Privacy policy

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)

a. Account and Authentication Data Security

What we collect:

• Email address
• Login metadata (e.g., timestamp, method)
• Authentication info (Google OAuth or Magic Link)
• A pseudonymous internal user ID

Why we collect it:

To create and manage your account, authenticate access securely, and prevent unauthorized use of the platform.

b. Billing and Subscription Data Billing

What we collect:

• Name (for invoicing, if provided)
• Billing address and country
• VAT number (if applicable)
• Payment metadata (via Stripe)

Why we collect it:

To process payments, issue legally compliant invoices, meet tax obligations, and provide customer support for billing.

c. Technical and Security Data Monitoring

What we collect:

• IP address
• Browser type and version
• Device and OS
• Login attempts and access timestamps
• CAPTCHA/bot check signals

Why we collect it:

To detect fraud, secure user accounts, optimize service performance, and protect against denial-of-service attacks or unauthorized access.

d. Operational Logs and Usage Metrics Analytics

What we collect:

• Feature usage (e.g., dashboard interactions)
• Timestamped system events
• Error and exception logs

Why we collect it:

To monitor platform health, debug technical issues, and understand which features are worth building on. Inside the app these are explicit events only: we record that a feature was used, never the contents of your portfolio. If you accepted the banner on turbobulls.com, the visit that brought you there can be joined to the account you then created, so we can tell which pages and adverts lead somewhere. That join is the only one we make, and it carries nothing from inside your account. In the Turbobulls Community we count page views without cookies and without sending your IP address to our analytics provider: only the kind of page, a thread number, the site that sent you, and your browser, operating system, device type and country. We also record forum actions (signing in, joining, starting a thread, replying, liking, reporting, and switching the optional bull buddy on or off) under your account’s internal ID, never what you wrote, and error reports from the community describe the error, never what you posted.

e. Support and Communication Data Support

What we collect:

• Your email address and name (if provided)
• Message content and attachments

Why we collect it:

To respond to your inquiries, troubleshoot issues, and provide support or legal documentation (e.g., invoices, data requests).

f. Roadmap Votes Product Feedback

What we collect:

• Which roadmap items you have voted for, while signed in
• The timestamp of each vote
• An anonymized hash of your IP address and your browser identifier, kept in an audit log to investigate abuse

Why we collect it:

To prioritize what to build next based on what users actually want, to prevent vote stuffing, and to investigate abuse if it happens. Vote counts are public, but who voted for what is not. Deleting your account removes all your votes and their audit log entries automatically.

g. Turbobulls Community Public Forum

The Turbobulls Community at community.turbobulls.com is a public discussion forum. Anyone can read it without an account, and you take part with your Turbobulls account.

What we collect:

• The handle you pick, and when you accepted the community guidelines
• What you post: threads, replies, edits, and the images you upload. Images are re-encoded, and all metadata in them, including location, is removed
• Your likes, and the reports you file (the reason you pick and any details you add)
• Moderation records: when a moderator hides a post, locks a thread or suspends a member, and the statement of reasons given
• When you send a notice of illegal content: the content it concerns, your explanation, and your name and email address, or your account if you are signed in. A notice about child sexual abuse material can be sent anonymously

Why we collect it:

To run the forum, to keep it within its guidelines and the law, and to handle notices of illegal content as the EU Digital Services Act requires. Everything you post is public and shown with your handle, never with your email address or anything from inside your account. Unlike your portfolio data, posts are not encrypted, because they are there to be read.

The community and the app share one sign-in. The community asks app.turbobulls.com whether you are signed in there, so that it can sign you in without a click, and sign you out when you sign out of the app or switch to another account there. The answer is yes or no and, while you are signed in, a code that only our servers can check to tell whether it is still the same account. It holds no name and no email address. Signing out of the community also signs you out of the app.

a. Account and Authentication Data

Lawful basis:

• Contractual necessity – to create and manage your account, authenticate your access, and deliver the services you request
• Legitimate interest – to protect the security of the platform, detect fraud, and prevent unauthorized access

b. Billing and Subscription Data

Lawful basis:

• Contractual necessity – to process your subscription and deliver paid features of the Service
• Legal obligation – to comply with tax, accounting, invoicing, and financial reporting laws in the EU and Romania

c. Technical and Security Data

Lawful basis:

