Privacy Policy

1. Who is responsible for your data?

The data controller for Veldran is:

You may contact this address for questions regarding this Privacy Policy or the processing of your personal data.

2. Data we collect

Depending on the features you use, Veldran may process the following categories of information.

Account and identity information

This may include:

• email address;
• name and profile image when provided through Google authentication;
• authentication and account information;
• language preference;
• workspace memberships and roles;
• account status and related technical identifiers.

When email/password authentication is used, Veldran stores a password hash rather than your plaintext password.

Financial and wealth information

Information you manually enter, import or connect may include:

• investment accounts and portfolios;
• assets and securities;
• quantities and positions;
• purchase prices and cost bases;
• current and historical valuations;
• currencies;
• investment income and dividends;
• bank or cash balances entered into Veldran;
• properties and real-estate information;
• liabilities and loans;
• income and budget information;
• financial goals;
• net-worth and performance history.

Some of this information can be particularly sensitive from a financial privacy perspective.

Brokerage information

If you choose to connect a brokerage account through SnapTrade, Veldran may receive information such as:

• brokerage or institution name;
• account identifiers and account type;
• account currency;
• balances;
• securities and instrument identifiers;
• quantities;
• prices;
• cost bases;
• market values;
• brokerage connection status.

Veldran uses SnapTrade to facilitate brokerage connectivity.

Veldran does not ask you to provide your brokerage password directly to Veldran.

Disconnecting a brokerage connection does not automatically delete portfolio data that has already been imported into Veldran. This allows users to keep their portfolio history after disconnecting a provider.

Deleting an eligible Veldran account deletes the associated private workspace data according to Veldran's account-deletion process.

Portfolio screenshots

If you voluntarily use Veldran's image-based portfolio import feature, screenshots you upload are transmitted to OpenAI's API for automated extraction of portfolio information.

Screenshots may contain financial information such as institution names, holdings, balances, quantities, prices or other information visible in the image.

Veldran does not intentionally persist the original screenshot after this processing in the current implementation.

According to OpenAI's API data policies, API inputs and outputs are not used to train OpenAI models by default. OpenAI may retain API inputs and outputs for a limited period for service provision and abuse monitoring, subject to the applicable OpenAI API configuration, policies and legal requirements.

Users should avoid including unrelated personal information in screenshots.

Payments and subscriptions

If you purchase a paid Veldran subscription, payment processing is handled by Stripe.

Veldran may provide Stripe with information required to manage the subscription, such as:

• email address;
• internal workspace identifier;
• subscription plan and billing information.

Payment-card details are collected and processed through Stripe's payment infrastructure and are not intentionally stored by Veldran.

Veldran stores identifiers and subscription metadata needed to manage your subscription.

Feedback and collaboration

If you use collaboration, invitations, public sharing or feedback features, Veldran may process:

• workspace names;
• invitation email addresses;
• membership roles;
• feedback titles and descriptions;
• votes;
• public-sharing preferences;
• display names and sharing tokens.

3. How we obtain your data

We receive information:

• directly from you;
• when you use Veldran;
• through authentication providers such as Google;
• from brokerage connections you authorize through SnapTrade;
• from payment services such as Stripe;
• from financial and market-data providers;
• from information generated as part of operating and securing the service.

4. Why we use your data

Veldran processes information where necessary to:

• create and authenticate your account;
• provide portfolio and wealth-tracking functionality;
• synchronize brokerage information you request;
• calculate portfolio values, allocations, income and financial indicators;
• process portfolio imports;
• manage subscriptions and payments;
• provide collaboration and workspace functionality;
• provide public sharing when you explicitly enable it;
• answer feedback and support requests;
• maintain the security and integrity of the service;
• diagnose technical problems;
• prevent misuse or unauthorized access;
• comply with applicable legal obligations.

Where applicable under data-protection law, processing may rely on:

• performance of the service requested by you;
• legitimate interests in operating, securing and improving Veldran;
• compliance with legal obligations;
• your consent where consent is specifically required.

5. Financial-data and market-data providers

Veldran uses external data providers to retrieve or enrich financial information.

Current providers may include:

• Twelve Data;
• Marketstack;
• Massive;
• the U.S. Securities and Exchange Commission (SEC).

Depending on the feature, Veldran may send instrument-related information such as ticker symbols, exchange identifiers, instrument identifiers, currency pairs or requested date ranges.

These requests are intended to obtain market or reference data. Veldran does not intentionally include your Veldran user identifier in these market-data queries unless required for the operation of a particular service.

