Privacy Policy
This notice describes how Value for Money collects, uses and protects your personal data.
1. Data Controller
The controller of personal data is Value for Money, with operating premises in Italy, reachable through the site valueformoney.it. For any request concerning the processing of personal data you can write to: info@valueformoney.it.
2. Personal Data Collected
We collect the following categories of data: registration data (email address, name); portfolio data (fund ISIN codes and the amounts invested); payment data (handled entirely by Stripe Inc.; we do not store card numbers); browsing data (IP address, browser type, pages visited, timestamp); technical cookies necessary for the service to work and, subject to your consent, Google Analytics 4 analytics cookies.
3. Legal Basis and Purposes of Processing
Data is processed on the basis of: performance of the contract (art. 6(1)(b) GDPR) to provide the portfolio analysis service, manage your account and process payments; legitimate interest (art. 6(1)(f) GDPR) to improve the service, prevent fraud and ensure security; legal obligation (art. 6(1)(c) GDPR) to comply with tax and regulatory duties. We do not use your data for direct marketing and we do not share it with third parties for promotional purposes. We also keep a copy of delivered reports in order to defend ourselves against possible disputes, again on the basis of legitimate interest (art. 6(1)(f) GDPR).
4. Data Retention
Portfolio data (ISINs and amounts) is kept for 30 days from generation of the report, after which it is deleted automatically. Account data is kept until you request its deletion. Billing data is kept for 10 years as required by Italian tax law. Browsing logs are kept for a maximum of 90 days. There is one exception: the report delivered to you following a payment. We keep a copy of it, together with the delivery date and the payment references, for ten years. We keep it for one reason only — to be able to show what was actually delivered to you and when, should a dispute arise — and we process it on that basis: legitimate interest in establishing, exercising or defending a legal claim (art. 6.1.f GDPR). The period matches the ordinary limitation period for contractual claims. This copy is not used for any other purpose: we do not analyse it, we draw no statistics from it, we do not share it with third parties. Reports for unpaid portfolios are not archived.
5. Your Rights
Under arts. 15-22 GDPR you have the right to: access your personal data and obtain a copy; rectify inaccurate or incomplete data; request erasure (right to be forgotten); restrict processing; request portability in a structured format; object to processing; withdraw consent at any time. To exercise these rights, write to info@valueformoney.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it). The right to erasure does not extend to the archived copy of the report delivered to you, for the period and to the extent we need it to defend a legal claim (art. 17(3)(e) GDPR). You may object to this processing at any time: we will assess your objection case by case and reply in writing.
6. Data Security
We adopt appropriate technical and organisational measures to protect your data: SSL/TLS encryption for all communications; secure storage on servers located in the European Union (Supabase, eu-west-1 region, Dublin); access restricted to authorised personnel; encrypted backups; secure authentication with password hashing.
7. Transfers Outside the EU
One processor is based in the United States: Stripe Inc. (payment processing). Transfers to this provider take place on the basis of the Standard Contractual Clauses approved by the European Commission and of certification under the EU-US Data Privacy Framework, ensuring a level of protection equivalent to the European one. Application hosting (Vercel) and the database (Supabase) are instead configured on servers located in the European Union (Dublin, Ireland).
8. Cookies and Tracking Technologies
We use technical cookies necessary for the site to work (authentication, language preferences) and, subject to your consent collected through the banner, Google Analytics 4 analytics cookies for usage statistics. Without consent no analytics cookie is set. We do not use profiling or marketing cookies. See our Cookie Policy, linked in the site footer, for details.
9. Sub-processors
To provide the service we rely on the following sub-processors: Supabase Inc. (database and authentication, EU servers); Vercel Inc. (hosting and CDN, EU servers; aggregate traffic and performance statistics through Web Analytics and Speed Insights); Stripe Inc. (payment processing, based in the USA); Aruba S.p.A. (transactional email delivery, servers in Italy). Each sub-processor handles data solely for the stated purposes and in compliance with the GDPR. We also use Google Ireland Limited for Google account sign-in and for Google Analytics 4, subject to consent.
10. Changes to this Privacy Policy
We reserve the right to update this notice. Changes will be published on this page, stating the date of the last update. In the event of material changes, we will notify registered users by email.
Last updated: September 2026