Privacy Policy

1. Who the controller is

Tortuga Trades, a trade name operated by Sergio Marín García. Address: HaMefaked 12, Jerusalén (Israel). Contact: info@tortugatrades.app.

The data controller is not established in the European Union. This policy and the General Data Protection Regulation (GDPR) still apply to your data, because the service is offered to people located in the EU.

2. What data we process and where it comes from

Account data: your email address and name, plus your Google account identifier if you sign up with it. Handled by our authentication provider.

Your trading data: the trades, positions, cash movements, dividends, net asset value and notes you enter or import. It comes from you — you type it in, upload a CSV, or authorise us to download it from your broker using a read-only query token (IBKR Flex) that you generate yourself and can revoke at any time.

Billing data: if you subscribe on the web, our payment provider processes your payment method and billing address. We never see or store your card number. If you subscribe from the iPhone app, the payment is processed by Apple through your Apple ID and we only receive confirmation of your subscription status, never your payment method.

Technical data: IP address, browser type, pages visited and application errors, collected by our hosting and monitoring providers.

We do not ask for and do not want special categories of data (health, beliefs, biometrics). Please do not put them in your notes.

3. What we use it for, and on what legal basis

To provide the service — create your account, import and compute your trading activity, show you your results: legal basis is performance of the contract you accept when you register.

To charge your subscription and keep our accounts: performance of the contract and compliance with legal obligations.

To keep the service secure and working: detecting faults, preventing abuse and measuring usage in aggregate. Legal basis is our legitimate interest in a product that works and does not get abused.

To send you operational alerts you switched on yourself (trade alerts, Telegram notifications): performance of the contract as to the feature you asked for.

To send you marketing or the newsletter: only with your consent, which you can withdraw at any time from the unsubscribe link in every email.

To generate AI analysis: only when you use that feature. At that moment the portfolio data needed to produce the analysis is sent.

4. Who we share it with

We do not sell your data and we do not hand it to third parties for their own advertising. We share it only with the providers we need to run the service, and only with what each one needs:

Clerk, for authentication and account management. Supabase, as the database. Vercel, for web hosting and aggregate usage metrics. Railway, for server hosting. Stripe, for payments and subscriptions on the web. Apple, for purchases and subscriptions made from the iPhone app. Resend, for the emails we send you. Telegram, only if you enable notifications on that channel. Anthropic, to generate AI analysis when you use that feature. Sentry, to log application errors.

All of them act as processors on our behalf and under contract, except Stripe, Apple and Telegram, which are also controllers for their own processing under their respective policies.

We may also disclose data to authorities where a law requires us to.

5. International transfers

The controller resides in Israel. The European Commission recognises Israel as providing an adequate level of protection (Decision 2011/61/EU), so transfers of data from the EU to Israel require no additional safeguards.

Several of the providers listed above are in the United States. Those transfers rely on standard contractual clauses approved by the European Commission, or on the EU–US adequacy framework where the provider is certified.

6. How long we keep it

While your account is active, we keep your data so we can provide the service.

If you delete your account, we mark your data as deleted and stop using it. We keep a limited copy for as long as needed to handle claims and meet legal obligations — billing records, for instance, carry tax retention periods — and then it is erased.

If you want immediate and complete erasure, write to us and we will do it.

7. Your rights

You can ask us to access your data, rectify it, erase it, restrict its processing, object to it, and receive it in a portable format. You can also withdraw any consent you gave at any time, without affecting processing carried out beforehand.

To exercise them, write to info@tortugatrades.app. We will reply within one month. There is no charge.

If you believe we have got it wrong, you can lodge a complaint with the data protection supervisory authority of your country of residence. In Spain that is the Agencia Española de Protección de Datos (www.aepd.es).

8. Security

We encrypt communications, restrict access to data, and use providers that apply recognised security measures.

Your broker query token is read-only and exists to download reports: it cannot trade or move money in your account. You can revoke it from your broker whenever you want.

No system is infallible. Should a breach occur that poses a risk to your rights, we will tell you and notify the competent authority within the legal deadlines.

9. Minors

The service is not aimed at people under 18 and we do not knowingly process their data. If we find an account belonging to a minor, we will delete it.

10. Changes to this policy

If we change this policy, we will update the version date shown at the top. If the change is substantial, we will tell you by email or inside the app before it takes effect.