The SEC is used as a public financial/reference-data source and is not presented as a Veldran payment, authentication or brokerage processor.

6. Service providers

Veldran relies on third-party services to operate the application.

These currently include:

• Vercel — application hosting and execution;
• Supabase — PostgreSQL database infrastructure;
• Google — optional Google authentication;
• SnapTrade — brokerage connectivity;
• Stripe — payment and subscription processing;
• Resend — transactional email;
• OpenAI — optional image-based portfolio extraction;
• Twelve Data — financial and market data;
• Marketstack — financial and market data;
• Massive — financial and dividend data.

These providers may process information necessary to perform their respective services.

They operate under their own contractual, privacy and data-retention obligations.

7. Cookies and local storage

Veldran currently uses technical and preference storage required for the service, including:

• authentication/session cookies;
• an active-workspace cookie;
• a language-preference cookie;
• browser local storage for the light/dark theme preference.

Veldran does not currently implement advertising trackers or advertising pixels.

No dedicated third-party product analytics platform is currently implemented.

If Veldran introduces optional analytics, advertising technologies or other non-essential tracking in the future, this Policy and any required consent mechanism will be updated accordingly.

8. International data transfers

Veldran is operated from France, but some service providers operate internationally.

As a result, personal data may be processed outside France or the European Economic Area, including in the United States.

Where required by applicable data-protection law, relevant providers may rely on recognized transfer mechanisms such as adequacy decisions, the EU-U.S. Data Privacy Framework, Standard Contractual Clauses or other legally recognized safeguards.

The precise mechanism may depend on the provider and service configuration.

9. Data retention

Veldran retains personal information for as long as reasonably necessary to provide the service and for the purposes described in this Policy.

Retention may also be necessary for:

• security;
• fraud or abuse prevention;
• dispute resolution;
• legal obligations;
• accounting or payment-related requirements.

Veldran does not claim a fixed retention period where no such automated retention policy is currently implemented.

Third-party providers may apply their own retention requirements.

10. Account deletion

Eligible users can request account deletion through Veldran's account settings.

Account deletion is permanent.

Where deletion can proceed, Veldran removes the user's private workspaces and associated Veldran financial data, including associated portfolio records, properties, liabilities, budgets, goals, history and public-sharing configuration.

Memberships in workspaces owned by another user are removed without deleting the shared workspace's financial data.

If a user owns a workspace containing other members, account deletion is blocked until ownership or membership of that workspace has been resolved.

For deleted private workspaces:

• active Stripe subscriptions are cancelled where applicable;
• SnapTrade brokerage authorizations are disabled where applicable;
• locally stored SnapTrade credentials and workspace brokerage records are deleted.

Some information may remain outside Veldran where a third-party provider has its own legal or contractual retention obligations.

For example, Stripe may retain historical payment and billing records under its own requirements.

Certain administrative audit records may also prevent immediate self-service deletion where retention is required by Veldran's current audit architecture. Affected users may contact Veldran for assistance.

11. Public sharing

Veldran may allow users to create public portfolio links.

Financial information is not intended to become public through this feature unless the user explicitly enables sharing and selects the relevant visibility options.

Users are responsible for reviewing the information they choose to make public.

Public sharing can be disabled or its access token regenerated.

12. Security

Veldran uses technical and organizational measures intended to protect personal information against unauthorized access, alteration, disclosure or destruction.

These include measures such as authentication controls, access restrictions, encrypted transport, server-side authorization checks and protection of provider credentials.

No internet service can guarantee absolute security.

13. Your privacy rights

Depending on your location and applicable law, you may have rights concerning your personal data, including rights to:

• access your data;
• correct inaccurate data;
• request deletion;
• restrict certain processing;
• object to certain processing;
• receive certain data in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a competent data-protection authority.

Users in France and the European Economic Area may exercise rights available under the General Data Protection Regulation (GDPR).

In France, users may also contact the Commission Nationale de l'Informatique et des Libertés (CNIL).

Requests may be sent to:

Veldran may need to verify the requester's identity before processing certain requests.

14. Users under 18

Veldran is intended for adults aged 18 or older.

The service is not intended for children or minors under 18.

If Veldran becomes aware that personal data has been collected from a person under 18 contrary to this requirement, appropriate steps may be taken to remove it.

15. Changes to this Policy

Veldran may update this Privacy Policy when the service, its providers, applicable law or data-processing practices change.

The current version and its last-updated date will remain available on this page.

Material changes may be communicated through the service where appropriate.

16. Contact

For privacy questions or requests concerning personal data: