow, alert levels, pause state, trial and subscription status. Art. 6(1)(b) GDPR.
Delivery records: which alerts we sent you and when, so that we deliver reliably, avoid duplicates and can update alerts after you upgrade. Art. 6(1)(b) GDPR.
Payment data: if you subscribe to Pro, you pay on a Stripe page. Stripe collects your card details, billing information and email address; we never see your card number. We receive and keep the payment and subscription IDs, amount, currency, dates and status. Your email address stays with Stripe; we look it up there only to identify you when you write to us, for example to cancel without the bot. Art. 6(1)(b) GDPR, and Art. 6(1)(c) GDPR for accounting and tax obligations.
Support messages: if you email us or use /paysupport, we use your email address and message to answer you. Art. 6(1)(b) GDPR, or our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).
Technical logs: our servers and Cloudflare record technical data, such as IP addresses of requests to this website and error logs, to keep the service secure and working. Our legitimate interest in security and operation (Art. 6(1)(f) GDPR).

You give us this data voluntarily. Telegram data is needed to provide the service: without it the bot cannot work. We do not collect sensitive data, and we do not need your real name, email address or location.

No automated decisions about you. Alerts are selected by rules applied to filings and tickers, not to people. We do not profile you and we make no decisions with legal or similarly significant effects by automated means (Art. 22 GDPR).

This website uses no cookies, analytics, tracking pixels or third-party scripts.

3. Who receives your data

We share personal data only with the providers we need to run the service:

Telegram (Telegram FZ-LLC, Dubai, United Arab Emirates): delivers the bot's messages. Telegram's own privacy policy applies to your use of Telegram.
Stripe (Stripe Payments Europe Ltd., Ireland): payment processing. For card and fraud-prevention data Stripe acts as an independent controller under its own privacy policy.
Hosting: [TODO: server provider and location, e.g. Hetzner Online GmbH, Germany], as our processor.
Cloudflare (Cloudflare, Inc., USA): hosts this website, protects and routes traffic to our server and forwards support emails, as our processor.
Google (Google Ireland Ltd.): our support inbox (Gmail) receives the emails you send us.

We may disclose data when the law requires it, for example to authorities. We do not sell or rent personal data, and we do not share it for advertising.

4. International transfers

Our servers are in the EU. If you use the service from outside the EU, your data is transferred to and processed in the EU. Some providers process data outside the EU/EEA: Cloudflare and Google in the USA, under the EU-U.S. Data Privacy Framework and the European Commission's standard contractual clauses; Telegram in the United Arab Emirates, which is necessary to deliver the messages you ask for through Telegram (Art. 49(1)(b) GDPR).

5. How long we keep data

Account data, settings and delivery records: while your account exists. If you ask us to delete your account, we delete them within 30 days.
Telegram messages you sent to the bot, and the bot's direct replies to them: deleted automatically after 30 days.
Payment records: 10 years from the end of the financial year, as required by Romanian accounting law (Law 82/1991, art. 25).
Support emails: up to 2 years after the conversation ends, unless needed for a legal claim.
Technical logs: [TODO: e.g. up to 30 days].

6. Security

Data is transmitted over encrypted connections. Our database is not reachable from the internet, access is limited to the people who run the service, and backups are encrypted. [TODO: confirm once the production server is set up]

7. Children

The service is only for people aged 18 or over. We do not knowingly collect data from children. If we learn that a child uses the service, we delete the account.

8. Your rights

Wherever you live, you have the right to:

access your data and get a copy of it;
have inaccurate data corrected;
have your data deleted;
restrict processing;
receive your data in a portable format;
object to processing based on our legitimate interests.

To use these rights, write to support@portfowhisper.com from your email, or use /paysupport in the bot so we can identify your account. We answer within one month.

You also have the right to lodge a complaint with a data protection authority: in Romania, ANSPDCP (dataprotection.ro), or the authority in the country where you live or work.

9. Residents of the United States

We do not sell personal information and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act (CCPA) and similar state laws. We do not use or disclose sensitive personal information. The categories we collect are identifiers (Telegram IDs and names), commercial information (subscription and payment records) and internet activity related to the bot (your commands and settings). Their sources, purposes and recipients are described above. You can exercise the rights in section 8, including access and deletion, regardless of your state, and we will not treat you differently for doing so.

10. Changes

We update this policy when the service changes. If a change is significant, we tell you in the bot. The date at the top shows the current version.