Privacy Policy.

Controller

Naftal Invest d.o.o.
Maistrova ulica 1, 1290 Grosuplje, Slovenia
Registration number (matična številka): 6856136000
VAT ID (ID za DDV): SI27446620
VAT status: VAT registered
Contact email: naftal.invest@gmail.com

What we collect

• Account data: your email address and display name, and your plan and billing status.
• Saved reports: the reports you save to your trails. Reports themselves are stored without your identity so they can be shared by link and reused as a cache.
• Stack data: the tools you add to My Stack (name, cost, seats, usage notes, renewal dates) and audit results.
• Guest counter: for visitors without an account, an anonymous cookie id and a salted SHA-256 hash of the IP address to count the free search. The raw IP is never stored.
• Statement import: bank or card files are read in your browser. Only merchant names, amounts and dates of outgoing charges are sent for analysis; they are not stored.
• Analytics events: cookieless, first-party events (e.g. page viewed, search completed) with a random per-tab session id, the page path and small non-personal details. If you are signed in, events are linked to your account.
• Feedback: ratings and optional comments on results.

Purposes and legal bases

• Providing the Service and your account — performance of a contract (Art. 6(1)(b) GDPR).
• Billing, tax and accounting — legal obligation (Art. 6(1)(c)).
• Preventing abuse and usage limits — legitimate interest (Art. 6(1)(f)).
• Product analytics and improving results — legitimate interest (Art. 6(1)(f)).
• Renewal reminder emails — contract; you can turn them off in Settings.

Processors

• Hosting and database provider (application hosting, authentication, storage).
• Stripe (payment processing and invoicing).
• AI model provider (generating comparisons, audits and emails from your inputs).
• Email provider (sign-in links and reminders).

The specific provider names and processing locations will be added before launch. This policy is still under legal review.

International transfers

Some processors may process data outside the EEA. Where that happens we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or Standard Contractual Clauses.

Retention

• Account, stack and saved trails: until you delete them or your account.
• Guest counters and daily usage counters: up to 12 months.
• Analytics events and feedback: up to 24 months, then deleted or aggregated.
• Billing records: as long as required by accounting and tax law (typically 10 years).
• Anonymous shared reports: kept so existing links keep working.

Your rights

You have the right to access, rectify, delete, restrict and export your data, and to object to processing based on legitimate interest. You can export your data or delete your account yourself in Settings, or email naftal.invest@gmail.com. You may lodge a complaint with the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec, ip-rs.si), or the authority in your country.

Cookies

We only use essential storage. See the cookie notice.

Contact

Questions about privacy: naftal.invest@gmail.com.