Privacy Policy

01Introduction

This Privacy Policy ("Policy") describes how WealthView Ltd ("WealthView," "we," "us," or "our"), a company registered and operating under applicable law, collects, uses, stores, discloses, and protects personal data when you use the WealthView platform, accessible at wealthview.ltd(the "Service").

WealthView Ltd acts as the Data Controllerwithin the meaning of Article 4(7) of the General Data Protection Regulation (EU) 2016/679 ("GDPR") for all personal data processed through the Service.

This Policy applies to all users of the Service, regardless of geographic location. We have designed this Policy to comply with the GDPR, the California Consumer Privacy Act (CCPA) as amended by the CPRA, the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL"), and other applicable data protection legislation.

By creating an account or using the Service, you acknowledge that you have read and understood this Policy. If you do not agree with any part of this Policy, you must immediately discontinue use of the Service and request deletion of your account and associated data.

02Data We Collect

We collect and process the following categories of personal data. Each category is listed alongside the specific data points collected, the purpose for collection, and the lawful basis under Article 6 GDPR.

2.1 Account Information

2.2 Financial Data

2.3 Transaction Data

2.4 Usage Data

2.5 Device and Connection Information

2.6 Market Data (Third-Party Derived)

03How We Collect Data

3.1 Directly From You

The majority of data we process is provided directly by you when you:

• Create an account (email, password, display name, preferences)
• Add financial records (holdings, bank accounts, debts, budgets, goals, subscriptions, properties)
• Record transactions (trades, income events, manual entries)
• Configure settings (currency, language, notification preferences, 2FA enrollment)
• Contact us via email for support or feedback

3.2 Automatically

When you access the Service, we automatically collect certain technical data through server logs and essential cookies. This includes your IP address, browser type, operating system, referring URL, pages visited, timestamps, and error logs. We do not use advertising or marketing analytics platforms such as Google Analytics. We do use Sentry for error monitoring, which receives error reports and, when an error occurs, a replay of the page you were on.

3.3 From Third-Party APIs

When you add a stock ticker or cryptocurrency to your portfolio, we fetch publicly available market data from Yahoo Finance, Finnhub and CoinGecko. These requests are made by our servers, running on Vercel (Frankfurt) and Cloudflare's edge network, and contain only the ticker symbol or asset identifier — no name, email or holdings. This applies to price data only; the insights feature sends a summary of your portfolio to Cloudflare Workers AI, and property valuation features send address details to their provider.

04Lawful Basis for Processing

Under Article 6 of the GDPR, we process personal data only where we have a valid lawful basis. The following table maps each processing activity to its corresponding lawful basis:

Where we rely on legitimate interest(Art. 6(1)(f)), we have conducted a Legitimate Interest Assessment ("LIA") and concluded that our interests do not override your fundamental rights and freedoms. You may request a copy of any LIA by contacting wintertonvincent@gmail.com.

Where we rely on consent (Art. 6(1)(a)), you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Consent withdrawal can be requested by emailing wintertonvincent@gmail.com. In-app consent controls are not built yet.

05Why We Collect Data

We collect and process personal data strictly for the following specific, explicit, and legitimate purposes:

06How We Store Data

6.1 Database

We use Supabase Cloud (Supabase Inc.) for our PostgreSQL database and authentication. Your data is stored on Supabase-managed infrastructure, and Supabase is therefore a processor with access to it, acting under its own data processing agreement. Access from the application is scoped by PostgreSQL row-level security, so each account can only read its own rows.

6.2 Encryption at Rest

Exchange API keys and bank connection tokens are encrypted using AES-256-GCM(256-bit Advanced Encryption Standard in Galois/Counter Mode) before being written to the database. The encryption key is held in our hosting platforms' secret stores, separately from the database itself. Other data is not separately encrypted at the field level; it is protected by row-level security and by the encryption our database provider applies to its own storage.

6.3 Encryption in Transit

All data transmitted between your browser and our servers is encrypted using TLS 1.3 with forward secrecy. We enforce HSTS (HTTP Strict Transport Security) with a minimum max-age of one year and include the preload directive.

6.4 Backups

Our database provider takes automated daily backups of the production database and retains them for the period included in our plan (currently 7 days). These backups are created, encrypted and deleted by the provider under its own key management; we do not maintain separate backups of our own. Backups from before that window are no longer available, which also means data deleted from the live database disappears from backups as they expire.

07Data Sharing

We share limited data with the following categories of recipients, strictly as necessary to operate the Service:

For the price providers — Yahoo Finance, Finnhub and CoinGecko — no personal data is transmitted. Those requests contain only a ticker symbol or coin identifier (e.g. "AAPL" or "bitcoin") and are made by our servers, so the providers cannot identify which user requested which data point. This does not apply to the other recipients above: Supabase, Vercel, Cloudflare, Sentry, Resend, Plaid and the exchanges each receive data that relates to you.

