Privacy policy
Last updated: October 2026
This policy explains what personal data Adamas Research (“the Service”) collects, why, and what rights you have under the General Data Protection Regulation (GDPR) and Portuguese law (Lei n.º 58/2019). Items in [brackets] are details the operator must complete.
1. Controller
The data controller is [operator full name], an individual established in Portugal.
Address: [postal address]
Email: [operator contact email]
The operator has not appointed a data protection officer; contact the email above for any privacy matter.
2. What we collect
Account data
- When you sign in with Google: your email address, name and profile picture URL, as shared by Google. When you sign in by email link: your email address.
- A display name you may set, your chosen currency, and notification preferences.
Data you enter
- Portfolios, holdings, transactions, watchlist items and notes.
- Price alerts and the notifications they generate.
- Property records (name, address, values, rent, mortgage figures, notes).
- Community posts, comments and likes.
- Learning progress, quiz scores and your self-assessment (experience level, goals, risk tolerance, horizon).
- Inputs to AI features and the reports they produce, kept as history in your account.
Technical data
- Server logs: IP address, browser type, requested pages, timestamps and error traces, kept by our hosting provider.
- A session cookie that keeps you signed in (see section 8). We do not use analytics or advertising trackers.
Financial information in the Service is self-reported. We do not connect to banks or brokers and do not process payment card details. The Service is not intended for anyone under 18.
3. Why we process it and on what legal basis
| Purpose | Data | Legal basis (GDPR art. 6) |
|---|---|---|
| Creating and running your account, showing your portfolios, alerts and content | Account data, data you enter | Performance of a contract (art. 6(1)(b)) |
| Sending alert emails you turned on | Email address, alert details | Performance of a contract; you can switch it off at any time |
| Generating AI analyses you request | The holdings, symbols or questions you submit | Performance of a contract |
| Showing your posts and display name to other members | Display name, avatar, posts, comments | Performance of a contract |
| Security, abuse prevention, debugging | Technical data | Legitimate interest (art. 6(1)(f)) in keeping the Service secure and working |
| Complying with legal obligations | Whatever is required | Legal obligation (art. 6(1)(c)) |
We do not use your data for advertising, profiling for marketing, or automated decisions with legal effects on you.
4. Who processes data on our behalf
We use the following processors. Each is bound by a data-processing agreement.
- Supabase: database, authentication and session management. Project region: [Supabase region, e.g. eu-central-1 (Frankfurt)].
- Vercel: application hosting and server logs. Functions run in [Vercel region]; edge caching may route requests through other locations.
- Anthropic: language models for AI features. Only the inputs needed for the request (for example your holdings and the question) are sent; Anthropic processes API data under its commercial terms and does not train on it.
- Resend: delivery of alert emails. Receives your email address and the alert text when an email is sent.
- Google: sign-in provider if you choose “Continue with Google”. Google’s own privacy policy applies to that step.
- GitHub: runs the scheduled job that checks price alerts. It calls our server; no personal data is stored on GitHub.
Market data providers (Finnhub, Twelve Data, CoinGecko, Frankfurter) receive only the symbols being looked up from our server, never your identity or account data.
We do not sell personal data and do not share it with anyone else except where the law requires.
5. International transfers
Some processors (Vercel, Anthropic, Resend, Google, GitHub) are established in or operate from the United States. Where personal data leaves the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses included in each processor’s agreement and, where the provider is certified, the EU-US Data Privacy Framework. You can ask for a copy of the relevant safeguards at the contact address above.
6. How long we keep data
- Account and the data you enter: for as long as your account exists.
- Notifications: until you delete them or, at the latest, when your account is deleted.
- AI report history: until you delete a report or your account.
- Server logs: kept by the hosting provider for a short rolling period, typically [e.g. 30 days].
- Backups: database backups are retained by Supabase for up to [e.g. 7 days] and then overwritten; deleted data disappears from backups on that cycle.
When you delete your account, the user record and every row linked to it (profile, portfolios, holdings, transactions, watchlist, alerts, notifications, properties, posts, comments, likes, learning progress, AI reports) are deleted at once by a database cascade.
7. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy. Use Settings → Your data → Download my data to get a JSON export at any time.
- Rectify inaccurate data. Profile fields are editable in Settings; everything else can be edited in the relevant section of the app.
- Erase your data. Use Settings → Delete account; this is immediate and cannot be undone.
- Portability: the export above is in a structured, machine-readable format.
- Restrict or object to processing based on legitimate interest, and withdraw consent where processing relies on it (for example by turning off email alerts).
- Complain to a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, geral@cnpd.pt. You may also complain to the authority of the EU country where you live.
For anything the app does not let you do yourself, email [operator contact email]. We respond within one month, as the GDPR requires, and may ask you to confirm your identity through the signed-in account.
8. Cookies
The Service sets only strictly necessary cookies: the Supabase authentication cookies that keep you signed in (names starting with sb-), which expire when the session ends or is refreshed. Your light/dark theme preference is stored in your browser’s local storage, not sent to us. We do not use analytics, advertising or cross-site tracking cookies, so no cookie banner is required.
9. Security
All traffic is encrypted in transit (TLS). Data is stored encrypted at rest by Supabase. Every user-owned table is protected by row-level security, so one account cannot read another account’s private data. Administrative credentials are kept server-side only. No system is perfectly secure; if we learn of a breach affecting your data we will notify you and the CNPD as the GDPR requires.
10. Changes to this policy
We may update this policy as the Service or the law changes. The date at the top shows the current version; material changes will be announced in the app before they take effect.
11. Contact
[operator full name]
[postal address]
[operator contact email]
See also the terms of service and the disclaimer.