Privacy Policy
This Privacy Policy explains what personal data PORTIQA ("we", "us") collects, how we use it, and the choices you have. It applies to portiqa.ai and the PORTIQA API service.
1. Data we collect
Account data
When you sign up, our identity provider (Auth0) processes your email address and a hashed password (or your social-login identifier). We store an internal user ID, your email, plan tier, and timestamps for account events.
Billing data
Subscription payments are handled by Stripe. We do not see or store your card number. We retain a Stripe customer ID, subscription status, billing cycle, and invoice metadata so we can show your billing history and apply plan changes.
API usage data
Each request to POST /evaluate is logged with a timestamp, the API key used, and the HTTP status returned. We do not retain the request or response payload bodies. Aggregated usage is shown in your dashboard and used to enforce plan limits.
Site analytics
Public and account pages can use Google Analytics to measure traffic and product steps such as completing a check, registering, and saving holdings, but the analytics script is loaded only after affirmative consent. Portfolio contents and account identifiers are not included in these product events. Global Privacy Control and Do Not Track keep analytics disabled. See our Cookie Policy for the controls.
Portfolio checks and saved holdings
A portfolio check does not automatically save your holdings. When you choose Save, we retain the name, holdings and values, risk setting and cash amount in your account so you can reopen them. We do not store a history of scores through this feature. A save started before signup is held temporarily in a server-side session associated with this browser and is available for confirmation for 30 minutes after you start it. You can delete saved holdings from the Saved portfolios page.
Google Search Console connection for administrators
PORTIQA administrators may connect a Google account that has access to the relevant Search Console property so they can submit PORTIQA's public XML sitemap. This optional administrative connection is separate from Google sign-in for customer accounts. It requests the Search Console permission needed to submit a sitemap and is not required to register, sign in, or evaluate a portfolio.
We store the selected Search Console property, connection metadata, and an encrypted refresh token on our server. We use the token to obtain temporary access tokens and send the property identifier and public sitemap URL to Google when submitting the sitemap. The current integration does not retrieve Search Analytics reports or access Gmail, Drive, or Calendar data.
The stored connection remains until it is replaced or an administrator selects Disconnect. Disconnect deletes the connection credential from PORTIQA's active integration database; it does not itself revoke Google's authorization. You can revoke that authorization separately in your Google Account's third-party connections settings. Revoking access prevents PORTIQA from continuing to use the connection, but does not itself delete PORTIQA's stored integration record.
PORTIQA's use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
2. How we use data
- To authenticate you and provide the service you signed up for.
- To process payments and prevent fraud (via Stripe).
- To enforce plan limits and prevent abuse of the API.
- To respond to your support requests.
- To send service notices (e.g., billing issues, security alerts). We do not send marketing emails without an explicit opt-in.
3. Legal basis (GDPR)
We process personal data on the basis of (a) contract — to deliver the service you have purchased; (b) legitimate interest — to keep the service secure and improve it; and (c) consent — for analytics cookies, where applicable.
4. Sub-processors
We rely on the following providers to operate PORTIQA. Each is bound by a data-processing agreement:
- Auth0 (Okta, Inc.) — authentication and identity.
- Stripe, Inc. — payment processing and subscription management.
- Google LLC — Google Analytics on marketing pages.
- Hosting provider — application and database hosting.
5. Data retention
Account data is kept while your account is active and for up to 12 months after closure for accounting and dispute purposes. API usage logs are kept for 24 months. Invoices are retained for the period required by applicable tax law (typically 5–10 years).
Saved holdings remain until you delete them or the associated account is deleted. Pending save requests expire after 30 minutes.
6. Your rights
If you are in the EEA, the UK, or another jurisdiction with comparable rules, you have the right to access, correct, export, or delete your personal data, and to object to or restrict its processing. To exercise these rights, email privacy@portiqa.com. We will respond within 30 days.
7. Security
We use TLS for all traffic, hash passwords via Auth0, never store card numbers, and follow the principle of least privilege for internal access. Vulnerability reports can be sent to security@portiqa.com.
8. International transfers
Some of our sub-processors are based in the United States. Where personal data is transferred outside the EEA/UK, we rely on Standard Contractual Clauses or equivalent safeguards.
9. Children
PORTIQA is not directed at children under 16. We do not knowingly collect data from children.
10. Changes
We may update this policy. Material changes will be announced by email or in-app notice at least 14 days before they take effect.
11. Contact
Questions about this policy: privacy@portiqa.com.