Privacy Policy

Effective February 4, 2026 · Updated July 20, 2026. How Irish Investor collects, stores, and protects your data.

Introduction

Data controller. Irish Investor (the “Service”) is operated from Ireland by a natural person acting in a non-commercial capacity while Free Mode remains active. For privacy-related matters, contact the operator at support@irish-investor.com. The operator's full legal identity is disclosed on written request to that email address; see the Legal Notice for the matching service-provider disclosure.

Information We Collect

We collect only what is necessary to provide the service:

Identity — email address, authentication credentials (password hashed or Google OAuth ID), optional person records (name and colour label)
Financial profile — annual income by year, marital status, spouse income, per-person other unearned income and PRSI profile, plus legacy unallocated other-income values retained for migration review
Investment data — transactions, holdings, broker reports (temporarily stored in compressed form for processing and restart retry, then cleared when no longer needed), household-wide fund-tax treatment choices and optional evidence notes, supported deemed-disposal events for reviewed holdings, tax calculations, encrypted server-side backups (up to 5 per user, retained 90 days), and opt-in debug file copies (retained up to 30 days)
Integration credentials — broker API keys and secrets (encrypted with Fernet AES-128) only if you enable API sync
Operational records — Stripe customer identifier, payment and refund history, feedback submissions and attachments, and broker sync attempt records containing person and broker linkage, status and timestamps, rollback cursor snapshots, committed-import references, and error context for restart recovery and safe cancellation
Security telemetry — rate-limit events keyed by email or IP (24-hour cleanup), revoked-JWT identifiers, password-reset token IDs (purged at natural expiry), anonymous-on-delete API usage log for price, FX, and broker API calls
Technical metadata — JWT token, theme preference, app preferences, and active upload recovery metadata in localStorage (including broker filters, crypto-trader broker selections, broker label, file name, and job metadata while recoverable), IP address (redacted /24 or /48 in logs), browser and device info

Legal Basis for Processing

Contract (Art. 6(1)(b)) — account creation, service provision, payment processing
Legal obligation (Art. 6(1)(c)) — 6-year retention of tax-report-supporting records per Irish TCA 1997 s.886
Legitimate interest (Art. 6(1)(f)) — security, fraud prevention, rate-limit telemetry
Consent (Art. 6(1)(a)) — Google Analytics 4 and Vercel Speed Insights (disabled until you accept the cookie banner)

Data Storage & Security

Irish Investor's primary Railway PostgreSQL database and encrypted service snapshots are hosted within the European Union. Other service data may be processed outside the EU by the providers disclosed below, including website delivery metadata, support and transactional email, optional Google authentication, Stripe payment operations, opt-in broker sync, provider support or fallback access, and consented analytics. Broker API credentials and server-side backup snapshots are encrypted at rest using Fernet (AES-128). All traffic is encrypted via TLS/SSL. Passwords are hashed using PBKDF2-SHA256 with per-user salt (never reversible). Strict multi-tenancy isolation controls user access.

Breach notification. In the event of a personal-data breach, we will notify the Irish Data Protection Commission without undue delay and, where feasible, not later than 72 hours after becoming aware, unless the breach is unlikely to result in a risk to your rights and freedoms, as required by GDPR Article 33. When a breach is likely to result in a high risk, we will notify affected users without undue delay unless an Article 34 exception applies.

Third-Party Services

Stripe — historical payment records and future checkout readiness if paid access is reintroduced (EU via Stripe Technology Europe Ltd.; SCCs cover US pipeline steps)
Google — optional OAuth sign-in and Google Analytics 4 with Consent Mode v2 (US; SCCs)
Vercel Speed Insights — consent-gated real-user performance measurements (EU plus global edge; SCCs)
Resend — transactional email delivery (US; SCCs)
ImprovMX — support email forwarding for messages sent to support@irish-investor.com (EU/US infrastructure; SCCs where applicable)
CoinGecko / CryptoCompare / yfinance / Stooq / European Central Bank / Frankfurter — price and FX data (asset tickers only, no user PII)
Binance, Bybit, Kraken — only when you explicitly enable broker API sync in Import → API Connections; CSV imports involve no broker communication
Railway — backend hosting and PostgreSQL (primary EU region; SCCs for US fallback)
Vercel — frontend hosting and edge CDN (no user data stored on edge beyond HTTP access logs; SCCs)

The Sub-processors page separately publishes Irish Investor's personal-data processing provider inventory. Non-PII price and FX sources and user-enabled broker integrations remain disclosed above because they have different data boundaries.

