Privacy Policy

This Privacy Policy explains what personal data PROVISUM ("we") processes, why, and your rights. We are the data controller for account data. We follow a data-minimisation principle: we collect only what is needed to run the Service.

1. Data we collect

Account data you provide: email address, a securely hashed (bcrypt) password, optional name, and your subscription status. Usage/technical data generated by use: session records, IP address and timestamps for security and rate-limiting, and basic request logs. Payment data: handled by Stripe (see below) — we store only a Stripe customer/subscription identifier and status, never card numbers.

2. How we use it & legal bases

We use your data to provide and secure the Service and your account (performance of our contract with you), to prevent abuse and fraud and keep the Service reliable (our legitimate interests), to process subscriptions and comply with tax/accounting obligations (legal obligation), and to send you essential transactional email such as password resets (contract/legitimate interest). We do not send marketing email without your consent.

3. Sharing & processors

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract: Stripe (payments), Google Analytics (aggregate usage analytics), our transactional email provider (password-reset delivery), our database host (MongoDB Atlas), and our server host. We may disclose data if required by law. We do not connect to, or store credentials for, any exchange or brokerage, and we never see your funds.

4. Cookies & analytics

We use one essential, httpOnly session cookie to keep you logged in. We also use Google Analytics 4 to understand aggregate traffic and improve the product; it sets its own cookies and may process usage data (with IP anonymisation enabled). We do not use advertising cookies or sell data. You can opt out of Google Analytics with Google's opt-out add-on or your browser's tracking controls.

5. Retention

We keep account data for as long as your account is active and as needed to comply with legal, tax and accounting obligations. Sessions and password-reset tokens expire automatically (reset tokens within one hour). When you delete your account, we delete or anonymise associated personal data except where retention is legally required.

6. Your rights

Depending on your location (e.g. under the EU/UK GDPR or the CCPA), you have rights to access, correct, delete, port, restrict or object to processing of your personal data, and to withdraw consent. You can change your password and cancel billing yourself; for other requests, contact us and we will respond within the legally required time. You may also complain to your local data-protection authority.

7. International transfers & children

Your data may be processed in countries other than yours; where required we rely on appropriate safeguards. The Service is not directed to anyone under 18, and we do not knowingly collect data from minors.

8. Changes & contact

We may update this policy; the effective date below reflects the latest version. For any privacy request, use the contact route on the site.

Questions? See the FAQ or the Disclaimer.