• Legitimate interest – to ensure the performance, stability, and security of the platform, including protection against fraud, abuse, and malicious activity

d. Operational Logs and Usage Metrics

Lawful basis:

• Legitimate interest – to monitor system health, debug technical issues, and improve the Service. This data is limited in scope, anonymized or pseudonymized where appropriate, and is never used for profiling, behavioral tracking, or advertising.

e. Support and Communication Data

Lawful basis:

• Contractual necessity – when your inquiry relates to your use of the Service
• Legitimate interest – to respond to general questions, collect feedback, and improve customer service

f. Optional Cookies and Analytics

Lawful basis:

• Consent – where required by law, we will obtain your explicit consent before placing non-essential cookies or using analytics tools. You can withdraw this consent at any time through your cookie settings or browser preferences.

g. Turbobulls Community

Lawful basis:

• Contractual necessity – to provide the forum you join: your handle, what you post and your likes
• Legitimate interest – to moderate the forum, prevent spam and abuse, keep records of moderation decisions, and count how the community is used without cookies
• Legal obligation – to handle notices of illegal content and to give reasons for our moderation decisions, under the EU Digital Services Act (Regulation (EU) 2022/2065)

a. Trusted Service Providers (Processors)Processors

We engage carefully selected third-party service providers to help us deliver, secure, and maintain the platform. These subprocessors may process limited categories of personal data strictly on our behalf.

• Authentication and login providers (Google OAuth)
• Payment processors (Stripe)
• Security, fraud prevention and bot protection (Cloudflare, including Turnstile)
• Product analytics (PostHog, EU region) - page views and feature usage, never the contents of your portfolio or the text of what you post in the community
• Website analytics and advertising (Google Analytics and Google Ads) - only on turbobulls.com and only after you accept cookies: which pages you visit, whether a visit led to an account, and being shown our adverts on other sites afterwards. Never anything from inside the app, and never the contents of your portfolio
• Error monitoring (Sentry, EU region) - diagnostic data when something breaks
• Email delivery (Resend, EU region) - your address, to send account email and, if you asked for it, the newsletter
• Rate limiting and scheduling (Upstash) - IP addresses or a keyed hash of them and account IDs, only for as long as a limit lasts, and when onboarding emails are due
• Hosting and database (Google Cloud, Vercel, Supabase, Aws)

We cannot see what is inside your account. Your portfolio and your transactions are encrypted on your device before they reach us, so there is nothing there for us to read, sell, or hand to an advertiser. None of it is used for advertising, on any page, ever.

On our website we count visits and see which pages and links get used, so we know what is worth writing. That happens for everyone, anonymously: nothing identifies you and one visit cannot be connected to the next. Two things are kept on your device whatever you choose, and both are small: the choice you make on the banner, and the advert that brought you, which disappears when you close the tab.

Accepting the banner adds three things. A cookie, so a returning visitor can be told from a new one. A recording of how pages get used, which replays clicks and scrolling on our own pages; what you type is masked and never reaches us. And advertising: we measure whether an advert brought somebody here, and Google may show you Turbobulls adverts on other sites afterwards. Choosing advertising also chooses the first two, which share one switch, because the Google identifier that lets us credit an account to an advert is only set once that switch is on. Declining means none of the three, and you are still counted anonymously. Error monitoring runs either way, because it is what tells us a page is broken for you.

If you accept advertising and then create an account, we keep Google's identifier for that visit on your profile. A subscription is usually paid for weeks after the advert was clicked, and without it we cannot tell which adverts bring people who actually pay. When a payment happens we send Google that identifier, the amount and the currency. Nothing else: not your name, not your email, and nothing about what you hold. Decline advertising and there is no identifier to keep.

Inside the app none of that applies. We record explicit product events only: no autocapture, no session recording, no advertising trackers, and nothing that could describe a holding.

The Turbobulls Community has no analytics script and no measuring cookie either. Its page views are counted on our server without cookies, and forum actions are recorded under your account’s internal ID, never with what you wrote.

All subprocessors are subject to written data processing agreements that require them to implement appropriate technical and organizational security measures under Article 32 of the GDPR.

b. Internal Access and ConfidentialityAccess Control

Access to your personal data is strictly limited to authorized personnel and contractors who require access to fulfill their job responsibilities. All such access is governed by confidentiality agreements and role-based access controls consistent with GDPR Article 32 and industry best practices.

c. Legal Obligations and Government RequestsLegal Compliance

We may disclose personal data when required to do so under applicable law, such as to comply with a valid subpoena, court order, or government investigation under Article 6(1)(c) of the GDPR.

