InvestAssist uses a small amount of personal data to run your account, maintain your watchlist and preferences, produce My Brief, and operate the private beta.
- We do not sell your personal data.
- We do not share your watchlist, ownership status, or monitoring intents with advertisers, brokers, or data brokers.
- We use cookieless Vercel Web Analytics for aggregate website understanding. It does not use a persistent browser identifier or track you between different days or websites. There is no Google Analytics, Meta Pixel, LinkedIn Insight Tag, session replay, or advertising tracker on our website.
- Inside the signed-in portal, we record only limited product-engagement events needed to evaluate the beta, such as whether and when My Brief was viewed. We do not build a detailed browsing profile.
- We do not measure whether you open or click links in emails in the current beta. We may record delivery events such as delivered, bounced, or failed so we can operate email delivery.
- Mailchimp is used only for marketing email recipients. If you do not opt into marketing, we do not add you to our Mailchimp marketing audience.
- No card is required for the free trial. If you actively subscribe, our payment provider processes payment details; InvestAssist does not store raw card details.
- You can delete your account through the product. For access, portability, or other privacy requests, contact hello@invest-assist.com.
The sections below give the full details.
1Who is responsible for your data
InvestAssist, a Dutch sole proprietorship (eenmanszaak) based in Amsterdam, The Netherlands, is the data controller for personal data processed through the service.
Registration: KVK registration pending.
Business address: Korte Lijnbaanssteeg 1-4551, 1012 SL Amsterdam, The Netherlands.
Contact for privacy questions and requests: hello@invest-assist.com
We have not appointed a Data Protection Officer because we do not currently consider one to be legally required for this small private-beta operation.
2What we collect
Information you give us or configure
| Data | Why we use it |
|---|---|
| Email address | To create and secure your account, communicate with you, and send brief emails if you enable them |
| Display/profile name, if provided | To identify or address you in the product or communications |
| Country and time zone | To configure your account and support time-sensitive product behaviour |
| Watchlist instruments | To provide the monitoring service |
| Ownership status for an instrument, such as owned or watching | To apply the product’s structured monitoring rules |
| Monitoring/management intent selected for an instrument | To determine which predefined condition families are relevant to that instrument |
| Mute and other condition-display preferences | To decide whether an otherwise eligible condition should be shown to you |
| Brief email preference | To know whether to send My Brief by email |
| Marketing preference | To know whether you want optional marketing emails |
| Recognised signup link parameters (UTM source, medium, campaign, content, term, and referral code) and your answer to “How did you hear about InvestAssist?” | To understand which attributable signup journeys produce accounts and onboarding, without persistent anonymous tracking |
| Records of Terms/legal acceptance and beta access status | To operate the private beta and demonstrate the terms under which an account was created or enabled |
| Support messages and beta feedback | To respond to you and improve the product |
Our Terms require users to be 18 or over. We keep the relevant acceptance record; we do not ask for or store your date of birth unless there is a specific reason to verify eligibility.
Information we receive through authentication
If you use Google sign-in, Google provides the account information needed for authentication, such as your email address and basic account identity information according to the permissions shown in the Google sign-in flow.
If you use email/password, authentication credentials are handled by our authentication provider. InvestAssist does not have access to your plaintext password.
Information collected automatically when you use the service
| Data | Why we use it |
|---|---|
| IP address, request metadata, browser/device information, timestamps, and operational logs | Security, abuse prevention, authentication, troubleshooting, and keeping the service available |
| Sign-in and authentication events | Account security and troubleshooting |
| Email delivery events such as delivered, bounced, or failed | To operate email delivery and diagnose problems |
| Limited signed-in product-engagement events, such as a My Brief view timestamp | To measure whether the beta product is actually being used and to evaluate product engagement |
| Cookieless aggregate page views, referrer, approximate location, and browser/device category | To understand aggregate use of the public website and public login/signup pages; Vercel’s daily visitor hash is not retained across days or websites |
We do not ask for your brokerage credentials, brokerage account balance, exact position size, income, net worth, or national identification number. Payment details are requested only by our payment provider if you actively choose to subscribe.
