Last updated: September 7, 2026
Who is responsible for your data
PortfolioX is operated by Popa Alexandru, based in Romania, who is the controller responsible for personal data handled through the app and website. For privacy questions or requests, email support@portfoliox.io.
This policy explains what information we handle, why we use it, who receives it, and your rights. Reading this policy or using PortfolioX does not by itself give consent to uses of data that require separate consent.
Information you provide
- Account information: your email address and the information needed to create, access, and manage your account.
- Portfolio information: holdings, transaction records, watchlists, and other portfolio details you enter manually or import using CSV files or screenshots. PortfolioX does not connect to your broker accounts.
- xBot conversations: your questions and the responses generated, including personal information you include in a question.
- Support messages: your contact information, messages, and attachments when you contact us.
Review files and screenshots before importing them. Avoid including unrelated personal information, passwords, recovery codes, or payment card details in imports, xBot questions, or support messages.
Technical information
When you use the app or website, technical information may be processed to deliver and maintain the service, such as your IP address, device and browser information, access times, and diagnostic information about errors. Advertising services may also process device identifiers and information about ad interactions, as described below.
Why we use information
- To provide the service you request: creating and managing your account, tracking portfolio records, processing imports, calculating portfolio information, responding through xBot, and providing purchased features. We rely on processing necessary to perform our contract with you for these purposes.
- To support and secure the service: responding to questions, investigating errors, and preventing unauthorized access or misuse. Where this is not necessary to perform our contract, we rely on our legitimate interests in operating a reliable and secure service, subject to your rights and interests.
- To meet legal obligations: handling privacy requests and complying with legal requirements that apply to us.
- Where consent is required: for advertising-related tracking or other optional processing that requires your permission. Consent must be obtained separately and can be withdrawn.
If you choose not to provide information needed for a particular feature, we may be unable to provide that feature.
xBot and OpenAI
xBot uses tools powered by OpenAI. Your questions are sent to OpenAI to generate responses. Portfolio context is included in that request only when your question explicitly asks for portfolio details. Information you include in the question itself is also sent to OpenAI.
OpenAI may retain information it receives under the data controls and retention rules applicable to the services used. Those periods depend on the features and settings involved. See OpenAI’s data controls documentation. Deleting your PortfolioX account does not necessarily immediately remove information retained separately by OpenAI.
Advertising and purchases
PortfolioX uses Google advertising services in the app. These services may process information such as IP addresses, device or advertising identifiers, and ad interactions to deliver and measure ads and prevent fraud. The information processed depends on the advertising settings, device permissions, and consent choices that apply. Learn more about how Google uses information from apps that use its services.
Purchases and subscriptions are processed through Apple or Google Play. The applicable store handles payment information under its own privacy policy. Manage your purchases and subscriptions through that store.
Who receives information
Information may be handled by providers that support hosting, account access, communications, and operation of PortfolioX, where needed to deliver those services. OpenAI receives information for xBot as described above. Google processes information for advertising, and Apple or Google processes store purchases.
Information may also be disclosed where required by law or necessary to establish, exercise, or defend legal claims. Links to third-party websites take you to services governed by their own privacy policies.
International processing
PortfolioX is operated from Romania, but using international providers can involve processing information outside Romania and the European Economic Area. Transfers must comply with applicable data-protection requirements. Contact support@portfoliox.io for information about the providers, processing locations, and safeguards relevant to your data.
Retention and account deletion
We keep account and portfolio records to provide your account and its features. Deleting your account removes your account and all associated records from our systems, including portfolio records and xBot conversation history.
You can delete your account under Settings → Delete Account in PortfolioX or email support@portfoliox.io. See our account deletion instructions. Retention by external providers, including OpenAI and app stores, is separate from removal of records in PortfolioX.
Your privacy rights
Depending on the applicable law and circumstances, you can request access to your personal data, correction of inaccurate data, deletion, restriction of processing, or a portable copy of data. You may object to processing based on legitimate interests and withdraw consent for processing that relies on consent. Withdrawal does not affect the lawfulness of processing before it was withdrawn.
Send requests to support@portfoliox.io. We may need to verify that a request relates to your account before providing information or making changes. Do not send your password. We will respond within the period required by applicable law.
You have the right to complain to a data-protection authority. In Romania, this is the National Supervisory Authority for Personal Data Processing (ANSPDCP). You may also contact the competent authority in the country where you live or work, or where you believe an infringement occurred.
Children’s privacy
PortfolioX is not intended for children under 14. Children under 14 must not create an account or use the service. If you believe a child under 14 has provided personal data, contact support@portfoliox.io so we can investigate and remove the associated account and data.
For users aged 14 and above, parental or guardian consent may still be required under applicable law. Our minimum age does not replace those requirements.
Security and policy changes
No online service can guarantee absolute security. Keep your sign-in information private and contact us if you suspect unauthorized access to your account.
We will publish updates to this policy here and update the date above. Where required, we will notify you of material changes through the app, website, or email before they take effect and obtain any necessary consent for new processing.