Privacy Policy

Responsible for the data processing on this app is:
Sascha Klement (sole proprietor)
Am Bahnhof 44, 21218 Seevetal OT Emmelndorf, Germany
Email: support@north-folio.de

When using Northfolio, the following data may be processed:

• User account (e.g. display name)
• Email address
• Login information and login times
• Portfolio data (stored financial instruments, assignments)
• Balances and current values (asset values)
• CSV imports
• Screenshot imports (uploaded images; processed exclusively for one-time AI analysis and transmitted to OpenAI; not stored by Northfolio – see section 6)
• AI analyses (e.g. automated evaluations of uploaded screenshots)
• Anonymous usage statistics (e.g. page views, device type, origin) to improve the app
• Technical error logs (possibly including user ID, email, device, route) for stability and security improvement
• Voluntary cancellation feedback (reason and, if provided, free text) on account deletion

Your data is processed to provide and operate Northfolio – in particular to manage your account, display your portfolio, carry out imports and AI analyses, and to ensure the security and functionality of the app. In addition, we process anonymous usage statistics and technical error logs to improve stability, security and usability, and to protect against abusive login attempts.

Processing is carried out for the performance of the user contract (Art. 6 (1) lit. b GDPR), for the legitimate interests of the operator such as security, functionality and stability improvement (Art. 6 (1) lit. f GDPR), and on the basis of your consent where it has been obtained (Art. 6 (1) lit. a GDPR). The processing of anonymized usage statistics and technical error logs is based on legitimate interests (Art. 6 (1) lit. f GDPR) insofar as it is not already necessary for the performance of the contract.

Northfolio does not automatically query bank or portfolio data and does not establish connections to banks or brokers. No bank logins, passwords or TANs are collected. All financial data is provided by you manually or via imports (e.g. screenshot, CSV).

Uploaded screenshots are processed exclusively for the AI evaluation requested by the user. Northfolio does not store the uploaded images – neither in the app database nor in a file storage. After completion of the processing, the images are no longer available at Northfolio. The operator and staff cannot view uploaded screenshots via a Northfolio interface or database; routine manual access does not take place.

For the AI evaluation, the images are transmitted to the service OpenAI and processed there. Short-term processing or storage by OpenAI may take place in accordance with the privacy policy applicable there. Northfolio cannot determine the storage period at OpenAI and therefore makes no statement that the images are deleted immediately or completely.

CSV files are processed exclusively to provide the requested function (e.g. import of your portfolio data). Storage or use beyond this does not take place unless required by law.

Northfolio does not take any solely automated decisions within the meaning of Art. 22 GDPR that produce legal effects concerning you or significantly affect you. The AI-supported analysis serves exclusively for data extraction (e.g. recognition of values from screenshots) and does not constitute an automated decision about you.

We store your data for as long as you use Northfolio. If you delete your account, the associated data will be removed promptly, unless legal retention obligations conflict with this. Uploaded screenshots are not stored by Northfolio (see section 6); after completion of the processing, the images are no longer available at Northfolio. Technical error logs will be deleted after a limited period as soon as they are no longer needed for stability and security improvement. Voluntary cancellation feedback will be stored after account deletion for product improvement and deleted after a limited period.

You can download your data at any time via the app's export function (e.g. as a PDF, Excel, CSV or JSON file). You can delete your account at any time in the app; the associated data will be removed promptly, unless legal retention obligations conflict with this. Before deletion, you have the option to leave voluntary cancellation feedback.

Northfolio does not use advertising cookies, no third-party tracking (such as Google Analytics, Google Tag Manager, Meta Pixel, Microsoft Clarity or Hotjar) and no marketing cookies.

The app stores only a technically necessary access token in the local storage of your browser (localStorage) so that you stay logged in during a session. This storage is technically necessary to enable the authentication and use of the app that you have explicitly requested (Art. 6 (1) lit. f GDPR / § 25 (2) no. 2 TTDSG).

In addition, Northfolio collects its own, anonymous usage statistics (e.g. page views, device type, origin) to improve the app. These are not attributable to individuals and do not use third-party tracking services.

Since only technically necessary local storage and anonymous, first-party statistics are used and no consent-requiring tracking or advertising technologies are employed, a consent banner (cookie consent) is not required.

For the operation of Northfolio, the following external services are used as processors (Art. 28 GDPR) or as independent controllers. Only services that are actually integrated into the implementation are listed.

• Base44 / Wix – Hosting, authentication, database, backend runtime, email delivery and LLM gateway.
• OpenAI – AI-supported OCR analysis of uploaded portfolio screenshots.
• Google – Sign in with Google (“Sign in with Google”).
• Apple – Sign in with Apple (“Sign in with Apple”).

The following overview shows the services used, their purpose, the data processed, the transfer and the link to the respective privacy policy.

Where data is transferred to third countries outside the EU/EEA, this is done on the basis of suitable safeguards, in particular Standard Contractual Clauses of the European Commission (Art. 46 GDPR).

Stock and crypto prices are queried server-side via public market data interfaces (Yahoo Finance for indices and exchange rates, Kraken for cryptocurrencies). No personal user data is transmitted. Prices may be delayed, incomplete or incorrect. Another price provider (Twelve Data) is technically prepared but not active in current operation.

Within the scope of technical and organizational possibilities, the following measures are taken, among others:

• Encrypted data transmission via HTTPS/TLS.
• Access control via the Base44 (Wix) platform with role-based access control; users can access only their own data.
• Secure authentication (email/password, optional biometric lock on the device) and protection against abusive login attempts.
• No connection to banks or brokers; no collection of bank logins, passwords or TANs.
• Error and usage logging to ensure stability and security.
• Regular updating and further development of the application by the operator.

You have the following rights:

• Access to your stored data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR) – you can also download your data via the app's export function
• Objection to processing (Art. 21 GDPR)
• Withdrawal of given consent (Art. 7 (3) GDPR)

Northfolio is not directed at persons under 16 years of age. Use by minors requires the consent of the legal representative.

Please direct questions about data protection to:
Sascha Klement · support@north-folio.de