We collect the country and time zone you provide, but we do not ask for precise GPS location. Like most online services, infrastructure providers may infer an approximate location from an IP address for security, routing, or fraud-prevention purposes.
3Why we use personal data, and our legal basis
| Purpose | Main data involved | Legal basis under GDPR Article 6 |
|---|---|---|
| Creating and running your account and providing the portal | Account identity, country/time zone, watchlist, ownership status, monitoring intents, preferences | Performance of the contract, Art. 6(1)(b) |
| Producing My Brief and applying your configured condition-display preferences | Watchlist, ownership status, monitoring intents, mute preferences | Performance of the contract, Art. 6(1)(b) |
| Sending brief emails when you enable them | Email address, brief content, brief-email preference | Performance of the contract, Art. 6(1)(b) |
| Important account/service notices | Email address | Performance of the contract, Art. 6(1)(b), and where applicable legal obligation, Art. 6(1)(c) |
| Support and beta feedback you choose to send us | The information you provide | Our legitimate interests in operating, troubleshooting, and improving the beta, Art. 6(1)(f); and consent where we expressly rely on it for an optional research activity |
| Security, abuse prevention, troubleshooting, and service reliability | IP/request logs, device/browser data, sign-in events | Legitimate interests, Art. 6(1)(f) |
| Limited beta/product engagement measurement inside the signed-in portal | Account identifier and limited events such as My Brief viewed + timestamp | Legitimate interests, Art. 6(1)(f): understanding whether the beta is being used and improving the product, using a deliberately limited event set rather than broad behavioural analytics |
| Aggregate cookieless website analytics and account-level signup attribution | Aggregate page views/referrers and recognised UTM/referral fields plus the optional detail you provide | Legitimate interests, Art. 6(1)(f): understanding acquisition effectiveness while avoiding analytics cookies, persistent anonymous identifiers, and cross-site tracking |
| Marketing emails | Email address and, if used, name | Consent, Art. 6(1)(a) |
| Demonstrating consent, Terms acceptance, or defending legal claims | Relevant consent/acceptance records and correspondence | Legal obligation where applicable and/or legitimate interests, Art. 6(1)(c) and 6(1)(f) |
You have the right to object to processing based on legitimate interests. Contact hello@invest-assist.com. We will consider your objection in light of the purpose, necessity of the processing, and your rights and interests.
4What we deliberately do not do
We run only cookieless aggregate Vercel Web Analytics on the public marketing website and public login/signup pages. There is no Google Analytics, advertising pixel, session replay, heatmapping, persistent anonymous identifier, or cross-site marketing tracker on the InvestAssist website.
The signed-in portal is different: we record a small, first-party set of account events, such as whether and when My Brief was viewed, so we can measure beta engagement. We do not use that data to build advertising profiles, follow you across websites, or reconstruct a detailed browsing history.
We do not use your watchlist or ownership information for advertising. We do not sell it, provide it to brokers or data brokers, or use it to target third-party advertisements.
We do not use your personal data to train models that are sold, shared, or licensed to other organisations.
5Beta feedback and optional research
The private beta exists so we can learn where InvestAssist works and where it fails. Our Terms of Service explain that we ask beta users to report things that look odd, incorrect, or broken and to complete a short survey about two weeks after access begins. Providing that feedback is not a contractual condition of using InvestAssist.
If you choose to send feedback, we use it to respond to issues, evaluate the beta, and improve the product. Our main legal basis for ordinary beta feedback is our legitimate interests in operating, troubleshooting, and improving the service.
We may also invite you to optional interviews, additional surveys, research sessions, testimonials, or other studies. Participation is voluntary. Where we rely on consent for a particular activity, you can decline or withdraw that consent without losing ordinary access to the service.
We may report beta or research findings in aggregated or anonymised form. We will not identify you publicly without a separate lawful basis, and where appropriate your explicit consent.
Earlier pilot data. Data from earlier InvestAssist pilots is handled under the terms and privacy information that applied to those pilots and applicable law. If you took part and want to ask about it or request deletion, email hello@invest-assist.com.
