Privacy Policy

1. Controller and scope

This Privacy Policy explains how Taufolio collects, uses, stores, and otherwise processes personal data when you use the Taufolio website, application, reports, public sharing links, payment process, and related support channels.

The controller of your personal data is:

• Jacek Janczura
• Adama Mickiewicza 73, 01-625 Warsaw, Poland
• Email: support@taufolio.com
• NIP (Polish tax ID): 5253008276
• EU VAT number: PL5253008276
• REGON: 528998136

In this Privacy Policy, "Taufolio", "we", "us", and "our" refer to the controller named above.

2. What Taufolio does

Taufolio is a software service that helps users generate AI-assisted research material on publicly traded stocks, including in-depth research reports, short summary reports, earnings-call analyses, translations, and related portfolio and sharing features.

Taufolio provides informational software output only. It does not provide investment, financial, legal, or tax advice, and its output may contain inaccuracies, omissions, outdated information, or model hallucinations.

3. Categories of personal data

Depending on how you use Taufolio, we may process the following categories of personal data:

Account and profile data

• first and last name
• email address
• authentication identifiers
• an avatar or profile information you choose to provide

Authentication, session, and device data

• login and account-security metadata
• session identifiers
• browser and device metadata
• IP address and related security logs

Workspace and product-usage data

• workspace membership and role data
• feature settings and preferences
• report requests and usage history
• usage records related to billing and credits

Portfolio and watchlist data

• tracked tickers
• portfolio holdings and watchlist entries
• report preferences linked to those tickers

Billing and transaction data

• subscription plan details
• billing status
• invoices and payment metadata
• checkout and top-up transaction records

We do not knowingly store full payment-card data. Payments are handled by external payment providers, including Stripe.

Submitted and generated content

• earnings-call transcripts
• files or documents you upload
• report payloads and translations generated for your account or workspace
• the content of public sharing links you choose to publish

Communication and support data

• support tickets
• messages you send us
• operational messages and service notifications

Security, audit, and anti-abuse data

• security events
• administrative logs
• cost-control and abuse-monitoring signals
• records needed to investigate abuse, bugs, or fraud

4. Sources of personal data

We collect personal data:

• directly from you
• from your use of Taufolio
• from authentication, payment, hosting, AI, market-data, email, and infrastructure providers who help us deliver the service

Providing personal data is generally voluntary, but some data is required to open an account, verify identity, or process a payment. Without it, we cannot provide those features.

5. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases under GDPR:

To provide and operate Taufolio

This covers opening an account, authentication, report generation, portfolio features, subscriptions, credits, support, and delivering the service.

• Legal basis: performance of a contract, or taking steps at your request before entering into one.

To manage billing, payments, and accounting

This covers subscription management, invoicing, fraud checks, handling chargebacks, and accounting records.

• Legal basis: performance of a contract and compliance with legal obligations.

To secure the service and prevent abuse

This covers authentication security, rate limiting, fraud detection, incident investigation, cost control, and protecting our systems, users, and business.

• Legal basis: legitimate interests in securing and operating the service, and, where applicable, compliance with legal obligations.

To improve and maintain the service

This covers debugging, troubleshooting, internal diagnostics, availability management, and operational improvements.

• Legal basis: legitimate interests in maintaining and improving the service.

To communicate with you

This covers transactional emails, account notifications, support replies, legal notices, and other service communications.

• Legal basis: performance of a contract, legitimate interests, and, where required by law, your consent.

To comply with legal obligations

This covers tax, accounting, anti-fraud, consumer-protection, and other legal obligations applicable to our business.

• Legal basis: compliance with legal obligations.

Where consent is required

Where a specific processing activity requires consent under applicable law, we rely on consent for it.

• Legal basis: consent.

Automated decision-making

We do not use personal data for automated decision-making or profiling that produces legal effects or similarly significantly affects a person, within the meaning of GDPR Article 22.

6. Cookies and similar technologies

Taufolio uses cookies or similar storage technologies that are necessary for the service to work, including for:

• authentication
• session continuity
• security
• billing processes
• user preferences
• core service functionality

Because these technologies are used to deliver and secure the service, blocking them may affect functionality.