Cookies & Tracking

The cookie banner offers two categories: Essential cookies (always on — authentication, session, your saved preferences) and Analytics (toggleable, default off). We use Google Consent Mode v2: analytics_storage defaults to denied at page load. Google Tag Manager, GA4, and Vercel Speed Insights do not load until you opt in. No advertising cookies, retargeting, or profiling. Your choice is stored as versioned JSON in your browser's localStorage and may re-prompt on material policy changes; change it at any time via “Manage Cookies” in the page footer.

Data Retention

Active accounts — retained while your account is active
Deleted accounts — personal and financial data permanently deleted within 30 days
Encrypted backups — retained 90 days for disaster recovery, then purged
Temporary upload processing storage — broker report bytes are retained only while needed for parsing, restart retry, cancellation handling, or failed-upload cleanup, and are cleared from terminal jobs. Terminal job metadata (including filename, broker, status, and timestamps) becomes eligible for daily deletion once it is older than seven days plus a one-hour safety buffer. Completed current-month metadata is retained until the monthly upload quota resets, then follows the same daily deletion window
Debug files — automatically deleted after 30 days
Operational logs — API call timing, daily quota counters, export events, and terminal broker-sync attempt records retained for 365 days for service operation, abuse prevention, restart recovery, and troubleshooting
Support feedback — attachment bytes retained for 90 days from submission regardless of support status, then removed while feedback text, status, filename, and size metadata remain; resolved or closed feedback metadata retained for 730 days from its last update, then deleted with any legacy attachment file
Legal obligations — investment transactions, income events, deemed-disposal records, and related account records that support tax calculations, audit trails, and user exports may be retained for 6 years per Irish Revenue (Taxes Consolidation Act 1997, section 886), together with payment records and purchase and refund history.

Your Rights Under GDPR

As an EU resident, you have the right to: access your data (Art. 15), rectify inaccuracies (Art. 16), erase your data (Art. 17), port your data in machine-readable JSON format, with currently retained feedback attachment bytes available as a separate ZIP archive, via Settings → Account → Your Data (Art. 20), object to processing (Art. 21), restrict processing (Art. 18), withdraw consent (Art. 7(3)), and lodge a complaint with the Irish Data Protection Commission at www.dataprotection.ie (Art. 77). Account deletion is available in Settings → Account, or by emailing support@irish-investor.com if you cannot access your account. Verified deletion requests complete within 30 days, subject to records we are legally required to retain.

How to Exercise Your Rights

Email support@irish-investor.com describing the right you wish to exercise. We verify your identity via your registered email and respond within 1 month (extendable by 2 months for complex requests per Art. 12(3)). Self-service shortcuts: download data via Settings → Account → Your Data; rectify tax profile via Settings → Profile & Tax; withdraw analytics consent via the cookie banner. Withdrawing analytics consent immediately updates Google Consent Mode, unmounts Vercel Speed Insights, and stops Web Vitals events from being sent from the page; reloading after Reject All starts without analytics scripts.

Data Sharing

We never sell, rent, or trade your data. Data is shared only with the service providers listed above as necessary for their function, or when required by law.

International Transfers

Irish Investor's primary Railway PostgreSQL database and encrypted service snapshots are hosted within the European Union. Providers listed above may process other service data outside the EU, including website delivery metadata, support and transactional email, optional Google authentication, Stripe payment operations, opt-in broker sync, provider support or fallback access, and consented analytics. Where a listed provider relies on Standard Contractual Clauses under GDPR Article 46, that safeguard is identified above.

Children's Privacy

The Service is not intended for individuals under 18 years of age (service-terms floor; note Irish Article 8 GDPR digital-age-of-consent is 16). We do not knowingly collect personal information from persons under 18. Contact us immediately if you believe we have inadvertently collected data from a minor.

Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted here with an updated effective date. Material changes affecting your rights or introducing new data collection will be communicated via email at least 30 days before they take effect.

Contact Us

For questions about this Privacy Policy, to exercise your GDPR rights, or to report a data protection concern: support@irish-investor.com — we respond within 1 month.

This application requires JavaScript to run. Please enable JavaScript in your browser.

Contact: support@irish-investor.com