Privacy & RODO Policy

§01Who we are (data controller)

MyTradeWorld is the controller of the personal data described in this policy. For any privacy question or to exercise a right, contact us at privacy@mytradeworld.pl. Full company and registration details are provided on request.

§02Data we collect

We process only what the service needs to function:

• Account email, used for authentication and managed through Supabase Auth.
• Profile details you set: a display name and your base currency.
• Your financial ledger, meaning the transactions, holdings, and portfolios that result from the records you import.
• Uploaded statement files, staged transiently during an import. Once an import is committed or discarded, the original uploaded file is removed; only the reconciled ledger entries remain.

§03How and why we use it

We use your data to provide the service you asked for: valuing your holdings in PLN, computing returns, and producing an indicative tax estimate. We do not sell your data, and we do not use it for advertising or profiling.

Our legal bases under RODO/GDPR are the performance of our contract with you (Article 6(1)(b), to deliver the service) and our legitimate interest (Article 6(1)(f)) in keeping the service secure and maintaining an audit trail. Where a future feature relies on consent, we will ask for it separately and you can withdraw it at any time.

§04Processors and sub-processors

We rely on a small number of infrastructure providers who process data on our behalf under data-processing agreements:

• Supabase for the database, authentication, and file storage.
• Vercel for application hosting.

Where the configuration allows it, data is processed on EU-region infrastructure.

§05Cookies

We use only strictly necessary cookies, for authentication and maintaining your session. We do not use analytics, advertising, or tracking cookies, so there is nothing to opt into beyond signing in.

§06Retention and security

We keep your data while your account is active. When you delete your account, your ledger and profile data are removed. Uploaded statement files are transient and are removed as soon as an import is committed or discarded.

Each user’s data is isolated at the database level using row-level security, so one account cannot read another’s records. Changes to your data are recorded in an append-only audit log that supports security review and helps us trace how a figure was produced.

§07Your rights under RODO/GDPR

You have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected (rectification);
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format (portability/export);
• lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO).

§08International transfers, changes, and contact

If data is ever transferred outside the European Economic Area, we will rely on a lawful transfer mechanism, such as the European Commission standard contractual clauses.

We may update this policy as the service changes. Material updates will be reflected in the “last updated” date above and, where appropriate, flagged in the app. For any privacy matter, contact privacy@mytradeworld.pl.