In addition, Taufolio uses PostHog for product analytics, session replay (signed-in users only), frontend error tracking, and web-vitals monitoring. PostHog is loaded only after you consent to analytics in the cookie banner. Full disclosure is in section 6a (Product analytics and session replay), and the specific cookies plus how to withdraw consent are described in the Cookie Policy.

6a. Product analytics and session replay (PostHog)

To improve Taufolio, diagnose problems, and understand how people use the product, Taufolio uses PostHog as its analytics and observability platform. PostHog acts as a data processor on our behalf and processes data in the European Union region (eu.i.posthog.com). PostHog is activated only after you consent to analytics in the cookie banner; otherwise it stays off, and you can withdraw consent at any time via "Manage cookies" in the footer.

What PostHog collects

For every visitor who has consented (anonymous and signed-in):

• Usage events: clicks and actions taken in the product (e.g. opening a report, starting a chat, changing plan).
• Pageviews and pageleaves: the site and app URLs visited, with timestamps.
• Heatmaps: aggregated on-page click positions (no individual cursor-movement recording for anonymous visitors).
• Paths: the sequence of pages visited within a session, to understand navigation flows.
• Frontend exceptions: JavaScript errors that occur in your browser, together with stack traces and the URL where they occurred, so we can diagnose and fix them.
• Web vitals: performance measurements such as Largest Contentful Paint and Cumulative Layout Shift, used to monitor page speed.
• Technical context: browser type and version, operating system, device type, screen size, language, referrer, country (derived from IP at ingest time - the raw IP address is not retained long term), and a random visitor identifier PostHog assigns, stored in the ph_* cookies described in the Cookie Policy.

Only for signed-in users:

• Session replay: a recording-like reconstruction of your interaction with the app (cursor movement, clicks, scrolling, typing in non-sensitive fields). Replay is disabled for anonymous visitors and masks fields flagged as sensitive by default (passwords, card data). Replay is used to diagnose specific bugs and usability problems for registered or paying users.
• The identify call: when you sign in, we link your PostHog identifier to your account using your email address and name, so we can connect analytics data to your account when diagnosing support tickets or quality regressions.

Taufolio does not send PostHog any Stripe data or billing, payment, or subscription data. PostHog only receives the product-analytics, pageview, heatmap, session-replay, frontend-error, and web-vitals data described above; revenue and subscription reporting stays in Stripe and our own systems, never in PostHog.

As of 19 August 2026, application errors are no longer sent to PostHog: error and performance monitoring is now handled solely by Sentry, described in section 6b.

What PostHog does NOT collect

• your password, payment-card data, or any other secret credential.
• the content of your portfolio holdings or watchlist, beyond the ticker-level pageviews needed to render those pages.
• AI provider prompts or responses (PostHog is not used as an LLM-observability backend for this service).

Legal basis

• Analytics, session replay, heatmaps, and web vitals are processed on the basis of your consent (GDPR Article 6(1)(a) and Article 5(3) of the ePrivacy Directive as implemented in Poland). They operate only while consent stands.
• Operational logs strictly necessary to run the service (e.g. error logs needed to investigate an incident you reported) may, where applicable, be processed on the basis of our legitimate interests (GDPR Article 6(1)(f)), independently of PostHog.

Processor

• PostHog Inc. (acting as our processor under a data processing agreement), processing data in the EU region.

How to withdraw consent

You can withdraw analytics consent at any time:

• Click "Manage cookies" in the site footer to reopen your consent preferences and turn off the Analytics category.
• Once you withdraw consent, Taufolio stops loading PostHog and instructs PostHog to discard any further events from your browser. Events collected before you withdrew consent remain subject to the retention schedule described in section 10.

6b. Error and performance monitoring (Sentry)

To keep Taufolio running - to know that a page crashed, that a report failed to generate, or that a screen became unbearably slow - we use Sentry as our error and performance monitoring platform. Sentry acts as a processor on our behalf and stores data in its European Union region (Frankfurt, Germany).

Unlike product analytics, error monitoring is not consent-gated: it runs in every session, including one where you declined analytics consent. It is strictly limited to keeping the service secure, available, and correct; we do not use it to build a profile of you or to measure your behaviour.

