Privacy Notice

Service operator

Legal name

MB "Rei exitus"

Registration number

304960641

Address

Vasario 16-osios g. 41, LT-76350 Siauliai

Country

Lithuania

Customer support

hello@buffered.app

1. Controller and contact

MB "Rei exitus" is the controller for account, product, support, and portfolio data processed to provide Portfolio Risk Platform. Privacy requests can be sent to hello@buffered.app.

2. Data we process

• Account data: email address, authentication tokens in hashed form, session and security records.
• Portfolio data: holdings, cash, options, transactions, imports, settings, limits, notes, and calculated risk outputs.
• Broker connection data: account reference and encrypted read-only IBKR Flex credentials.
• Billing data: Stripe customer/subscription identifiers, plan, status, invoices, and entitlement state. Full card details are handled by Stripe, not stored by this service.
• Technical data: IP address used for rate limiting, request/security logs, route-level error references, and aggregate browser performance measurements supplied to hosting infrastructure.
• Support data: messages and information you provide when requesting help or exercising a legal right.

3. Sources

Data comes from you, your configured read-only broker report, Stripe billing events, authentication and hosting systems, and market-data providers used to refresh instrument context. The service does not obtain authority to place broker orders.

4. Purposes and legal bases

• Contract: create your account, provide subscribed features, process imports, support billing, and respond to service requests.
• Legitimate interests: secure the service, prevent abuse, diagnose failures, and improve reliability without overriding your rights.
• Legal obligation: retain records required for accounting, tax, fraud prevention, disputes, or regulatory requests.
• Consent: only where a specific optional processing activity expressly asks for consent. Consent can be withdrawn prospectively.

5. Recipients and processors

Data is shared only as needed with configured service providers, including hosting, PostgreSQL/database, passwordless email, Stripe billing, market-data, and support infrastructure. If AI explanation review is enabled, only structured calculated context required for that review is sent to the configured AI provider; AI cannot unblock deterministic risk rules. Providers may process data under their own legal obligations.

6. International transfers

Some providers may process data outside the European Economic Area. Where required, transfers use an adequacy decision, standard contractual clauses, or another lawful transfer mechanism. Contact the privacy address for information about safeguards applicable to the configured production providers.

7. Retention

Portfolio and account data is retained while the account is active and then deleted or anonymized when no longer needed, subject to backups and legal retention duties. Login links expire after their stated period; revoked and expired session/security records are retained only as needed for security. Billing and transaction records may be kept for statutory accounting, tax, dispute, and fraud-prevention periods.

8. Your rights

Depending on applicable law, you may request access, correction, deletion, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Requests are handled after reasonable identity verification and normally answered within the legally required period. Signed-in users can export personal data or submit a deletion request from the Account and Data page. You may also complain to your local data protection authority.

9. Automated analysis

The service calculates deterministic portfolio-risk statuses and may provide optional AI explanations. These analytics do not make legal or similarly significant decisions about you, do not execute trades, and do not determine access to credit, insurance, employment, or public services.

10. Cookies and local storage

The current product uses an essential session cookie for secure sign-in and does not require advertising or behavioral-tracking cookies. Operational error and performance diagnostics do not create an advertising profile and do not store a separate tracking identifier in the browser. Non-essential analytics or marketing storage must not be enabled without updating this notice and implementing any consent controls required by law.

11. Security and changes

Security measures include hashed authentication secrets, encrypted broker credentials, account-scoped data, access controls, and signed billing webhooks. No system is risk-free. Material notice changes will be published here with an updated date and communicated when required.