Privacy Policy

The data controller responsible for your personal data is:

ACCE Investments, operated by Adrien Chantreuil (sole trader)
Email: [email protected]
Website: acceinvestments.com

This Privacy Policy explains how we collect, use, store, and protect your personal data when you use the ACCE Investments platform (the "Service"), in accordance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable national data protection law, in particular Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and Guarantee of Digital Rights ("LOPDGDD").

2.1 Data you provide directly

Account information: email address, full name, and password (hashed) when you register. Payment information: billing details processed by Stripe; we do not store credit card numbers on our servers. Profile preferences: alert preferences, followed indices and stocks, and display settings. Portfolio data: stock transactions you manually enter, including ticker, date, shares, price, and optional notes. Contact communications: any messages you send to us via email.

Portfolio sharing: when you share a portfolio publicly via a share token, the recipients see the holdings and notes you have chosen to make visible. When you invite a collaborator by email, that email address is stored on the invitation record and shared with the invited party only.

2.2 Data imported from broker connections (optional, opt-in)

If you choose to connect a brokerage account via our SnapTrade integration (currently in beta), SnapTrade returns to us a read-only feed of your positions, executed transactions, account balances, and account metadata for the accounts you authorise. We use this data to populate the portfolio tracker on your behalf. We do not initiate trades, hold funds, or modify any account state.

Broker connection metadata stored by ACCE is limited to: the connection identifier returned by SnapTrade, your encrypted SnapTrade userSecret (encrypted with AES-256-GCM at rest), the broker name, and the connection status. The brokerage credentials themselves never reach ACCE servers; they are entered into SnapTrade's OAuth flow directly.

You can disconnect a broker at any time from Settings > Connections. Disconnection revokes SnapTrade's access and stops further data refresh; previously-imported transactions remain in your portfolio tracker for historical continuity unless you delete them.

2.3 Data collected automatically

Usage data: pages visited, features used, timestamps, and interaction patterns. Device and technical data: IP address, browser type and version, operating system, screen resolution, and referring URL. Authentication data: session tokens and authentication state managed by Supabase. When you are signed in, this usage data may be linked to your account so we can understand how registered users use the Service.

2.4 Affiliate click events

When you click an outbound link to one of our brokerage partners, we log the partner identifier, the source page, your account ID if you are signed in, your user-agent string, and a salted daily hash of your IP address. We do not store the plaintext IP. We use this data solely to (a) detect fraudulent or automated clicks, (b) reconcile commissions reported by partners, and (c) understand which content drives broker sign-ups. The salt rotates daily, so hashes cannot be linked across days. This processing relies on our legitimate interest (Art. 6(1)(f) GDPR) in operating and funding the Service. We do not share this data with advertising networks.

2.5 Data we do not collect

We do not collect special categories of personal data (such as racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data). We do not collect data from minors; the Service is restricted to users aged 18 and over. We do not access your brokerage accounts unless you explicitly opt in to a SnapTrade broker connection (see section 2.2), and even then we receive only the read-only feed described above.

2.6 Instagram commenters (information under Article 14 GDPR)

If you comment a stock keyword (for example a company name) on one of our public Instagram posts, we receive that comment from Instagram, so we obtain your personal data from a source other than you. We process your Instagram username and ID, the text and time of your comment, and the identifier of the post. If we reply, we also store the private message and the public reply we sent.

We use this data only to answer your comment: one private message and one short public reply with the information you asked for, and to avoid messaging you twice. We do not build a profile of you and we do not share the data with anyone other than Meta, which delivers the messages. The legal basis is our legitimate interest in answering people who ask us for information (Art. 6(1)(f) GDPR).

Retention: we keep the record for 12 months. After 12 months your username, the text of your comment, the message text and the public reply are erased from our database. Only a technical comment identifier remains, so that the same comment cannot trigger a second message. If you reply STOP, we remember that choice so that we do not message you again.

Your rights are those described in section 8. To object to this processing (Art. 21 GDPR), reply STOP to our message or in a comment on one of our posts, or write to [email protected], and we will not message you again. You can also delete your comment on Instagram, and you may lodge a complaint with a supervisory authority.

We process your personal data under the following legal bases as defined in Article 6 of the GDPR:

Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service, manage your account, process payments, deliver subscription content, and maintain the portfolio tracker.

Legitimate interests (Art. 6(1)(f)): Processing for platform security, fraud prevention, service improvement, analytics to understand usage patterns, and communication about Service updates. Our legitimate interest is balanced against your rights and does not override your fundamental rights and freedoms.

Consent (Art. 6(1)(a)): Where required, such as for marketing emails, optional cookies, and non-essential analytics. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.