What Sentry collects

When an error or performance problem occurs, Sentry may receive:

• the error's content, its type, and the technical stack trace pointing at the line of our code that failed
• the URL of the page you were on, and the URL of the previous page
• technical "breadcrumbs" from the moments before the error - for example "page opened", "button clicked", "network request returned an error" - recorded as element and endpoint names, not as content you typed
• your browser, operating system, device type, screen size, and language
• your IP address and the version of Taufolio you were using
• your Taufolio account identifier and the email address attached to your account, so we can tell whether one person hit an error ten times or ten people hit it once, and so we can reply to you about the reported issue without asking you to identify yourself again
• for a small sample of requests (10% by default, plus every report-generation request and scheduled job): performance traces recording how long a page or operation took. These include the duration of every database query, named only by table and operation - the values a query filters on are deliberately stripped before the measurement is sent. They also include the duration of every report-generation step and which model produced it, but never the prompt or the generated content

Because an error's content or page URL can incidentally contain an identifier - a ticker you were viewing, a report id - such identifiers can appear in an error record. We treat this data with the same confidentiality as the rest of your account data.

Bug reports you send us

If you report a bug from within the app, we attach technical identifiers for the session in which it occurred (a trace id, a link to the session recording where you consented to analytics, the page URL, your browser, and the app version), together with the text you wrote and the email address attached to your account. This lets us look at the actual bug instead of reconstructing it from a description.

What Sentry does NOT collect

We have deliberately configured Sentry so that it does not receive:

• request and response content: your portfolio contents, your holdings, purchase prices, notes, and uploaded files are never sent to Sentry
• session replay: Sentry does not record video-like playbacks of your session; we have turned this feature off
• passwords, authentication tokens, or payment-card data
• AI prompts or AI-generated report content

Legal basis

We process this data on the basis of our legitimate interest (GDPR Article 6(1)(f)) in running a secure, stable, working service and in detecting and fixing bugs and abuse. Error monitoring is necessary for us to deliver the service you signed up for, and it does not store on your device anything beyond what is technically necessary to send a report, so it does not depend on cookie consent. You can object to this processing on grounds relating to your particular situation - see section 12.

Routed through our own domain

Reports from your browser first go to taufolio.com/monitoring, and are forwarded to Sentry from there. This exists so that browser extensions and ad blockers do not silently suppress error reports; it does not change what is collected or who receives it.

Processor

• Functional Software, Inc. (Sentry), acting as our processor under a data processing agreement, processing data in the EU region.

Retention

Error and performance records are kept by Sentry for 90 days from collection, then automatically deleted.

7. When we share personal data

We may share personal data, to the extent necessary, with service providers and partners who help us run Taufolio, including categories such as:

• authentication providers, including Clerk
• payment providers, including Stripe
• database and infrastructure providers, including Supabase
• hosting, storage, and content-delivery providers
• email and notification providers
• product analytics, session replay, and web-vitals providers, currently PostHog (EU region) - see section 6a
• error and performance monitoring providers, currently Sentry (EU region) - see section 6b
• live chat (support) providers, currently tawk.to Inc. (United States), see the Cookie Policy
• AI model providers used for generating, translating, or processing report content and for the features described in section 8 (currently Google Cloud Vertex AI, OpenAI, and OpenRouter - an intermediary that routes our request to a model we choose from a variable set; additionally, when we configure the service to do so, Microsoft Azure OpenAI). We change providers and models without separate notice and do not publicly disclose which model handles which feature - email support@taufolio.com and we will tell you which providers we currently use. These providers act as processors and are bound by confidentiality obligations. We use their business-customer API access, not consumer products. Some Taufolio features also send these providers your portfolio data - section 8 (Scope of AI processing) describes exactly what, feature by feature.
• OCR (text-recognition) providers used to read uploaded files and source documents, currently Microsoft Azure Document Intelligence
• market-data and financial-information providers
• professional advisors, auditors, insurers, and legal counsel

We may also disclose personal data:

• where required by law, a court order, or a competent authority
• to establish, exercise, or defend legal claims
• in connection with a reorganisation, transfer, or sale of the business

We do not sell your personal data in the ordinary sense of that term.

