Legal

Privacy notice

Version 1.0 · Last updated 1 November 2026 · GDPR Articles 13 and 14.

1. What this notice covers

This notice explains how personal data is processed when you visit ETF Weight, create an account, save a portfolio or subscribe. The analysis can be used without an account. Public ETF and country data do not contain personal data about you.

2. Data we process and why

Visiting the site

The hosting reverse proxy and application process technical request data (IP address, timestamp, requested URL, user agent, response status and security events) to deliver the site, prevent abuse and troubleshoot faults. Legal basis: Article 6(1)(f) GDPR (legitimate interests in secure, reliable operation). Server logs are kept only as long as needed for security and diagnostics and are not used for advertising.

Account and email verification

If you register, we process your email address, password hash, consent timestamp, verification attempts, account status and saved portfolio allocations. We send a six-digit verification code and password-reset messages through Brevo. Legal basis: Article 6(1)(b) GDPR (contract or steps before a contract) and Article 6(1)(f) GDPR (account security). Consent is recorded where required; you may withdraw it, but withdrawal does not affect processing already carried out.

Saved portfolios

Saved portfolios contain the fund identifiers and allocation percentages you enter, linked to your account. They are private to you. Do not enter personal data about third parties into a portfolio name or any free-text field. Legal basis: Article 6(1)(b) GDPR.

Premium subscriptions

When payments are enabled, Stripe processes payment and subscription data as an independent payment provider. ETF Weight receives identifiers such as customer ID, subscription ID, status and period end, but never full card details. Legal basis: Article 6(1)(b) GDPR and Article 6(1)(c) GDPR for tax/accounting records.

Bot protection

The registration page may load Cloudflare Turnstile. Cloudflare receives technical signals needed to distinguish humans from automated abuse and returns a verification token. Cloudflare may set necessary security cookies. Legal basis: Article 6(1)(f) GDPR (protecting the service from fraud and abuse). The widget is loaded only on the registration page when configured.

Transactional email

Brevo processes your email address and message metadata to deliver verification and password-reset messages. We do not use Brevo for marketing. Legal basis: Article 6(1)(b) GDPR and Article 6(1)(f) GDPR.

Backups

Encrypted database backups are uploaded to Google Drive using rclone. They may contain account and saved-portfolio data. Access is restricted to the service operator. Retention is limited by an automated rotation policy (currently seven daily backups unless changed in the deployment configuration). Legal basis: Article 6(1)(f) GDPR (disaster recovery and integrity of the service).

3. Cookies and local storage

ETF Weight sets only essential first-party cookies: a session cookie for sign-in and a CSRF cookie for form security. We do not use analytics, advertising, tag managers or cross-site tracking. Because there are no non-essential cookies, no advertising consent banner is shown. Cloudflare Turnstile may set security cookies on the registration page. See the cookie notice.

4. Recipients and international transfers

Recipients are limited to service providers necessary for the operation: the EU hosting provider, Brevo (transactional email), Cloudflare (bot protection), Stripe (payments when enabled), Google Drive/rclone (encrypted backups), and the open-source software supply chain. Each provider is bound by its own terms and, where required, a data processing agreement. Some providers may process data outside the EEA; transfers rely on an applicable adequacy decision or Standard Contractual Clauses. The operator must keep the provider list and transfer assessment current before launch.

Public authorities may receive data where legally required. We do not sell personal data.

5. Retention

• Unverified accounts are deleted after a short verification window.
• Active account data is kept while the account exists and is deleted or anonymised after an erasure request.
• Saved portfolios are deleted when you delete them or your account.
• Security logs are kept for a short operational period and then rotated.
• Billing records may be retained for Austrian tax and accounting periods even after account deletion, in pseudonymised form.
• Encrypted backups expire under the rotation policy; a deleted record may remain in an old backup until that backup expires.

6. Your rights

Subject to the GDPR, you may request access, rectification, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. You can download your account data and delete your account from the account page. You may also lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna) or your local supervisory authority.

To exercise a right that the self-service tools do not cover, email josip.domazet.vibe@gmail.com. We may need to verify your identity.

7. Automated decisions and profiling

ETF Weight produces portfolio calculations and comparisons. It does not make automated decisions with legal or similarly significant effects about you, and it does not profile you for advertising. The analysis is a deterministic calculation on the inputs and published data.

8. Security

We use password hashing, email verification, CSRF protection, secure session cookies, rate limiting, restricted admin access, signed Stripe webhooks, encrypted backups and server-side authorization. No internet service can guarantee absolute security. Report a suspected vulnerability to josip.domazet.vibe@gmail.com.

9. Changes

We may update this notice when the service or law changes. Material changes will be announced on the site or by email where appropriate. The version and date above identify the current text.

This notice describes the intended production configuration. Before a paid public launch, the operator must verify the hosting location, processor DPAs, transfer mechanisms, retention settings and business identity with qualified Austrian/EU counsel.