Legal obligation (Art. 6(1)(c)): Processing necessary to comply with applicable tax, accounting, and legal requirements.

We use your personal data to: provide, operate, and maintain the Service and your account; process subscription payments and manage billing; deliver personalised content based on your followed indices and stocks; send transactional emails (account confirmations, password resets, payment receipts); send alert and digest emails based on your configured preferences; compute and display portfolio analytics based on data you provide; improve the Service through aggregate usage analytics; detect and prevent fraud, abuse, and security incidents; and comply with legal obligations.

We do not sell, rent, or trade your personal data to any third party. We share data only with the following categories of recipients. Unless stated otherwise below, they act as our processors and are bound by data processing agreements:

Supabase (infrastructure & authentication): Hosts our database and manages authentication. Supabase processes account data and usage data on servers located in the EU (AWS eu-central-1, Frankfurt). Privacy policy: supabase.com/privacy.

Vercel (hosting): Hosts and serves the ACCE platform. Processes IP addresses and request data. Edge functions may process requests in multiple regions. Privacy policy: vercel.com/legal/privacy-policy.

Stripe (payments): Processes subscription payments and stores payment method information. Stripe is a certified member of the EU-US Data Privacy Framework. Privacy policy: stripe.com/privacy.

Anthropic (AI processing): Powers AI-generated content such as stock analysis, alerts, and picks. General content is built from market and company data only. Personalised features you choose to use, such as portfolio insights and performance summary emails, send your holdings (tickers, quantities, cost basis) and performance figures to the Anthropic API. We never send your name or email address. Privacy policy: anthropic.com/privacy.

Ask ACCE: the questions you type in Ask ACCE are sent to the Anthropic API together with the ACCE data needed to answer them. We never send your name or email address, but anything you write in a question is sent as written, so avoid sharing personal details you do not need to. Chats are kept for 12 months, you can delete any chat at any time, and all chats are deleted with your account. We only read the text of messages that our automatic check flags as misuse; otherwise we only see counts and token usage.

SnapTrade (broker auto-import, optional): Used only when you opt in to a broker connection. SnapTrade authenticates you with your brokerage and returns a read-only feed of positions, transactions, balances, and account metadata for the accounts you authorise. SnapTrade is the data controller for the broker credentials themselves; ACCE only receives the data feed. See SnapTrade's privacy policy at snaptrade.com/privacy. You may disconnect at any time from Settings > Connections.

Resend (email delivery): Delivers transactional and alert emails on our behalf. Processes your email address. Privacy policy: resend.com/legal/privacy-policy.

OpenAI (embeddings): Converts public stock descriptions into search vectors. No personal data is sent. Privacy policy: openai.com/policies/privacy-policy.

Cloudflare (Turnstile bot protection): Checks that sign-up and contact forms are used by people. It processes your IP address and browser signals. Privacy policy: cloudflare.com/privacypolicy.

Meta Platforms (advertising measurement): When the Marketing cookie category is on (on by default only for visitors from the United States, Canada outside Quebec and Australia; see our Cookie Policy, section 2), the Meta Pixel and our server tell Meta about visits, signups, trial starts and first payments that follow our Instagram and Facebook ads, with your email address hashed (SHA-256), your IP address, your browser's user agent and Meta's cookie identifiers. When it is off, nothing is sent. Meta processes this data under its own terms; see our Cookie Policy (section 2.4). Privacy policy: facebook.com/privacy/policy.

We may also disclose your data if required by law, court order, or governmental authority, or if necessary to protect our rights, safety, or property.

The portfolio tracker offers two optional sharing flows. Both are user-initiated and revocable; nothing is shared until you explicitly turn it on.

Public share links: When you generate a public share token for a portfolio, anyone with the link can view a read-only snapshot of the portfolio (holdings, returns, optional notes). The link is unguessable (24 random bytes, base64url-encoded) but is not authenticated; treat it like an unlisted document. You can revoke the link at any time from the portfolio settings, which immediately invalidates it.

Collaborator invites: When you invite a collaborator by email, the invitation record stores their email address and a single-use token. The invited person sees the portfolio you choose to share, in read-only mode. Either you or the collaborator can revoke access at any time. We do not market to invited email addresses.

Some of our processors operate outside the European Economic Area (EEA). Where personal data is transferred outside the EEA, we ensure appropriate safeguards are in place, including: EU-US Data Privacy Framework adequacy (for certified US processors such as Stripe); Standard Contractual Clauses (SCCs) approved by the European Commission; or adequacy decisions of the European Commission.

