Privacy Policy

Who is responsible for your data

The data controller is Fernando Correia, an individual (sole operator; no company is registered yet), based in Portugal. Correspondence address: Rua Espírito Santo 187, Matosinhos, Portugal.

For anything about your data, including the requests described under Your rights, email fernando@facorreia.com. Norviq is run by one person; there is no separate data protection officer.

Data we collect

Account data: email address, username, sign-in identifiers (password hash, or your Apple, Google or X account identifier, and any passkeys) and the profile fields you choose to fill in.

Financial data you enter or import: portfolios, holdings, trades, watchlists, expenses, budgets, goals, tax preferences, notes, position memos and imported files.

Connected-account data: when you link a broker or bank, the account metadata, balances, holdings and transactions that provider returns (read-only).

Billing data: subscription status, entitlement level, product and purchase identifiers from Apple, RevenueCat and web checkout. We never see or store your full card number.

Technical data: IP address, device and browser type, request identifiers, error reports and server logs.

Usage data: which screens you open and which features you use, as described under Analytics and cookies.

Social data, only if you use those features: friends, reports and blocks, articles you publish, and, if you find friends through Facebook or import the accounts you follow on X, the identifiers those services return.

What you must provide

To create an account you need an email address and either a password or a sign-in provider (Apple, Google or X). Without these we cannot create or secure an account. Everything else (profile fields, financial data, connected accounts, AI features, Telegram and social features) is optional; leaving it out only means the related feature does not work.

Why we use it and on what legal basis

We do not sell personal data, and we do not use your financial records to give you individual investment, tax or legal advice.

Where we rely on legitimate interest, the interests are: keeping the service and accounts secure and preventing abuse and fraud; finding and fixing errors; and understanding, in aggregate, which features are used so we can improve them. You can object to any of these (see Your rights).

How long we keep data

Deleting your account removes your data from the live database straight away. Copies inside encrypted backups expire on the schedule above, so a deleted account can remain in backups for up to 12 months. Backups are only restored to recover from an incident.

Where your data is stored and how it is protected

Norviq runs on a single server rented from Hetzner Online GmbH in Falkenstein, Germany. The database is backed up nightly; backups are encrypted (age) before they leave the server and are stored on a Hetzner Storage Box in a Hetzner data center in Germany or Finland (EU).

Provider credentials (IBKR, Plaid and your own AI provider keys) are encrypted at rest with AES-256-GCM. For GoCardless no access token is stored, only the reference to your bank authorisation. API, MCP and OAuth tokens are stored only as SHA-256 hashes. Some profile fields (bio, partner name, date of birth) and AI conversations are encrypted at field level.

Administrative access is restricted to a private network (Tailscale) and to SSH from a single administrator IP address.

The Security page describes these measures, and their limits, in more detail. No system is perfectly secure.

• Security at Norviq

Connected financial accounts

When you connect a brokerage or bank account, Norviq accesses that data on a read-only basis. Norviq cannot place trades, move money, or modify data at your financial institution.

Interactive Brokers (IBKR): portfolio and statement data is imported through IBKR's reporting feed using a token you provide. The token is stored encrypted.

Bank linking, where it is enabled, uses Plaid (United States) and GoCardless Bank Account Data (European Union and United Kingdom). Plaid access tokens are stored encrypted; for GoCardless only the reference to your bank authorisation is stored. You can revoke any connection at any time from Settings.

AI features

Norviq's AI features (the Q assistant, insight cards, summaries, position memos, proactive tips and AI-assisted imports) only run after you give explicit consent. You can withdraw it at any time: on the web in Settings, AI providers; in the iPhone app in the assistant's Assistant settings. AI features then stop and nothing more is sent.

If you use version 1.4.0 or earlier of the iPhone app, AI features you open there run as before until you update; the update asks for your consent. Background AI features (tips, alerts, Telegram) require consent regardless.

