1. Introduction
Netfolio ("we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our wealth management platform at netfolio.no.
We comply with the General Data Protection Regulation (GDPR), the Norwegian Personal Data Act (Personopplysningsloven), and the ePrivacy Directive.
2. Data Controller
Legal entity:
Netfolio is operated by Operta AS
Organization number: 932326485
Kalbakkveien 13A
0953 Oslo, Norway
Contact:
Email: hello@operta.io
Response time: Within one month
3. What Data We Collect
3.1 Account Data
- Full name
- Email address
- Password (hashed using bcrypt — never stored in plain text)
- Base currency preference
- Age and retirement age (for pension projections)
- Date of birth (used solely to verify you are 18 or older)
3.2 Financial Data (provided by you)
- Investment portfolio: holdings, transactions, orders, dividends
- Bank and brokerage account balances
- Property details: purchase price, current value, mortgage information, rental income
- Vehicle details: make, model, purchase price, depreciation
- Pension accounts: type, provider, contributions, projected values
- Private equity investments: company, shares, valuations
- Cash accounts and balances
- Legal entity ownership structures
3.3 Billing Data (if you subscribe to Pro)
- Subscription status and plan type
- Billing history (managed by Stripe — we do not store card details)
- Stripe customer ID
3.4 Usage Data (collected automatically)
- Pages visited and features used (anonymized)
- Error logs (anonymized via Sentry)
- Performance metrics (via Vercel Analytics — cookieless)
3.5 Communication Data
- Email notifications sent to you
- Support communications
4. Legal Basis for Processing
| Purpose | Legal Basis | Data Used |
|---|---|---|
| Providing the service | Contract (Art. 6(1)(b)) | All account and financial data |
| Processing payments | Contract (Art. 6(1)(b)) | Billing data |
| Security and fraud prevention | Legitimate interest (Art. 6(1)(f)) | Usage data, error logs |
| Email notifications (opted in) | Contract (Art. 6(1)(b)) | Email, preferences |
| Product improvement | Legitimate interest (Art. 6(1)(f)) | Anonymized usage data |
| Legal compliance | Legal obligation (Art. 6(1)(c)) | Billing records, account data |
We never process your financial data for advertising, profiling for third parties, or sale to third parties.
5. How We Use Your Data
We use your data exclusively to:
- Display your net worth, portfolio, and financial overview
- Calculate performance metrics, returns, and projections
- Process your subscription payments via Stripe
- Send notifications you have opted into
- Improve the platform based on anonymized usage patterns
- Respond to support requests
- Comply with legal and accounting obligations
Automated decision-making: Netfolio uses AI tools (our assistant "Lens") to provide financial insights and analysis. These are informational only. We do not make any automated decisions with legal or significant personal effect. You are always in control of your financial decisions.
6. Who We Share Your Data With
We share data only with the following processors under Data Processing Agreements (DPAs):
| Provider | Purpose | Data shared | Location | Transfer mechanism |
|---|---|---|---|---|
| Neon | Database hosting | All financial data | EU (Frankfurt) | EU-based — no transfer |
| Vercel | Application hosting | Request logs, edge processing | EU (Frankfurt) | EU-based — no transfer |
| Stripe | Payment processing | Email, billing info | US | Standard Contractual Clauses |
| Resend | Email delivery | Email address, content | EU | EU-based — no transfer |
| Sentry | Error tracking | Anonymized error logs | EU | EU-based — no transfer |
| PostHog | Product analytics | Anonymized usage events | EU | EU-based — no transfer |
| Groq | AI assistant | Query context only, no bulk data | US | Standard Contractual Clauses |
We never sell your data. We never share your financial data with advertisers, brokers, or financial institutions without your explicit consent.
When using the AI assistant (Lens), only the minimum data needed to answer your specific question is sent. No bulk financial data is transmitted.
7. International Data Transfers
Your data is primarily stored in EU data centers. Where processing occurs outside the EU (Stripe, Groq), we rely on Standard Contractual Clauses (SCCs) as approved by the European Commission under GDPR Art. 46(2)(c).
