Privacy Policy

Last updated: 05-10-2026

This policy explains what personal data Profolio collects, why, who we share it with, how long we keep it and what your rights are. It applies to the Profolio website at https://profolioapp.com and the service behind it.

1. Who we are

Profolio is a trading name of Bednal Limited, a company registered in England and Wales with company number 12582198. Our registered office is Unit 4 Clifford Court, Cooper Way, Carlisle, CA3 0JG. VAT registration number GB 385708067.

Bednal Limited is the controller of your personal data. We are registered with the Information Commissioner's Office (ICO) under registration number [ICO REGISTRATION NUMBER].

For anything about your data, contact us at support@profolioapp.com.

2. What we collect

Information you give us

Account details: your email address, your name if you give it, your password (stored only as a hash), your passkeys (the public part only) and, if you turn on two-factor authentication, its secret.
Your financial records: the assets, investments, properties, liabilities and expenses you enter, including amounts, dates, descriptions, ticker symbols and property addresses.
Imported transactions: when you import a bank statement, the transactions you confirm (date, description or merchant name, amount and category).
Connection keys: if you connect Trading 212, Alpha Vantage, Twelve Data or CoinGecko, the API key you give us for that service.
Settings: preferences such as your currency.
Messages: what you tell us if you email us.

Information collected when you use Profolio

Sign-in and security data: for each device you are signed in on, a session record with its IP address and browser (user agent), kept until the session ends; the time you last signed in; and your IP address, which we use for rate limiting and to protect accounts.
Server logs: our hosting provider records requests to the site (such as IP address, browser type, the page requested and the time) for running and securing the service.
Subscription data: your subscription status, plan, trial and renewal dates. Stripe holds your card details; we never see your full card number.
Data from providers you connect: for example, your investments from Trading 212.
Records of actions our staff take on your account: for example granting free access, changing your role, sending a password reset or signing you out. We record who did it, when and why, so those actions can be checked later. The record refers to your account by an internal id only and is kept after the account is deleted.

If you choose to sign in with Google or Apple, that provider tells us your email address, a unique account identifier and, if you allow it, your name. We receive nothing from them if you do not use that option.

What we do not collect

We do not use analytics or advertising trackers, we do not send marketing emails, and we do not carry out identity checks.

3. Bank statements

When you import a bank statement, the file (CSV or PDF) is read in your browser. Only the transactions you review and confirm are sent to us and saved. The statement file itself is never uploaded or stored.

Transaction descriptions can reveal sensitive things about you, such as your health, religion, political views or trade union membership, from the names of the places you pay. We do not try to work these out and we use the transactions only to show you your own spending.

4. How we use your data and our lawful bases

What we do	Lawful basis
Create and run your account, store your records, show your dashboard, fetch prices, import from providers you connect	Contract: we need it to provide the service you asked for
Take payment, run the free trial, manage renewals, cancellations and refunds	Contract
Send service emails: email verification, password reset, billing notices, and warnings before an inactive account is deleted	Contract
Keep the service secure: rate limiting, preventing abuse, investigating problems	Legitimate interests: protecting you, us and the service
Keep tax and accounting records	Legal obligation
Answer your messages	Legitimate interests, or contract where it is about your account

We do not sell your data, share it for advertising, or make decisions about you by solely automated means that have legal or similarly significant effects. Profolio does suggest a category for imported transactions automatically; you can change it before you confirm and edit it afterwards.

We use the following providers to run Profolio. Each acts on our instructions (a "processor") unless stated otherwise.

Provider	What for	Data	Where
Vercel Inc.	Hosting and server logs	All data passing through the site, IP addresses, logs	USA and global edge network
Neon Inc.	Database	All account and financial data you store	USA (AWS us-east-1)
Stripe	Payments, subscriptions and VAT	Name, email, billing address, card details, payment history	USA and elsewhere
Resend	Sending service emails	Email address, email content	USA
Upstash	Rate limiting	IP address, user id	USA
Google	Google sign-in, if you choose it	Sign-in identity	USA
Google	Property address lookup (Google Places)	The address text you type, sent from our server	USA
Apple	Apple sign-in, if you choose it	Sign-in identity	USA
Yahoo Finance	Market prices	Ticker symbols only, no personal data	USA

Stripe is also an independent controller for its own legal obligations, such as fraud prevention and financial regulation. Its own privacy policy applies to that.

Services you connect yourself. If you connect Trading 212, Alpha Vantage, Twelve Data or CoinGecko, we send your API key, decrypted, only to that provider over an encrypted (HTTPS) connection, together with the request needed to fetch your data or prices. That provider's own terms and privacy policy apply to what it does.

We may also disclose data if the law requires it, to protect people's safety, or to a buyer if Profolio is sold, in which case we will tell you.

6. International transfers

Our providers store and process data in the United States. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that. Otherwise we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which oblige the provider to protect your data to UK standards. You can ask us for more detail at support@profolioapp.com.

7. How long we keep your data

While your account is active, we keep your data so that we can provide the service.
If you delete your account, your account and data are deleted from our database immediately and permanently. Our database provider keeps a restore history for 24 hours, so deleted data is gone from it completely within 24 hours.
If your subscription lapses or you cancel, your data is kept for 90 days from the day your access ends, so that you can come back or export it. We email you at 60 days and at 83 days. After 90 days your account and data are deleted, unless you have subscribed again.
If you never start a subscription, your account and data are kept for 90 days from the day you created the account. We email you at 60 days and at 83 days. After 90 days your account and data are deleted, unless you have started a subscription.
We never delete an account without both emails. If we send an email late, the deletion moves back so that you always have at least 30 days from the first email and 7 days from the second. Each email gives the exact date. We also email you to confirm once an account has been deleted.
Server logs are kept by our hosting provider for its standard period.
Payment records are kept by Stripe under its own retention rules, and we keep the invoices and records we must keep for tax and accounting.

8. How we protect your data

All connections to Profolio use HTTPS.
Passwords are stored only as hashes, never in plain text.
Two-factor authentication secrets and the API keys you give us for third-party services are encrypted with AES-256-GCM before we store them.
Every request is checked so that you can only reach your own data.
Our hosting and database providers encrypt stored data.

No system is completely secure. If a breach affects your data and puts you at high risk, we will tell you without undue delay.

9. Your rights

Under UK data protection law you have the right to:

access the personal data we hold about you;
have inaccurate data corrected;
have your data deleted;
restrict how we use it in some circumstances;
object to processing based on our legitimate interests;
data portability: receive your data in a machine-readable format; and
withdraw consent at any time, where we rely on consent.

You can do much of this yourself: edit your records in Profolio, download all your data as a JSON file from Settings, or delete your account from Settings. For anything else, email support@profolioapp.com. We will reply within one month. If a request is complex, we may extend this by up to two more months, and we will tell you if we do.

Complaints

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Phone: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/

10. Age

Profolio is for people aged 18 or over. We do not knowingly collect data from anyone younger. If you think a child has given us data, contact us and we will delete it.

11. Cookies

We use only cookies and browser storage that are needed for Profolio to work or to remember your preferences. See the Cookie Policy.

12. Changes to this policy

If we make an important change to this policy, we will tell you by email or in Profolio before it takes effect. The date at the top shows when it last changed.

13. Contact

Bednal Limited, trading as Profolio
Unit 4 Clifford Court, Cooper Way, Carlisle, CA3 0JG
Email: support@profolioapp.com