Privacy Notice

Who is responsible

The operator identified below is responsible for deciding how Opulya processes personal data. The operator may be an individual rather than a registered business. Opulya is the product name, not a separate legal entity.

Data controller

Not yet provided by the operator

Privacy and security contact

Not yet provided by the operator

Information we handle

We store your name, email address, password hash, verification and session records, accepted terms version and acceptance time, language and time zone. We also store the accounts, balances, categories, budgets, transactions, descriptions, investment activity and asset selections you enter. Requests expose technical information, including IP address and browser information, to the servers handling them. The app does not request your bank or broker credentials. Avoid entering other people's details or sensitive information in descriptions.

Purposes and legal grounds

Account administration, verification, storage and financial calculations are needed to provide the service you request (performance of a contract or steps requested before it). Session protection, abuse prevention and service troubleshooting support the legitimate interests of protecting users and operating a reliable service. Processing may also be necessary to meet a specific legal obligation. The operator must assess these grounds for the actual deployment. Reading this notice is not blanket consent to unrelated processing or marketing.

Service providers and disclosures

The current deployment uses Vercel for the website, Render for the API, Neon for the database and Resend for verification email. These providers process the information necessary for their roles, including technical request data; Resend receives your email address, first name and verification message. Yahoo Finance receives public search queries and instrument identifiers through our server, not your private balances or transaction history. Do not put personal information in market searches. Authorized operators and providers may access data for support, security and operations. Disclosure may also be necessary to meet a lawful request. Provider contracts, access and locations require operator review.

Processing locations and international transfers

A European database region does not by itself mean all processing stays in the EEA. Hosting, email, support and market-data services may involve other countries. The operator must document any transfers and their lawful mechanism, such as an applicable adequacy decision or standard contractual clauses with any necessary additional safeguards; this notice does not establish those safeguards.

The operator must confirm the actual hosting regions, provider processing locations, applicable transfer safeguards and how to obtain a copy of those safeguards before public launch.

Retention and deletion

Financial records remain while your account exists. Archiving an account or category, or correcting or voiding a transaction, does not erase the original history. The app does not currently delete inactive or unverified accounts automatically. Verification links expire and sessions have server-enforced expiry, but expiry is not the same as immediate deletion of their records. To request account and personal-data deletion, contact the operator. There is no self-service account deletion or complete data-export tool yet. Any justified retention exception and backup deletion schedule must be explained when handling a request.

The operator must publish the actual retention periods for inactive and unverified accounts, security logs, email-delivery records and backup deletion before public launch.

Cookies and browser storage

A first-party session cookie authenticates you. A language cookie remembers your choice for up to one year. Browser session storage remembers your pending verification email address and resend cooldown; it is cleared after successful verification or when you choose another address. The app currently includes no advertising cookies, third-party audience analytics or marketing-email feature. Hosting providers may separately process technical security and delivery records. Optional tracking must be assessed and, where required, consent obtained before it is introduced.

Your privacy rights

Depending on the applicable law and the processing, you may request access, correction, deletion, restriction or portability of your data, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. Send requests to the contact above; identity verification may be necessary. Under GDPR, requests normally require a response within one month, subject to permitted extensions. You may complain to your local supervisory authority, including AZOP in Croatia. These rights are not limited to the controls currently available in the app.

Croatian Personal Data Protection Agency (AZOP)

Your choices and automated processing

Registration requires your name and email address; a verified address and password are needed to sign in. You choose which financial information to enter. Without required account information, we cannot provide an account. Financial charts, budgets and portfolio calculations are informational; Opulya does not make automated lending, eligibility or trading decisions about you. There is no built-in sale-of-personal-data feature or targeted advertising.

Changes to this notice

The date above identifies this notice's latest revision. Material changes to purposes, recipients or retention require an updated notice and appropriate communication before the new processing begins. Where consent is required, merely updating this page does not replace obtaining it.