We carefully review each request to verify its legal basis, necessity, and proportionality. If permitted, we will notify you of such disclosures.

d. Corporate TransactionsBusiness Continuity

In the event of a merger, acquisition, financing, restructuring, or sale of assets, your personal data may be transferred as part of that transaction. We will ensure confidentiality protections are maintained and notify you in advance of any material changes to the way your data is processed.

e. With Your ConsentUser Control

We may share your personal data with third parties for other purposes only with your explicit, informed consent. For example, when you voluntarily enable third-party integrations. You may withdraw this consent at any time.

f. Public Content in the CommunityPublic by Design

What you post in the Turbobulls Community is published: your handle, threads, replies and images can be read by anyone on the internet, and anyone can copy them. If you delete a post, its text is removed from the forum, but copies made before then may remain. Reports and notices of illegal content are seen only by our moderators.

a. Transfers to Third CountriesGDPR Articles 46–49

Where personal data is transferred outside the EEA, we implement appropriate legal safeguards as required by GDPR Articles 46–49, including:

• Standard Contractual Clauses (SCCs) issued by the European Commission
• Supplemental technical and organizational safeguards, such as end-to-end encryption, pseudonymization, and strict access controls
• Vendor due diligence and contractual restrictions to ensure GDPR-level protection

We regularly assess these safeguards to ensure their effectiveness and adequacy, especially for any transfers to countries subject to conflicting laws (e.g., surveillance regimes).

b. U.S. Service Providers and the Data Privacy FrameworkEU–U.S. DPF

Some of our infrastructure, payment, or authentication providers may be located in or subject to U.S. jurisdiction. In such cases, we:

• Ensure your personal data is hosted in EU data centers where applicable
• Require the use of Standard Contractual Clauses as a legal basis for transfer
• Limit access to only what is necessary for secure operation
• Monitor eligibility for and participation in the EU–U.S. Data Privacy Framework (DPF), and may rely on this mechanism where applicable

c. Fallback Measures and Transfer SuspensionContinuity Measures

If any data transfer safeguard we rely on is invalidated or no longer provides adequate protection, we will:

• Implement an alternative lawful transfer mechanism where available, or
• Suspend the transfer until such safeguards are re-established

This ensures your personal data is never transferred internationally without a lawful basis under the GDPR.

d. Your Rights Regarding TransfersAccess Rights

You have the right to request more information about our cross-border transfer safeguards, including a copy of the Standard Contractual Clauses we rely on, by contacting us at privacy@turbobulls.com.

a. Right of Access Article 15

You have the right to request confirmation of whether we process your personal data and, if so, to receive a copy of that data along with relevant information about how and why we process it.

b. Right to Rectification Article 16

You may request correction of inaccurate or incomplete personal data that we hold about you.

c. Right to Erasure (Right to be Forgotten) Article 17

You have the right to request the deletion of your personal data where there is no compelling reason for us to continue processing it, such as when:

• The data is no longer needed
• You withdraw consent (where consent was the legal basis)
• You object to processing and no overriding legitimate interest exists
• Processing was unlawful or must be erased to comply with legal obligations

d. Right to Restriction of Processing Article 18

You may request that we restrict the processing of your personal data in certain circumstances, such as while we verify a correction request or assess an objection.

e. Right to Data Portability Article 20

You have the right to request your personal data in a structured, commonly used, machine-readable format, and to have it transferred to another controller, where technically feasible and where processing is based on consent or contract.

f. Right to Object Article 21

You have the right to object to processing based on legitimate interest, including profiling. If you object, we will stop processing your data unless we can demonstrate compelling legitimate grounds.

You also have the right to object to the use of your data for direct marketing, in which case it will be stopped immediately.

g. Right Not to Be Subject to Automated Decision-Making Article 22

You have the right not to be subject to a decision based solely on automated processing, including profiling, which significantly affects you. We do not use any such automated decision-making in our Service.

h. Right to Withdraw Consent Article 7

Where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of prior processing.

i. Right to Lodge a Complaint Article 77

You have the right to lodge a complaint with your local data protection authority. Our lead supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)