You may request a copy of the relevant SCCs by contacting hello@operta.io.
8. Data Retention
| Data type | Retention period |
|---|---|
| Account and financial data | Until you delete your account |
| Usage and analytics data | 24 months (anonymized) |
| Error logs | 90 days |
| Email logs | 12 months |
| Billing records | 7 years (Norwegian Bookkeeping Act / Bokføringsloven § 13) |
| Backup data | 30 days after account deletion |
When you delete your account, all personal and financial data is permanently deleted within 30 days. Billing records are retained for 7 years as required by Norwegian law — these contain only transaction amounts and dates, not your financial portfolio data.
9. Your Rights Under GDPR
You have the following rights:
- Right of access (Art. 15):
Request a copy of all personal data we hold about you. Use Settings → Export All Data, or contact us. - Right to rectification (Art. 16):
Correct inaccurate data directly in the app or by contacting us. - Right to erasure (Art. 17):
Delete your account and all associated data via Settings → Delete Account. Note: billing records are retained as required by law (section 8). - Right to data portability (Art. 20):
Export your data in JSON format via Settings → Export All Data. - Right to restriction (Art. 18):
Request we pause processing of your data while a dispute is resolved. - Right to object (Art. 21):
Object to processing based on legitimate interests. We will stop unless we have compelling legitimate grounds. - Right not to be subject to automated decisions (Art. 22):
We do not make automated decisions with legal effect — this right is not applicable, but you may contact us with any concerns. - Right to withdraw consent:
Where processing is based on consent, you may withdraw at any time without affecting prior processing.
To exercise any right, contact hello@operta.io. We will respond within one month. In complex cases we may extend by a further two months — we will inform you if this applies.
10. Right to Complain
If you are unsatisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority — without first contacting us.
Norwegian supervisory authority:
Datatilsynet (Norwegian Data Protection Authority)
Postboks 458 Sentrum, 0105 Oslo
datatilsynet.no
Tel: +47 22 39 69 00
If you are located in another EU/EEA country, you may contact your local supervisory authority.
11. Data Security
We implement the following technical and organisational measures:
- All data encrypted in transit using TLS 1.3
- Passwords hashed using bcrypt (cost factor 12)
- Database encrypted at rest (Neon PostgreSQL)
- Authentication via NextAuth with secure session management
- Access to user data is restricted, logged, and limited to what is necessary for support with user consent or legal obligation
- Regular security monitoring via Sentry
- No payment card details stored — handled entirely by Stripe PCI-DSS Level 1
12. Cookies and Tracking
We use minimal, privacy-respecting tracking:
| Tool | Purpose | Cookie used | Consent required |
|---|---|---|---|
| Session cookie | Authentication | Yes — essential | No (essential) |
| Vercel Analytics | Anonymous page view counts | No (cookieless) | No |
| PostHog | Anonymous feature usage | No (cookieless mode) | No |
We do not use advertising cookies. We do not share tracking data with advertisers. PostHog and Vercel Analytics are configured in cookieless mode — no cookies are set and no personal data is collected through these tools.
13. Children's Privacy
Netfolio is intended for users aged 18 and over. We do not knowingly collect data from minors. During registration, users must confirm they are 18 or older. If you believe a minor has created an account, contact hello@operta.io and we will delete the account within 72 hours.
14. Automated Decision-Making
Netfolio does not make automated decisions that produce legal effects or significantly affect you. Our AI assistant (Lens) provides informational analysis only. All financial decisions remain entirely yours.
15. Changes to This Policy
We will notify you by email and in-app notification of any material changes to this Privacy Policy at least 30 days before they take effect. The updated policy will always be available at netfolio.no/privacy. Continued use of Netfolio after the effective date constitutes acceptance of the updated policy.
For significant changes affecting your rights, we will request renewed acknowledgement where appropriate.
16. Contact
For privacy-related questions or to exercise your rights:
- Email: hello@operta.io
- Response time: Within one month
Data Controller:
Operta AS
Organization number: 932326485
Kalbakkveien 13A
0953 Oslo, Norway
Supervisory Authority:
Datatilsynet — datatilsynet.no