8. Scope of AI processing

Taufolio uses external AI model providers. We want you to know exactly what reaches them, so we describe it feature by feature, rather than in one general sentence.

What reaches the model provider

Company reports, their translations, and summaries. Only public information about the company being analysed reaches the model provider: financial statements, earnings-call transcripts, market data, and similar public sources. The only input that comes from you is which company and which report type you asked for.

The assistant (chat). When you chat with the assistant, the model provider sees: the content of your messages; the companies in your portfolio and watchlist; the number of shares you hold, the average purchase price, and the currency of each position; the names you gave your portfolios, with their full path (if you put someone's name in a portfolio name, that name goes too); the history of changes the assistant made to your portfolio, up to 90 days back; your workspace's credit balance; and the titles and short summaries of your earlier conversations with the assistant. While you are on the Portfolio screen, the list of your holdings (up to 40) is attached to every turn of the conversation, even when you are not asking about your portfolio. Without this data, the assistant could not answer "how much have I made on this company" or add a position for you.

Monthly portfolio summary (email). The model provider receives the list of companies you hold, together with summaries of reports about them. We do not send share counts or purchase prices this way.

Portfolio gist. The model provider receives the amount and percentage change in your portfolio's value for the month, together with the currency, the number of your positions, the list of your companies with their earnings dates, and events relating to individual companies (for example open and closed items to watch). We do not send individual holdings with their quantities and purchase prices this way.

"Why did this move?" and the portfolio-move explainer. The model provider receives your portfolio's percentage result, the list of companies that moved, their percentage change and contribution to the result, the total number of your positions, and, where one company dominates, its percentage share of your portfolio's value. If you hold no positions, the model receives that fact too. We never send amounts, share counts, or purchase prices this way. This feature also uses the provider's own web search, so the queries the model builds from this data reach that search engine too.

Tracked threads. If you write, in your own words, what you want to watch for in a company, that text reaches the model provider exactly as you wrote it, together with the company's ticker and name. The resulting formulation is then sent to the model daily to check whether anything has happened, until you archive the thread.

What we never send

We never send AI model providers:

• your first name, last name, or email address from your profile
• passwords, login credentials, session and device identifiers
• payment-card data, invoices, or payment history
• your investor journal and personal notes

A caveat, to keep this sentence honest: it applies to data we pull from your account. If you type someone's name yourself into a message to the assistant, into a portfolio name, or into a tracked-thread description, that text is sent along with everything else, exactly as you wrote it.

Why we do this, and on what basis

We process this data because, without it, the features described above simply would not work - the legal basis is performance of a contract (GDPR Article 6(1)(b)).

You have the following control over the scope of this processing:

• The assistant: your portfolio data reaches the model only while you are chatting with the assistant.
• Monthly portfolio summary: you can turn it off in Settings (Notifications) or with one click in the email's own footer.
• Portfolio gist and "Why did this move?": these have no separate toggle, because they are only generated when you open the relevant screen or click the button. We do not generate them in the background.
• Tracked threads: you create them yourself; you stop them by archiving the thread, which also stops the daily send to the model.

You can also exercise the rights described in section 12 at any time, including the right to object and the right to erasure.

Who exactly receives this data

• Google Cloud Vertex AI (Google Cloud EMEA Limited / Google LLC).
• OpenAI (OpenAI, L.L.C., USA).
• Microsoft Azure OpenAI: a fallback provider; it receives data only when we route a specific model to it in the service configuration.
• OpenRouter (OpenRouter, Inc., USA) - an intermediary: it routes our request to a model we choose from a variable set. Some of these models run outside the European Economic Area, including in countries for which the European Commission has not issued an adequacy decision. Details are in section 9.

We do not publicly disclose which provider or which model handles which feature, and we change them without separate notice - sometimes overnight. Two things do not depend on that choice: the breakdown above of what each feature sends, and the rule that anything reaching a model should be treated as leaving the EEA. If you want to know which providers we currently use, email support@taufolio.com.

What providers can do with it

AI model providers act as processors, under a data processing agreement and a confidentiality obligation. We do not pass this data to anyone for marketing purposes, and we do not sell it.

