Invesaro
Invesaro

Privacy policy

What data Invesaro processes, why, for how long, and what your rights are.

Last changed: 2026-10-04

1. Who processes your data

The controller of your personal data is Devation Karol Sobota, ul. Narwik 12/19, 01-471 Warsaw, Poland, tax id (NIP) 5223214054, REGON 520532390, which runs invesaro.com ("Invesaro", "we"). For anything about your data, write to invesaro@gmail.com.

2. What we collect and why

  • Account. Your email address, a hash of your password (never the password itself), and if you sign in with Google, your Google account id and name where Google provides it. Also the language you use the site in and the date of your last sign-in. Basis: performance of the account contract (Art. 6(1)(b) GDPR).
  • Newsletter. Email address, language and the date of confirmation. We send new theses and verdicts. Basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw with one click in every message or in your account settings.
  • Alerts on followed theses. Which theses you follow and whether you want email about them. Basis: contract. Switch them off in settings or through the link in every mail.
  • Payments. A customer id and subscription status in Stripe. Card details go to Stripe only; we never see them. Basis: contract and accounting obligations (Art. 6(1)(c) GDPR).
  • Broker connection (optional, Pro). If you connect a brokerage account, you do it in a SnapTrade window (Passiv Inc.), not on our site: we never see or store your broker login or password. The connection is read-only; we never place orders. SnapTrade passes us the broker name, account names and the last digits of their numbers, the currency, positions (shares and average cost) and the transaction history (buys, sells, dividends, fees), from which we build your portfolio. We keep your SnapTrade user id and its key, encrypted. Basis: performance of the contract, at your request. Remove the connection at any time in the portfolio view; deleting your account also deletes your data at SnapTrade.
  • Our own cookieless visit measurement. Every page sends our server a short page-view note: the page address, the site you came from (domain only), utm tags from the link, the page and browser language, a rough screen width and the device type read from the browser, and for a few steps (opening signup, signing up, clicking Follow or the trial, checkout, newsletter signup) just the name of that step. It uses no cookies or browser storage and no device fingerprint. The IP address is never stored: to count unique visitors, the server makes a hash of the IP address, the browser and a random value that changes every day; that value is deleted when the day ends, so the hash cannot be linked to you or to visits on other days. Automated traffic (bots, data-centre addresses) is flagged and left out of the statistics. The data identifies no one and is not shared with anyone. Basis: legitimate interest (knowing which pages are read and where readers come from).
  • Google statistics. Google Analytics 4 with IP anonymisation, loaded only after you agree in the banner. Basis: consent. Without it the Google script is not loaded at all.
  • Server logs. IP address, browser and requested address, kept briefly for security and troubleshooting. Basis: our legitimate interest (Art. 6(1)(f) GDPR).

3. Who we share it with

We do not sell data. We use processors that handle it on our behalf: Stripe (payments), Google (sign-in and, with consent, statistics), Brevo (email delivery), SnapTrade (Passiv Inc., broker connection, only if you turn it on) and the provider hosting the server the site runs on. Some of them may process data outside the European Economic Area under standard contractual clauses or an adequacy decision.

4. For how long

Account data: until you delete the account, which you can do yourself in settings. Newsletter: until you unsubscribe. Accounting records of payments: as long as tax law requires. Google Analytics: according to Google's retention setting, no longer than 14 months. Our own visit measurement: single page views for 90 days, after which only daily totals remain (such as the number of views of a page), kept for up to two years.

5. Your rights

You have the right to access, rectify, erase, restrict, port and object to the processing of your data. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You can lodge a complaint with your supervisory authority; in Poland that is the President of the Personal Data Protection Office (uodo.gov.pl). Delete your account yourself in settings; for everything else, write to the address above.

6. Cookies and browser storage

  • lang: a cookie remembering your language, valid one year. Strictly necessary.
  • Session token in your browser's local storage, which keeps you signed in. Strictly necessary.
  • Your analytics choice in local storage, so the banner does not ask again. Strictly necessary.
  • Google Analytics cookies: only after consent. To change your choice, clear the site's data in your browser and the banner will appear again.

7. Changes

When this policy changes, the date at the top changes with it. Signed-in users are told about material changes by email.