7.1 Law Enforcement Disclosure

We may disclose personal data to law enforcement or regulatory authorities if required to do so by law (Art. 6(1)(c) GDPR) or in response to valid legal process (e.g., a court order, subpoena, or binding regulatory request). In such cases, we will: (a) verify the legal validity of the request; (b) limit the scope of data disclosed to the minimum necessary; (c) notify the affected user, unless legally prohibited from doing so; and (d) document the disclosure internally.

08Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this Policy, or as required by applicable law. The following table sets out our specific retention periods:

8.1 Account Deletion

You can delete your account yourself from Settings, or email wintertonvincent@gmail.com and we will do it for you. Deleting your account removes your user record, and every table holding your data is removed with it: accounts, holdings, transactions, budgets, goals, household membership, your quick-log PIN, and any encrypted exchange credentials. What we cannot do is revoke an API key you created at an exchange — deleting our copy does not disable the key, so please also remove it in your Binance or Coinbase account. The process is:

1. Your account is immediately deactivated and you are logged out of all sessions.
2. A 30-day grace period begins. During this period, you may contact us to reverse the deletion.
3. After 30 days, all personal data associated with your account is permanently deleted from the production database. This includes all financial data, transaction records, preferences, and usage data.
4. Within the next 30-day backup rotation cycle, all references to your data are purged from encrypted backups via cryptographic erasure.
5. Anonymised, aggregated statistical data that cannot be linked back to you may be retained indefinitely.

09Your Rights Under GDPR

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have the following rights under the GDPR and equivalent legislation. These rights are not absolute and may be subject to legal exemptions.

10Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with the following rights regarding your personal information:

To exercise any CCPA right, email wintertonvincent@gmail.com with the subject line "CCPA Request" or use the in-app data export tool. We will verify your identity before processing the request by confirming your email address and, if necessary, requesting additional verification.

11Your Rights Under UAE PDPL

If you are located in the United Arab Emirates, Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data ("UAE PDPL") and its implementing regulations grant you the following rights:

To exercise any right under the UAE PDPL, contact wintertonvincent@gmail.com. We will respond within the timeframes prescribed by the UAE Data Office. If you are dissatisfied with our response, you have the right to lodge a complaint with the UAE Data Office.

12International Data Transfers

12.1 EU-to-UAE Transfers

Where WealthView Ltd or its operators access personal data from the United Arab Emirates for administrative purposes (e.g., customer support, system maintenance), such access constitutes an international data transfer under Chapter V of the GDPR (Articles 44-49). The UAE has not received an adequacy decision from the European Commission as of the date of this Policy.

To ensure lawful transfer, we rely on the following safeguards:

• Standard Contractual Clauses (SCCs): We implement the European Commission's Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) for any transfer of personal data to the UAE, as required by Article 46(2)(c) GDPR.
• Transfer Impact Assessment (TIA): We have conducted a Transfer Impact Assessment evaluating the legal framework of the UAE, including the UAE PDPL, to determine whether the laws of the UAE provide an essentially equivalent level of data protection. A copy of the TIA is available upon request.
• Supplementary Measures: All remote access from the UAE is conducted via encrypted VPN tunnels with multi-factor authentication. Access is restricted to the minimum necessary data, and all administrative actions are logged and audited.

12.2 Transfers to Market Data Providers

API requests to Yahoo Finance and Finnhub (United States) and CoinGecko (Singapore) contain only non-personal ticker identifiers, so those interactions do not constitute international data transfers. Transfers that do involve your personal data — to Supabase (Singapore), and to Vercel, Cloudflare, Sentry, Resend and Plaid (United States) — are covered by each provider's standard contractual clauses.

12.3 Cloudflare

Cloudflare may process IP addresses and request metadata at global edge nodes. Cloudflare is certified under the EU-US Data Privacy Framework and we have entered into a Data Processing Agreement (DPA) with Cloudflare that includes the Standard Contractual Clauses. We have configured Cloudflare to route EU traffic through EU data centres where possible.

13Cookies and Tracking

WealthView uses a minimal number of cookies, strictly limited to those necessary for the operation and security of the Service. We do not use third-party advertising or tracking cookies.

13.1 Strictly Necessary Cookies

These cookies are essential for the functioning of the Service and cannot be disabled. They do not require consent under Article 5(3) of the ePrivacy Directive (2002/58/EC) as they are strictly necessary for the provision of the Service explicitly requested by the user.

13.2 Analytics Cookies

We do not currently use any analytics cookies. If we introduce analytics cookies in the future, they will be opt-in only and will require your explicit consent before being set. We will update this Policy and display a cookie consent banner accordingly.

