Privacy Policy
This notice describes how Value for Money collects, uses and protects your personal data.
1. Data Controller
The controller of personal data is Value for Money, with operating premises in Italy, reachable through the site valueformoney.it. For any request concerning the processing of personal data you can write to: info@valueformoney.it.
2. Personal Data Collected
We collect the following categories of data: registration data (email address, name); portfolio data (fund ISIN codes and the amounts invested); payment data (handled entirely by Stripe Inc.; we do not store card numbers); browsing data (IP address, browser type, pages visited, timestamp); technical cookies necessary for the service to work and, subject to your consent, Google Analytics 4 analytics cookies.
3. Legal Basis and Purposes of Processing
Data is processed on the basis of: performance of the contract (art. 6(1)(b) GDPR) to provide the portfolio analysis service, manage your account and process payments; legitimate interest (art. 6(1)(f) GDPR) to improve the service, prevent fraud and ensure security; legal obligation (art. 6(1)(c) GDPR) to comply with tax and regulatory duties. We do not use your data for direct marketing and we do not share it with third parties for promotional purposes.
4. Data Retention
Portfolio data (ISINs and amounts) is kept for 30 days from generation of the report, after which it is deleted automatically. Account data is kept until you request its deletion. Billing data is kept for 10 years as required by Italian tax law. Browsing logs are kept for a maximum of 90 days.
5. Your Rights
Under arts. 15-22 GDPR you have the right to: access your personal data and obtain a copy; rectify inaccurate or incomplete data; request erasure (right to be forgotten); restrict processing; request portability in a structured format; object to processing; withdraw consent at any time. To exercise these rights, write to info@valueformoney.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (www.garanteprivacy.it).
6. Data Security
We adopt appropriate technical and organisational measures to protect your data: SSL/TLS encryption for all communications; secure storage on servers located in the European Union (Supabase, eu-west-1 region, Dublin); access restricted to authorised personnel; encrypted backups; secure authentication with password hashing.
7. Transfers Outside the EU
Some processors are based in the United States: Stripe Inc. (payment processing) and Resend (transactional email). Transfers to these providers take place on the basis of the Standard Contractual Clauses approved by the European Commission and of certification under the EU-US Data Privacy Framework, ensuring a level of protection equivalent to the European one. Application hosting (Vercel) and the database (Supabase) are instead configured on servers located in the European Union (Dublin, Ireland).
8. Cookies and Tracking Technologies
We use technical cookies necessary for the site to work (authentication, language preferences) and, subject to your consent collected through the banner, Google Analytics 4 analytics cookies for usage statistics. Without consent no analytics cookie is set. We do not use profiling or marketing cookies. See our Cookie Policy, linked in the site footer, for details.
9. Sub-processors
To provide the service we rely on the following sub-processors: Supabase Inc. (database and authentication, EU servers); Vercel Inc. (hosting and CDN, EU servers); Stripe Inc. (payment processing, based in the USA); Resend (transactional email delivery, based in the USA). Each sub-processor handles data solely for the stated purposes and in compliance with the GDPR. We also use Google Ireland Limited for Google account sign-in and for Google Analytics 4, subject to consent.
10. Changes to this Privacy Policy
We reserve the right to update this notice. Changes will be published on this page, stating the date of the last update. In the event of material changes, we will notify registered users by email.
Last updated: February 2026