Privacy policy

The data controller is Drovane Portfolio (micro-entreprise), 155 avenue de Wagram, 75017 Paris. For any question, or to exercise your rights: contact@drovaneportfolio.com.

This page describes what the website drovaneportfolio.com does with your data. It does not cover our providers' own websites (Stripe's payment page, for example), which have their own policies.

• Account: your email address; your password, kept only in hashed form by our authentication provider (we cannot read it); the dates your account was created, your address confirmed and your last login.
• Language: French or English, for the website and for emails.
• Subscription: your status (free, trial or Pro), the state of your subscription and the customer and subscription identifiers assigned by Stripe. Your card details are entered on Stripe's page: we do not see or store them.
• Email preferences: for each category (announcements, portfolio alerts), whether you receive it or not, and the date of your last change.
• Signup source: when you reach the site through a link that indicates where it comes from (those on our YouTube, Instagram or TikTok accounts, for example), we note that platform when you create your account; with no indication, the value “direct” is noted. Only one value from a fixed list is stored. No cookie or advertising identifier is used for this, and your browsing is not tracked.
• Emails sent: every email goes through our email provider, which receives the recipient's address and the content of the email. To be validated: what this provider keeps afterwards.
• Technical logs: on each request, our hosting providers process your IP address, your browser type, the page requested and the time. To be validated: when you log in to your account, our authentication provider records the IP address and browser with the session. The website itself keeps no log of your visits.
• Audience measurement, only if you accept it: pages viewed, referring site, device type and approximate location, with Google Analytics (see section 6).

We do not ask for your name, postal address or phone number. Stripe may ask you for billing information at the time of payment.

• To create and manage your account, log you in and give you access to the portfolio according to your plan.
• To manage the Pro subscription: payment, renewal, cancellation and invoicing.
• To send you the service's emails: address confirmation, welcome, rebalances, changes to the Bitcoin overlay and announcements. You can unsubscribe from announcements and alerts in your email preferences or through the link at the bottom of each email. Emails required for your account (address confirmation, password, payment receipts) are not affected.
• To learn which platforms bring people to the service: this is the only use of the signup source.
• To keep the website secure and running: technical logs, protection against bots.
• To measure the website's audience, only with your consent.

To be validated: the legal basis for each processing activity (performance of the contract, consent, legitimate interest, legal obligation) must be specified here after legal review.

We use the following providers.

• Supabase (Supabase, Inc.) — database and authentication: email address, hashed password, profile (language, subscription, email preferences, signup source), IP address and browser at login (to be validated). This data is stored in the AWS eu-west-2 region (London, United Kingdom).
• Cloudflare (Cloudflare, Inc.) — website hosting, network and protection against bots: every request to the website goes through Cloudflare (IP address, browser, pages requested, session cookies in transit).
• Stripe — payment for the Pro subscription: email address, your account's internal identifier, and the payment information you enter on its page. Missing information: the Stripe entity the contract is with.
• Resend (Resend, Inc.) — sending emails: the recipient's email address and the content of the email.
• GitHub (GitHub, Inc.) — running automated tasks (portfolio rebalancing, sending emails): recipients' addresses are processed there for the time it takes to send; if a send fails, the address concerned is written to the task's run log.
• Google — audience measurement with Google Analytics 4, only after your consent: the browsing data described in section 2 and Google Analytics cookies. Missing information: the Google entity the contract is with.

The website sends your data to no other third party, and we do not sell it.

The database that holds your account is hosted in London, United Kingdom, and therefore outside the European Union. To be validated: the legal framework for this transfer.

Supabase, Cloudflare, Resend, GitHub, Stripe and Google are US companies or belong to US groups: your data may be processed in the United States or in other countries where these companies operate.

To be validated: the legal framework for each of these other transfers (standard contractual clauses, certification or other), to be specified here after checking each provider's contract.

Here is everything the website places in your browser.

• NEXT_LOCALE (cookie) — remembers the website's language. Duration: the browsing session; it disappears when you close the browser.
• sb-…-auth-token (cookie) — keeps you logged in to your account. It is set only when you log in and removed when you log out. Maximum duration: 400 days.
• drovane-cookie-consent (local storage) — remembers your choice about audience measurement (accepted or rejected). No expiry date: it stays until you change your choice or clear the browser's storage.
• _ga and _ga_… (Google Analytics cookies) — audience measurement. Set only after you click “Accept”. To be validated: 2 years by default at Google, to be confirmed or reduced.
• Cloudflare security cookies (for example cf_clearance or __cf_bm) — may be set when Cloudflare checks that a visit does not come from a bot. To be validated: exact names and durations.

Google Analytics is loaded only after you agree. Until you click “Accept”, or if you click “Reject”, Google's script is not loaded and no audience-measurement cookie is set.

Changing your mind: the “Cookie preferences” link at the bottom of every page reopens the banner, in either direction. If you reject after having accepted, the website disables Google Analytics at once, without reloading the page, and deletes its cookies (_ga and _ga_…) from your browser.

The payment page is hosted by Stripe, on its own website, with its own cookies. The signup source uses neither cookies nor local storage.

The website does not currently delete any data automatically: there is no self-service account deletion and no purge of inactive accounts.

• Account and profile (including email preferences and signup source): kept for as long as your account exists. To have it deleted, write to contact@drovaneportfolio.com: deletion is done by hand. To be validated: within one month.
• Inactive account: no automatic deletion is applied today; an account with no login is kept until its deletion is requested.
• Billing data: to be validated: 10 years, the retention period for accounting records.
• Technical logs: according to our providers' retention periods. Missing information: periods applied by Cloudflare and by Supabase.
• Email sending records: missing information (period applied by Resend).
• Audience measurement: to be validated (Google Analytics retention setting).

You can ask to access your data, have it corrected or deleted, restrict its processing and receive it in a portable format, and you can object to a processing activity. Where processing is based on your consent (audience measurement), you can withdraw it at any time through the “Cookie preferences” link.

To exercise these rights, including to have your account deleted, write to contact@drovaneportfolio.com, preferably from your account's email address. To be validated: reply within one month.

You can also act directly: unsubscribe from emails in your email preferences, and manage or cancel your subscription from your account.

If you believe your rights are not being respected, you can lodge a complaint with the French data protection authority (CNIL): cnil.fr/en/complaints, or by post to CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France.

The website is only available over HTTPS. Passwords are never stored in plain text. Access to the database is restricted by rules applied to each row. Unsubscribe links in emails are signed and do not contain your email address.

When this policy changes, the date shown at the top of the page is updated.