6Email delivery
We may record whether an email was sent, delivered, bounced, or failed. These are operational delivery events used to run email delivery and diagnose problems; they do not tell us whether you actually read the message.
In the current beta, InvestAssist does not use tracking pixels to measure email opens and does not use tracked links to measure clicks in Brief emails or marketing emails.
Service and account notices are sent where needed to operate your account. Brief email delivery is optional and controlled through your settings. Marketing email is separate and is sent only if you opt in.
7Who receives personal data
We use a small number of providers to run InvestAssist. They may process personal data on our behalf under contractual and data-protection obligations. The exact provider may change as the beta develops; when a material change affects your privacy, we update this notice.
| Provider/category | What they do | Main data involved |
|---|---|---|
| Vercel | Hosts the marketing website and web portal, handles web requests, and provides cookieless aggregate Web Analytics | IP/request metadata, application traffic, operational logs, aggregate page-view/referrer/device data, and a visitor hash that resets daily |
| Supabase | Database and authentication | Account/profile data, watchlist, ownership status, monitoring intents, preferences, authentication data |
| Optional Google sign-in when you choose it | Authentication identity data needed for Google OAuth | |
| Amazon Web Services (AWS) | Runs parts of the monitoring/data-processing infrastructure | Instrument configuration and system data needed to generate the service; operational logs |
| Resend or another configured service-email provider | Sends service/brief emails | Email address, message content, and operational delivery events |
| Intuit Mailchimp | Sends optional marketing emails | Email address, marketing consent/subscription data, message content, and operational delivery events |
| Twelve Data | Supplies market data | Instrument identifiers/symbols and server-side request metadata; we do not send Twelve Data your InvestAssist email address, account ID, ownership status, or monitoring intent as part of ordinary market-data requests |
If you have not opted into marketing, we do not add you to our Mailchimp marketing audience.
No payment method is required for the 45-day trial. If you actively choose a paid subscription, our payment provider processes the payment and supplies InvestAssist with limited subscription and transaction status needed to administer access.
We may disclose personal data where law requires it, for example in response to a valid order or request from a competent authority. Where legally permitted and appropriate, we will tell you.
We do not share personal data with advertisers, advertising networks, data brokers, or brokers for their own marketing or commercial use.
If InvestAssist is sold, merged, or reorganised, personal data may be transferred as part of that transaction where lawful. We will provide information or notice where required.
8International transfers
Some providers are established outside the European Economic Area or may process data there. Where GDPR transfer rules apply, we use an available lawful transfer mechanism, such as:
- an applicable European Commission adequacy decision, including the EU-US Data Privacy Framework where a relevant recipient is validly certified;
- the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where needed; or
- another transfer mechanism permitted by applicable data-protection law.
We do not rely on your consent as the routine legal mechanism for international transfers.
You can contact hello@invest-assist.com for more information about the transfer safeguards relevant to a particular provider.
9How long we keep personal data
We keep personal data only for as long as reasonably necessary for the purpose for which it is used, including operating the beta, security, troubleshooting, demonstrating consent/acceptance, resolving disputes, and complying with legal obligations.
Our current retention approach is deliberately small:
| Data | Retention approach |
|---|---|
| Active account, profile, watchlist, ownership status, monitoring intents, and preferences | Kept while your account is active. After account closure, live application data is deleted without undue delay, normally within 30 days, unless we must retain specific records for another lawful reason. |
| Operational, authentication, and security logs | Kept only for the period reasonably needed for security, troubleshooting, abuse prevention, and provider operations; we do not use them for advertising. |
| Limited signed-in product-engagement events, such as My Brief viewed | Kept during the beta and for a limited period afterwards to evaluate engagement, then deleted or aggregated so they are no longer tied to an identifiable account. |
| Email delivery events | Kept for as long as reasonably needed to operate delivery, troubleshoot problems, and maintain necessary records; older data may be deleted or aggregated where appropriate. |
| Support and beta feedback | Kept for as long as needed to resolve the issue and evaluate the beta, then deleted, anonymised, or aggregated where appropriate. |
| Consent and Terms-acceptance records | Kept for as long as reasonably necessary to demonstrate what you agreed to and to meet legal/accountability requirements, including for a period after withdrawal or account closure where needed. |
| Backups | Deleted data may remain temporarily in encrypted or access-controlled backups until the relevant backup is overwritten according to the provider’s backup cycle. |
If we later begin taking payments, financial and tax records may need to be retained for statutory periods. We will update this policy before paid processing applies to you.
