Back to home

Privacy Policy

Last updated: February 2025

1. Who We Are

Chillfolio is operated by UAB W00RKS ("we", "us", "our"), a company registered in the Republic of Lithuania.

We are the data controller for your personal data processed through Chillfolio.

2. Data We Collect

We collect the following types of information:

Information You Provide

  • Account Information: Email address and passkey authentication data (WebAuthn credentials)
  • Portfolio Data: Asset tickers, quantities, and target allocations that you manually enter
  • Settings: Your preferences for allocation methods, strategy parameters, and display options

Information Collected Automatically

  • Usage Data: Pages visited, features used, actions taken within the service
  • Technical Data: IP address, browser type and version, device type, operating system
  • Performance Data: Page load times, errors encountered

3. How We Use Your Data

We process your data for the following purposes:

Purpose Legal Basis (GDPR)
Providing the portfolio tracking and rebalancing service Contract performance
Authenticating your account Contract performance
Sending service-related communications Contract performance
Improving and optimizing the service Legitimate interest
Preventing fraud and abuse Legitimate interest
Marketing communications (if opted in) Consent

4. No Brokerage Connection

Important: Chillfolio never connects to your brokerage accounts. All portfolio data is manually entered by you. We have no access to your actual brokerage holdings, account balances, transactions, or trading history.

5. Data Sharing

We do not sell your personal data. We may share your data with:

  • Service Providers: Infrastructure providers (hosting, databases) who process data on our behalf under strict confidentiality agreements. These are limited to what's necessary to operate the service.
  • Legal Requirements: When required by law, court order, or to protect our legal rights.

We do not share your portfolio data with third parties for their own purposes.

6. Data Security

We implement appropriate security measures to protect your data:

  • All data is transmitted over HTTPS (TLS encryption)
  • Data is encrypted at rest in our databases
  • Passwordless authentication using WebAuthn/Passkeys
  • Regular security reviews and updates
  • Access controls limiting who can access your data

While we implement strong security measures, no system is completely secure. We cannot guarantee absolute security of your data.

7. Data Retention

  • Active Accounts: We retain your data while your account is active.
  • Account Deletion: When you delete your account, we delete your personal data within 30 days.
  • Backups: Data may persist in encrypted backups for up to 90 days for disaster recovery.
  • Legal Requirements: We may retain certain data longer if required by law (e.g., billing records).

8. Your Rights (GDPR)

As a user, you have the following rights under GDPR:

  • Access: Request a copy of your personal data
  • Rectification: Correct inaccurate data
  • Erasure: Delete your account and personal data ("right to be forgotten")
  • Portability: Export your portfolio data in a machine-readable format
  • Restriction: Request we limit processing of your data
  • Object: Object to processing based on legitimate interests
  • Withdraw Consent: Where processing is based on consent, withdraw it at any time

To exercise these rights, contact us at [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Lithuanian Data Protection Authority (VDAI) or your local supervisory authority.

9. Cookies & Tracking

We use minimal cookies:

  • Essential Cookies: Required for authentication and session management. These cannot be disabled while using the service.
  • Analytics: We may use privacy-focused analytics to understand how the service is used. No cross-site tracking or advertising cookies.

We do not use third-party advertising cookies or sell data to advertisers.

10. International Transfers

Your data is primarily processed within the European Economic Area (EEA). If we transfer data outside the EEA, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses approved by the European Commission).

11. Children's Privacy

Chillfolio is not intended for users under 18 years of age. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you via email or through the service at least 30 days before the changes take effect. The "Last updated" date at the top indicates when this policy was last revised.

13. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us:

  • Email: [email protected]
  • Company: UAB W00RKS
  • Address: KriviĊ³ g. 4, Vilnius, Lithuania