We use business-customer API access, not consumer products. Individual providers' terms differ on how long they keep query content and whether they may use it to develop their own models; we will share the current position for a specific provider on request at support@taufolio.com. For models OpenRouter routes to, we do not restrict in the query which entities may handle it, so we cannot always say in advance which one will process a given request.

This is not investment advice

The assistant can see your portfolio, so its answers can be specific to your holdings. Even so, Taufolio does not provide investment advice and does not issue personal recommendations. We do not assess your financial situation, knowledge, or investment objectives, we do not carry out a suitability assessment, and we do not tell you what to buy or sell. The assistant's output is informational material that you evaluate yourself and use at your own risk.

Changes in scope

If we change the scope described above, we will update this section, raise this Policy's version number, and tell you about the change before it takes effect.

9. International data transfers

Some of our service providers may process personal data outside the European Economic Area.

Where personal data is transferred outside the EEA (for example to AI or infrastructure providers based in the US), we aim to apply an appropriate transfer mechanism and adequate safeguards, such as:

• adequacy decisions (e.g. the EU-US Data Privacy Framework)
• standard contractual clauses
• additional contractual, technical, or organisational measures where appropriate

AI model providers: where the data from section 8 goes

Assume that all the data described in section 8 is processed outside the EEA. We do not pin AI model processing to the European region, and we make no promise that we will.

• Google Cloud Vertex AI: a request may be handled in a Google data centre outside the EEA. Google acts as a processor under standard contractual clauses.
• OpenAI: a US-based company; data is processed on its servers outside the EEA, under standard contractual clauses.
• OpenRouter and the models it routes to. OpenRouter is a US-based intermediary: it routes our request to a model we choose from a variable set. Some of these models operate in countries for which the European Commission has not issued an adequacy decision. We rely on the standard contractual clauses in OpenRouter's terms, but we will say it plainly: this is a transfer of data outside the EEA, including to countries without an adequacy decision. Because we do not restrict in the query which entities may handle it, we cannot always say in advance which country will process it.

We change model providers and we don't announce it

We choose, and change, the provider and model for a given feature, because one turns out faster, cheaper, or more accurate. Such a change can happen overnight, we do not announce it separately, and we do not publicly disclose which model handles which feature. So instead we tell you what stays true regardless of who is handling a given request - and what matters about it: what goes out, and that it goes outside the EEA.

This applies above all to the "Why did this move?" feature. What it sends: your portfolio's percentage result, the list of companies that moved together with their percentage change and contribution to the result, the total number of your positions, and, when one company dominates, its percentage share of your portfolio's value. The purpose is to explain to you where your portfolio's move on a given day came from. Treat this data as transferred outside the EEA, including to a country without an adequacy decision. We never send amounts, share counts, or purchase prices this way - that does not depend on which provider we choose.

If this does not suit you: you can turn off the monthly summary in Settings, you can choose not to create tracked threads (and archive any existing ones), and "Why did this move?" and the portfolio gist are only generated when you open the relevant screen or click the button.

Our product-analytics provider (PostHog, section 6a) and our error-monitoring provider (Sentry, section 6b) are configured to store data in the European Union, so the data described in those sections is not routinely transferred outside the EEA. Both companies are registered in the US and may access data stored in the EU for support purposes, under standard contractual clauses.

10. Retention period

We keep personal data only for as long as is reasonably necessary for the purposes described in this Privacy Policy, including:

• to provide the service
• to maintain account history and purchased entitlements
• to comply with legal, tax, accounting, or reporting obligations
• to resolve disputes
• to enforce our agreements
• to investigate abuse, fraud, or security incidents

Specific retention periods

The following categories are kept on fixed schedules enforced by automated processes or our contractual commitments:

• Raw earnings-call transcripts and uploaded transcript files: deleted from storage 90 days after creation by an automated retention job. The text extracted to generate reports may be kept for as long as the resulting report, so there is no need to keep the raw file.
• Upload audit events (records of who uploaded a transcript or file, and when): deleted 90 days after creation by the same automated retention job.
• Error and performance monitoring records (see section 6b): kept by Sentry in the EU region for 90 days from collection, then automatically deleted.
• Account and workspace data (profile, membership, settings): kept for the life of the account and for a reasonable period after closure to complete the deletion process, resolve disputes, and comply with legal obligations.
• Generated reports and portfolio data: kept for the life of the account or the relevant workspace, or until the item is deleted, whichever comes first. On account closure they are deleted, subject to any legal hold.
• Billing, invoicing, and accounting records: kept for the period required by applicable tax and accounting law (in Poland, typically 5 years from the end of the tax year they relate to).
• Security, audit, and anti-abuse logs: kept only for as long as necessary to investigate incidents and abuse and for related legal or regulatory purposes.