10Automated processing
InvestAssist applies deterministic, rule-based logic to market data and the structured monitoring choices attached to an instrument. The underlying calculation is not an assessment of your creditworthiness, risk tolerance, financial situation, or personal suitability.
We do not make solely automated decisions about you that produce legal effects or similarly significant effects within the meaning of Article 22 GDPR. InvestAssist produces information; it does not execute a transaction or make a binding financial decision on your behalf.
11Your rights
Depending on the circumstances, GDPR gives you rights including:
- Access — ask for a copy of personal data we hold about you
- Rectification — correct inaccurate personal data
- Erasure — ask us to delete personal data where the legal conditions are met
- Restriction — ask us to restrict certain processing
- Portability — receive certain data you provided in a structured, commonly used, machine-readable format where the right applies
- Object — object to processing based on legitimate interests, and object at any time to direct marketing
- Withdraw consent — withdraw consent for future processing where consent is the legal basis
Some account information and preferences can be changed directly in the portal, and account deletion is available through the product. The MVP does not promise a self-service data-export feature. To exercise access, portability, restriction, objection, or another privacy right, email hello@invest-assist.com.
We normally respond within one month. If a request is complex or numerous, GDPR may allow an extension; if that applies, we will tell you.
We may need to verify your identity before acting on a request and will ask only for information reasonably necessary for that purpose.
Complaints. You can also complain to the Dutch data-protection authority:
If GDPR gives another supervisory authority jurisdiction, you may also have the right to complain there.
12Security
We use technical and organisational measures appropriate to a small online beta service. These include measures such as encrypted HTTPS/TLS connections, access controls, authentication controls, and security features provided by our hosting, database, and cloud providers.
InvestAssist currently supports email/password and Google sign-in. Password authentication is handled by our authentication provider; we do not have access to your plaintext password.
We never ask for your brokerage login credentials and do not connect to your brokerage account. InvestAssist does not store raw payment-card data.
No online service can guarantee perfect security. If a personal-data breach occurs, we will assess it and meet applicable notification obligations, including notifying the Autoriteit Persoonsgegevens and affected individuals where GDPR requires it.
13Children
InvestAssist is for adults. You must be 18 or over to use it. We do not knowingly offer accounts to children. If you believe a child has created an account or provided personal data, contact hello@invest-assist.com.
14Cookies and similar technologies
On the InvestAssist marketing site and portal, we use only storage that is necessary for authentication, security, and requested product functionality. We do not use advertising cookies or marketing-site analytics cookies.
Vercel Web Analytics does not use a cookie or persistent browser identifier. Its visitor hash resets daily and cannot be used by InvestAssist to follow a visitor across websites.
The limited signed-in My Brief view event described in this policy is recorded server-side as account activity; it does not require us to place an optional analytics cookie or advertising tracker on your device.
We do not use email tracking pixels or tracked-link analytics in the current beta.
See our Cookie Policy for more detail.
15Other websites and sign-in providers
Our site may link to other websites, and choosing Google sign-in takes you through Google’s authentication service. Those third parties process data under their own privacy notices for activities they control. InvestAssist is not responsible for unrelated processing on third-party websites.
16Changes to this policy
We may update this Privacy Policy as the beta and our processing change. If a change materially affects how we use your personal data, we will provide appropriate notice before the change where required by law.
This Privacy Policy is a notice, not a contract. You are not asked to consent to the policy as a whole. Where a particular processing activity requires consent, such as marketing, we ask for that consent separately.
We keep dated copies of previous versions and will provide one on request.
17Contact
Version history: v1.0 13 January 2026 · v2.0 19 August 2026