Privacy policy

The controller is Axom SARL-S, established in Luxembourg. Its full identity, and the address for privacy requests, are in the panel at the bottom of this page.

Whether a data protection officer is appointed has not been decided. That is a different answer from "no", and it is left as an open question rather than resolved by omission: the obligation turns on what the processing actually is, and this product handles financial records.

Your account: name, email address, interface language, password (stored hashed, never in readable form).

What your broker exports contain: transactions, positions, instruments, amounts, and the account references that appear in them.

Your email address if you asked for the calculator summary or for deadline reminders, together with the date and IP address of your confirmation, which is the evidence that consent was given.

Billing: your subscription state and Stripe identifiers. Your card details are handled by Stripe and never reach us.

Technical: server and error logs needed to operate and secure the service.

When you use the calculator without an account, the file you upload is parsed in memory during the request. It is never written to disk and never written to the database.

The resulting figures — and the rows we parsed from your file to produce them — are held in your encrypted session so the page survives a refresh and the email step. They disappear when the session expires or when you clear your browser. There is no retention period to explain, because there is nothing retained beyond the session.

If you create an account, or log in, while a calculation is in your session, we offer to keep it. Only if you explicitly tick that box are those parsed rows written to your account, as your first import, so you do not have to upload the same export twice. The uploaded file is still never stored. If you do not tick it, the calculation is discarded with the session and nothing is written.

When you are signed in, an uploaded statement is stored on a private disk that is not reachable from the web, parsed by a background job, and then deleted. Keeping the original file is off by default.

The parsed rows are kept, because they are the evidence behind every figure the product shows you and behind anything you may have declared.

Financial content is encrypted at rest in the database: transaction rows, parse warnings and reconciliation data, account references, manually entered holdings, and the email addresses on the reminder list. Passwords are hashed, not encrypted — they cannot be read back at all.

All traffic is served over TLS.

Belfolio has no connection to your bank or broker accounts. It cannot log in on your behalf, cannot see your balances and cannot move anything.

This is by design. PSD2 account access covers payment accounts and does not reach investment accounts, and acting as an account information service provider requires an authorisation — from the CSSF in Luxembourg, where the company is established, and recognised by the National Bank of Belgium to operate here. We hold none, and are not seeking one. Data enters this product one way: a file you export from your broker and choose to upload.

The application and its database run on servers located in the European Union, on a European hosting provider.

The exact provider, data-centre region and the equivalent details for backups and object storage are to be confirmed and stated here before launch.

Stripe, for payments, invoicing and VAT calculation. It receives your email address, your billing address and, if you provide one, your VAT number. It never receives your portfolio.

Our hosting provider, and the mail provider that sends account and reminder emails.

If enabled, a cookie-less analytics service and an error-tracking service. Neither receives any financial data.

The complete and final list of processors, the location of each, and the data processing agreements and transfer mechanisms behind them are to be completed before launch.

In outline: performing the contract for your account and subscription, your consent for the reminder mailing list, a legal obligation for invoices and accounting records, and our legitimate interest in keeping the service secure.

The precise mapping of each processing activity to its legal basis is to be settled by legal review before launch.

Today, your account data is kept while your account exists, including after a subscription ends — a cancelled subscription becomes read-only and nothing is deleted, because the figures may support a filed tax return. Uploaded files are deleted immediately after parsing. Anonymous calculator results are never stored unless you explicitly ask us to keep one when you create an account or log in.

Definite retention periods — in particular for invoices and accounting records, which Luxembourg law requires the company to keep, and for the reminder list — are to be settled by legal review and stated here as concrete durations.

You can download everything we hold about you, in machine-readable form, from Settings › Privacy. The export is generated from the same sources the product reads, so it is complete rather than a summary.

You can delete your account and its data from the same page. Deletion is real: the records are destroyed, not flagged. It is available whatever the state of your subscription — a paywall in front of erasure would be indefensible.

You also have the rights of access, rectification, restriction, objection and portability under the GDPR. Where to send such a request, and the identity checks that apply, are to be stated here before launch.

Belfolio sets a session cookie, which is required for you to stay signed in, and a cookie remembering your language choice. Neither is used for advertising or profiling.

Analytics, where enabled, is cookie-less and self-hostable, and records page views and a small set of product events — an upload started, a parse succeeded or failed, a summary downloaded. No event ever carries an email address, an instrument identifier or an amount.

If you think we are handling your data wrongly, tell us first — we would rather fix it.

You also have the right to lodge a complaint with a supervisory authority. Because the controller is established in Luxembourg, that is the CNPD (Commission nationale pour la protection des données); because you may live elsewhere, you can equally complain to the authority of your own country — for most of our users, the Belgian Data Protection Authority (Autorité de protection des données / Gegevensbeschermingsautoriteit). You do not have to work out which one applies; either will route it.