Other categories are kept only for as long as is reasonably necessary for the purposes described above, taking into account applicable legal, tax, accounting, and security requirements.

11. Public sharing links

Taufolio lets users publish selected report output via public sharing links. If you choose to publish a report through a public sharing link, that report's content may become accessible to anyone who has the link.

Please do not publish confidential, sensitive, or personal data through public sharing links unless you accept having it shared this way.

12. Your rights under GDPR

Subject to applicable law and any relevant limitations, you have the following rights regarding your personal data:

• Right of access (GDPR Article 15): confirmation of whether we process personal data about you, and, if so, a copy of that data and related information.
• Right to rectification (GDPR Article 16): having inaccurate personal data corrected, or incomplete data completed.
• Right to erasure / "right to be forgotten" (GDPR Article 17): requesting deletion of personal data in the circumstances set out in GDPR.
• Right to restriction of processing (GDPR Article 18): requesting that we restrict how we process your data in certain circumstances.
• Right to data portability (GDPR Article 20): receiving the personal data you provided in a structured, commonly used, machine-readable format, and having it transferred to another controller where technically feasible.
• Right to object (GDPR Article 21): objecting to processing based on our legitimate interests, including profiling, where applicable.
• Right to withdraw consent (GDPR Article 7(3)): where processing is based on consent, withdrawing it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint with a supervisory authority (GDPR Article 77): filing a complaint with your local data-protection authority.

To exercise any of these rights, contact us at support@taufolio.com. We may need to verify your identity before acting on a request, and we will respond within the period required by applicable law.

If you are in Poland, you may also lodge a complaint with the President of the Personal Data Protection Office (UODO). Official contact details are available on the UODO website at https://uodo.gov.pl/.

13. Data security

We apply reasonable technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, or destruction.

No storage method, transmission method, or security measure, however, is completely secure. For that reason, we cannot guarantee absolute security.

14. Children's data

Taufolio is not intended for children, and we do not knowingly provide the service to children who, under applicable law, lack the capacity to enter into the relevant contract.

15. Third-party services

Taufolio may contain links to third-party websites, documents, market-data sources, or tools. We are not responsible for the privacy practices of those third parties.

15a. Affiliate referral-code attribution

If you sign up to Taufolio after clicking a referral link from one of our affiliates, or after entering a discount code assigned to an affiliate (see the Affiliate Program Terms), we record which code was used so we can pay the affiliate the agreed commission. Affiliates do not receive any personal data about referred users - they only see aggregated figures (e.g. number of sign-ups, number of paid conversions, and total commissionable revenue) in the affiliate dashboard. The discount code itself is linked to your subscription record for the duration of the commission relationship and is kept as part of our billing records in line with section 11 (Retention period).

16. Changes to this policy

We may periodically update this Privacy Policy to reflect changes to the service, to applicable law, or to our processing practices. When we do, we will update the "last updated" date on this page and, where appropriate, provide additional notice.

Any material change raises the version number shown at the top of this page and gets its own effective date; minor editorial fixes only change the last-updated date.

Version 2 (effective 20 August 2026). This version rewrote section 8 (Scope of AI processing) from scratch, expanded section 9 to cover transfers to AI model providers, and reorganised the provider list in section 7. The previous version said we only sent AI model providers public company information and that portfolio holdings were not shared with them. Since the assistant and the portfolio summaries launched, that stopped being true, and the document had not caught up. Section 8 now describes the actual state of affairs, feature by feature. This change is about the description and your control over these features; we did not expand the scope of data processed as part of it.

17. Contact

If you have questions about this Privacy Policy or about how we process personal data, contact us:

• Email: support@taufolio.com
• Postal address: Jacek Janczura, Adama Mickiewicza 73, 01-625 Warsaw, Poland