13.3 Managing Cookies

You can manage cookies through your browser settings. Please note that disabling strictly necessary cookies will prevent you from using the Service, as they are required for authentication and security. Instructions for managing cookies can be found in your browser's help documentation.

13.4 Do Not Track

WealthView honours "Do Not Track" (DNT) browser signals. As we do not engage in cross-site tracking, no behavioural changes are necessary in response to DNT signals, but we recognise and respect them as an expression of user preference.

14Security Measures

We implement comprehensive technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction, in accordance with Article 32 of the GDPR.

14.1 Encryption

• Data at rest: exchange API keys and bank connection tokens are encrypted with AES-256-GCM before storage. Other data is protected by row-level security and by the storage encryption our database provider applies.
• Data in transit: TLS for all communication between your browser and the Service. HSTS is enforced with the preload directive.
• Backups: taken, encrypted and expired by our database provider under its own key management.

14.2 Authentication and Access Control

• Passwords: handled entirely by our authentication provider (Supabase Auth), which stores them only as salted hashes. We never receive, store or log a plaintext password.
• Leaked-password protection: passwords found in known public breach corpora are rejected at sign-up and password change.
• Row-Level Security (RLS): PostgreSQL row-level security policies ensure each authenticated user can only read and write their own rows. This is enforced by the database itself, so it holds even if an application-level check is missed.
• Read-only exchange access: API keys that can trade or withdraw are rejected when you connect them, and keys whose permissions cannot be verified are not stored at all.
• Sessions: short-lived access tokens issued by our authentication provider, refreshed automatically and revocable by signing out.
• Administrative access: limited to the founders, through the hosting, database and CDN providers' own dashboards, each protected by multi-factor authentication.

14.3 Network Security

• DDoS protection and CDN: traffic is served through Cloudflare, which provides network-level mitigation.
• Security headers: HSTS, a Content Security Policy restricting framing, and MIME-sniffing protection are set on all responses.
• Rate limiting: authenticated API endpoints are rate limited per account. Sign-in attempts are rate limited by our authentication provider.
• Managed infrastructure: we run no servers of our own, so there is no operating system, firewall or SSH access under our administration to compromise.

14.4 Monitoring

• Application errors are reported to Sentry and reviewed by the team.
• Automated tests and dependency vulnerability scanning run on every change before it is deployed.

15Data Breach Notification

In the event of a personal data breach as defined by Article 4(12) of the GDPR (a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data), we will take the following actions:

15.1 Supervisory Authority Notification (Art. 33 GDPR)

Where a breach is likely to result in a risk to the rights and freedoms of natural persons, we will notify the competent supervisory authority — the UAE Data Office, where WealthView is established, and any EU or UK authority with jurisdiction over affected users — without undue delay and no later than 72 hours after becoming aware of the breach. The notification will include: (a) the nature of the breach including approximate number of affected data subjects and records; (b) the name and contact details of our DPO or point of contact; (c) the likely consequences of the breach; and (d) the measures taken or proposed to address and mitigate the breach.

15.2 User Notification (Art. 34 GDPR)

Where a breach is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay via: (a) email to your registered email address; and (b) an in-app notification banner visible upon login. The notification will describe the nature of the breach, the likely consequences, and the measures taken to address and mitigate it, along with recommendations for protective steps you can take (e.g., changing your password, enabling 2FA).

15.3 UAE PDPL Notification (Art. 9, UAE PDPL)

Where the breach affects data subjects located in the UAE, we will additionally notify the UAE Data Office immediately upon becoming aware of the breach, as required by the UAE PDPL and its implementing regulations.

15.4 US State Law Compliance

For users located in the United States, we will comply with applicable state breach notification laws, including but not limited to the California Data Breach Notification Law (Cal. Civ. Code § 1798.82), which requires notification "in the most expedient time possible and without unreasonable delay."

15.5 Breach Documentation

In accordance with Article 33(5) GDPR, we maintain a comprehensive internal register of all personal data breaches, regardless of whether they trigger a notification obligation. This register documents the facts of each breach, its effects, and the remedial actions taken. The register is maintained for a minimum of 5 years and is available for inspection by the competent supervisory authority upon request.

16Children and Minors

WealthView does not knowingly collect, solicit, or process personal data from children under the age of 18. By creating an account, you represent and warrant that you are at least 18 years of age.

COPPA Compliance:In compliance with the Children's Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501-6506), we do not knowingly collect personal information from children under the age of 13 in the United States.

UK Age Appropriate Design Code: As a financial services application intended exclusively for adults, we do not design features to appeal to children and do not implement age-appropriate design features. The nature of the Service (investment tracking, debt management, portfolio analysis) is inherently directed at adults.