AI requests go to Anthropic (Claude Haiku, called directly) and OpenRouter, which routes requests to Anthropic models and, for receipt and screenshot text extraction, to OpenAI (gpt-4o-mini). Requests sent through OpenRouter ask providers not to collect or retain the data. Anthropic does not use data sent through its commercial API to train its models.

Your name, email address and user ID are not sent to AI providers. Only the financial context a feature needs is sent, as listed below.

If you connect your own key for Anthropic, OpenAI or another OpenAI-compatible provider, assistant requests go to that provider account under your agreement with that provider.

AI output is informational. Norviq makes no decisions based solely on automated processing that have legal or similarly significant effects on you (GDPR Art. 22); any change the assistant proposes waits for you to confirm it.

Voice input is transcribed on Norviq's own server. No third party receives your recordings.

MCP and API access

With a Norviq personal access token you can connect your own AI client (such as Claude, Cursor or ChatGPT) through the Model Context Protocol (MCP). Norviq answers that client's tool calls with your account data. From then on the data is handled by the client you chose, under its own terms and privacy policy, not Norviq's.

Tokens are scoped, can be revoked at any time in Settings, API access, and are stored only as hashes.

Telegram

Linking the Norviq bot on Telegram is optional and needs your confirmation. Telegram chats are not end-to-end encrypted. Messages you send and the bot's replies, which can include your portfolio values, budgets and expenses when you ask for them, are stored on Telegram's servers under Telegram's privacy policy.

Disconnecting in Settings stops the bot. Messages already in the chat stay on Telegram until you delete them there.

Service providers (sub-processors)

These providers process personal data for Norviq. Providers you connect yourself (brokers, banks, Telegram, Facebook, X) only receive or return data once you link them.

International transfers

Where a provider processes data outside the European Economic Area, the transfer relies on the European Commission's Standard Contractual Clauses (SCCs) or, for certified US companies, the EU-US Data Privacy Framework. Email us for a copy of the relevant safeguards.

Analytics and cookies

The website only sets cookies it needs to work: a session cookie that keeps you signed in, a CSRF cookie that protects forms, a language cookie, a timezone cookie (tz) so streaks and check-ins count days in your own time zone, and a cookie that remembers if you chose to stay on the web instead of opening the app. Display preferences such as sort order are kept in your browser's local storage.

Web analytics (PostHog EU) are cookieless: nothing is stored in your browser, session recording and automatic click capture are off, and events carry only a pseudonymous user ID, never your email or name.

Analytics in the iPhone app are not cookieless in the same way. PostHog and TelemetryDeck use a persistent pseudonymous ID. Amplitude (EU) uses a device identifier (Apple's identifier for vendor, IDFV) and receives your IP address. Events record actions you take in the app, which can include ticker symbols you view. None of them receive your email or name.

You can object to analytics by emailing us.

Your rights

Under the GDPR (Articles 15 to 22) you can ask for access to your data, correction, erasure, restriction of processing and a portable copy, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw consent at any time without affecting what was done before.

To exercise a right, email fernando@facorreia.com from the address on your account. We answer within 30 days; if a request is complex we may extend that by up to two further months and will tell you why.

You can delete your account yourself: on the web in Settings, Profile, Delete account; in the iPhone app in Profile, Delete account. On the web, Settings, Data export downloads your portfolio, transactions or watchlist; for a full copy of your data, email us. Export download links expire after 7 days and the files are deleted.

You can also complain to the Portuguese data protection authority, CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt), or to the authority where you live or work.

Security incidents

If a personal data breach occurs, we notify the CNPD within 72 hours where the GDPR requires it, and we tell affected users without undue delay when the breach is likely to put their rights and freedoms at high risk.

Children

Norviq is for adults. You must be 18 or older to use it, and we do not knowingly collect data from anyone younger.

Changes to this policy

When we change this policy we update the date at the top. Material changes are announced in the app or by email before they take effect.

Contact

Privacy questions, rights requests, exports and deletion: fernando@facorreia.com.

• Legal notice
• Terms of Use
• Security