Privacy Policy

This Privacy Policy explains how Portfolio X-Ray ("Portafolio Xray", "we", "us", or "our") collects, uses and protects your personal data when you use our service. We aim to follow principles consistent with EU data protection law (including the GDPR).

1. Data Controller and Contact

For the purposes of this Privacy Policy, Portfolio X-Ray is the data controller for the personal data we collect about you when you use the service.

If you have any questions or wish to exercise your data protection rights, you can contact us at:

Email: xrayportfolio@gmail.com

2. Personal Data We Collect

Account and Profile Information

When you register and use the service, we may collect:

• Email address.
• Username.
• Full name (if you choose to provide it).
• Password (stored in hashed form, not in plain text).
• Basic metadata about your portfolios (such as portfolio names, descriptions and visibility settings).

Usage Information

We may collect limited technical and usage information when you interact with the service, such as:

• Log data (e.g. timestamps, pages visited, basic device and browser information).
• Actions related to your portfolios (e.g. creating, editing, sharing or exploring portfolios).

X-Ray Data and Third-Party Processing

Our service helps you send portfolio information to an external third-party provider to generate a portfolio "x-ray" analysis. We do not store the resulting x-ray report or analysis data on our systems beyond what is technically necessary to request the report and display it to you in your browser.

The third-party analysis provider receives the necessary data to perform their computation. Their handling of data is subject to their own terms and privacy policy, which are not under our control.

3. Purposes and Legal Bases for Processing

We process your personal data for the following purposes and legal bases:

• To provide and operate the service – for example, to create your account, authenticate you, manage your portfolios and generate x-ray requests. The legal basis is performance of a contract (Article 6(1)(b) GDPR).
• To maintain security and prevent abuse – such as preventing unauthorized access, detecting suspicious activity or enforcing our Terms. The legal basis is our legitimate interests in securing the service (Article 6(1)(f) GDPR).
• To communicate with you – for example, to send transactional emails (account verification, password reset, important service messages). The legal basis is performance of a contract and legitimate interests in keeping you informed about important changes.
• To respond to your requests – for example, when you contact us through the contact form or email. The legal basis is our legitimate interests in responding to user inquiries and, where relevant, performance of a contract.

4. How We Share Your Data

We do not sell your personal data. We may share your data with:

• Service providers who help us operate the service (for example, hosting providers, email delivery services, and the third-party x-ray analysis provider).
• Authorities or third parties when required by law, regulation or legal process, or to protect our rights, property or safety or that of others.

5. Data Retention

We keep your account data for as long as your account is active and for a limited period after you close your account, to the extent necessary to comply with legal obligations, resolve disputes or enforce our agreements.

Data used to request x-ray analyses is generally handled in a transient way: it is sent to the third-party provider and used to display the result to you, but is not stored by us for long-term analytical or profiling purposes.

6. Security

We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, misuse or alteration. However, no system can be entirely secure, and we cannot guarantee absolute security of your data.

7. Your Rights

Depending on your location and applicable law (in particular, if you are in the European Union or European Economic Area), you may have the following rights with respect to your personal data:

• Right of access – to obtain confirmation as to whether we process your data and receive a copy.
• Right to rectification – to have inaccurate or incomplete data corrected.
• Right to erasure – to request deletion of your data in certain circumstances.
• Right to restriction of processing – to request that we limit how we use your data.
• Right to data portability – to receive your data in a structured, commonly used format.
• Right to object – to object to certain processing based on legitimate interests.

You also have the right to lodge a complaint with a supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or place of the alleged infringement.

8. Children and Minors

The service is intended for adults and is not directed to children. You must be at least 18 years old or the age of majority in your jurisdiction to create an account and use the service. We do not knowingly collect personal data from children.

9. International Transfers

Depending on where you are located and where our service providers are based, your personal data may be transferred to and processed in countries outside of your own. Where required by law, we will ensure that appropriate safeguards are in place to protect your data in connection with such transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will take reasonable steps to inform you, for example by updating the "Last updated" date or providing a notice within the service.

Your continued use of the service after the updated policy becomes effective will mean that you have read and understood the changes.

11. Contact

If you have questions about this Privacy Policy or how we handle your personal data, you can contact us at:

Email: xrayportfolio@gmail.com