If we discover that we have inadvertently collected personal data from a minor under 18, we will:

1. Immediately suspend the account.
2. Delete all personal data associated with the account within 48 hours of discovery.
3. Purge the data from all backup systems within the next backup rotation cycle (maximum 30 days).
4. Notify the minor's parent or legal guardian, if contact information is available.

If you believe a minor has created an account or provided personal data to WealthView, please contact us immediately at wintertonvincent@gmail.com.

17Automated Decision-Making and Profiling

In accordance with Article 22 of the GDPR, we provide the following disclosures about automated decision-making and profiling activities within the Service.

17.1 Financial Health Scores

WealthView may generate a "Financial Health Score" or similar aggregate metric based on your manually entered financial data. This score is calculated from the data you enter, using fixed rules that consider factors such as debt-to-income ratio, savings rate, portfolio diversification, budget adherence, and emergency fund adequacy. It is shown on your dashboard as part of the Service.

Important: Financial Health Scores are provided for informational and educational purposes only. They do not constitute financial advice, credit scoring, creditworthiness assessments, or recommendations to buy, sell, or hold any financial instrument. The scores do not produce legal effects and are not used to make decisions that significantly affect you.

17.2 AI-Powered Insights

WealthView offers insights about your portfolio (e.g. sector concentration warnings, diversification observations). Most are produced by fixed rules running on your own data. The insights feature on our API additionally sends a summary of your portfolio — net worth, totals and your largest holdings — to Cloudflare Workers AI to generate written commentary. If you use the in-app AI chat, your messages are sent to Anthropic using an API key you supply yourself.

These insights:

• Are advisory only and do not constitute investment advice or personal recommendations
• Do not produce legal effects or similarly significantly affect you within the meaning of Art. 22(1) GDPR
• Are generated in part by Cloudflare Workers AI, which receives a portfolio summary for that purpose
• Are not used for profiling for marketing or advertising purposes

17.3 Your Rights Regarding Automated Decisions

Under Article 22 GDPR, you have the right to:

• Opt out: simply do not use the insights or AI chat features. A settings toggle is not yet available.
• Obtain explanation: Request a meaningful explanation of the logic involved in any automated analysis, the significance, and envisaged consequences.
• Contest results: Request human review of any automated output you disagree with.
• Express your point of view: Provide feedback on the accuracy or appropriateness of any automated insight.

18Sub-processors

In accordance with Article 28 of the GDPR, we disclose the following third-party sub-processors that process personal data on our behalf or to whom personal data may be transmitted in the course of operating the Service:

We will notify users of any intended changes to our sub-processor list by updating this Policy and, for material changes, by notifying you via email at least 30 days before the new sub-processor begins processing personal data. If you object to a new sub-processor, you may terminate your account and request deletion of your data.

19Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or features of the Service. When we do, we will:

19.1 Non-Material Changes

For minor changes (e.g., typographical corrections, formatting changes, clarifications that do not alter the substance of the Policy), we will update the "Last updated" date at the top of this page and publish the revised Policy on the Service. Your continued use of the Service after the updated Policy is posted constitutes your acceptance of the changes.

19.2 Material Changes

For material changes (e.g., new categories of data collected, new sub-processors, changes to data sharing practices, changes to retention periods, introduction of new processing activities), we will:

1. Send a notification to your registered email address at least 30 days before the changes take effect.
2. Display a prominent in-app notification banner upon your next login.
3. Require you to actively re-accept the updated Policy before continuing to use the Service. We will not treat continued use as acceptance for material changes; affirmative action is required.
4. Provide a clear summary of what has changed, highlighting the specific sections affected.

19.3 Version History

We maintain a version history of all Privacy Policy revisions, accessible upon request. Each version is identified by its effective date and version number. The current version is Version 2.0, effective August 1, 2026. Version 2.0 corrected material inaccuracies in Version 1.0 about where data is stored, who processes it, and what security measures are in place.

If you do not agree with any material changes to this Policy, you must stop using the Service and request deletion of your account and data before the changes take effect.

20Contact and Complaints

20.1 Data Controller

20.2 Data Protection Officer

Given the nature and scale of our data processing activities, we are committed to appointing a Data Protection Officer (DPO) if and when our processing operations meet the thresholds set out in Article 37 of the GDPR. In the interim, all data protection inquiries should be directed to wintertonvincent@gmail.com.

20.3 Supervisory Authority Complaints

If you believe that our processing of your personal data infringes the GDPR or other applicable data protection legislation, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement.

We encourage you to contact us directly at wintertonvincent@gmail.com before filing a complaint with a supervisory authority, as we are committed to resolving any data protection concerns promptly and transparently. We aim to respond to all privacy-related inquiries within 5 business days.