You may request information about the specific safeguards applied to international transfers by contacting [email protected].

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

Account data is retained for as long as your account is active and is deleted when you delete your account; there is no recovery period. Copies in encrypted infrastructure backups are overwritten as backups rotate. Payment records and invoices are retained for 7 years, which covers the retention periods required by Spanish tax and commercial law (at least 6 years under Article 30 of the Spanish Commercial Code). Portfolio data is deleted when you delete your account. Usage analytics are deleted after 6 months. Instagram comments we answer automatically are anonymised after 12 months, and X reply records are deleted after 6 months. Email logs are retained for 12 months. Alerts and notification history is retained for 12 months. Sign-up verification codes are deleted after 24 hours. Support correspondence (emails you send to us and our replies) is retained for 5 years after it is received, the Spanish limitation period for contractual claims, on the basis of our legitimate interest in establishing, exercising or defending legal claims (Art. 6(1)(f) GDPR); it is not deleted when you delete your account.

Ask ACCE chats are kept for 12 months, you can delete any chat at any time, and all chats are deleted with your account. AI token balances and usage records are kept while your account exists; payment records for question packs and trial activations follow the 7-year rule above.

When data is no longer needed, it is securely deleted or anonymised so that it can no longer be associated with you.

Free trial records: when a free trial starts, we keep a one-way hash (SHA-256) of your normalised email address and the fingerprint Stripe assigns to the card used, together with the trial date. We keep this record after you delete your account, so that the free trial can be used only once per person. It does not contain your email address or your card number. The legal basis is our legitimate interest in preventing fraud and abuse of the free trial (Art. 6(1)(f) GDPR), and you can object to it as described in section 8.

As a data subject under the GDPR, you have the following rights:

Right of access (Art. 15): You may request a copy of the personal data we hold about you.

Right to rectification (Art. 16): You may request correction of inaccurate or incomplete personal data.

Right to erasure (Art. 17): You may request deletion of your personal data where there is no compelling reason for its continued processing.

Right to restriction (Art. 18): You may request restriction of processing in certain circumstances.

Right to data portability (Art. 20): You may request your data in a structured, commonly used, machine-readable format.

Right to object (Art. 21): You may object to processing based on legitimate interests, including profiling. You may object to direct marketing at any time.

Right to withdraw consent (Art. 7): Where processing is based on consent, you may withdraw it at any time.

Right to lodge a complaint: You have the right to lodge a complaint with your national data protection authority. In Spain, this is the Agencia Española de Protección de Datos (AEPD) at aepd.es.

To exercise any of these rights, contact us at [email protected]. We will respond within one month of receipt of your request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, in which case we will tell you within the first month and explain why. Exercising your rights is free of charge. Where a request is manifestly unfounded or excessive, in particular because of its repetitive character, we may either charge a reasonable fee or refuse to act on the request (Art. 12(5) GDPR).

We use cookies and similar technologies to operate the Service. For full details, see our Cookie Policy.

Strictly necessary cookies (authentication, session management, security) are exempt from consent because they are strictly necessary to provide the Service you request (Article 5(3) of the ePrivacy Directive 2002/58/EC and, in Spain, Article 22.2 of Law 34/2002 on information society services, "LSSI"). Non-essential cookies (analytics, attribution, marketing) are only placed with your prior consent.

We also record the pages you view on our site in our own database, without cookies (the details are in section 2.3 of the Cookie Policy). If you are signed in, these page views are linked to your account so we can understand how members use the product and improve it. The legal basis is our legitimate interest (Art. 6(1)(f)). This data is not shared with third parties.

We implement appropriate technical and organisational measures to protect your personal data, including: encryption of data in transit (TLS/HTTPS) and at rest; secure password hashing; Row Level Security (RLS) policies in our database ensuring users can only access their own data; access controls limiting admin access to authorised personnel; regular review of security practices; and use of established, security-audited infrastructure providers.

While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay, as required by Articles 33 and 34 of the GDPR.

The Service is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child under 18, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at [email protected].

Our scoring engine computes stock scores based on quantitative financial metrics using automated processing. These scores are applied to stocks (not to users) and do not constitute automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 of the GDPR.

AI-generated content (alerts, picks, analysis) is created by automated systems but is directed at general audiences, not at individual users based on their personal data.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. Material changes will be communicated via email or a prominent notice on the Service at least 30 days before they take effect. The "Last updated" date at the top of this page indicates the most recent revision.

For any questions, requests, or concerns regarding this Privacy Policy or our data processing practices, contact:

ACCE Investments, Data Protection
Email: [email protected]
General inquiries: [email protected]
Website: acceinvestments.com