Privacy Policy

1. Who We Are

This Privacy Policy explains how DashFolio collects, uses, discloses, and safeguards personal information when you use the DashFolio service (the "Service"). The Service is operated by Studio NextGen Inc., 1020 Bouvier Street, Suite 400, Québec G2K 0K9, Canada ("DashFolio", "we", "us", "our").

DashFolio is responsible for the personal information it holds. For the purposes of Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada's PIPEDA, and similar privacy legislation, DashFolio acts as the controller of personal information processed through the Service.

Privacy Officer. Studio NextGen Inc. has designated a Privacy Officer, who is in charge of the protection of personal information. You can reach the Privacy Officer by mail at 1020 Bouvier Street, Suite 400, Québec G2K 0K9, Canada (Attention: Privacy Officer), or through our contact page by choosing "Other".

The DashFolio Automator Chrome extension has its own policy: see the DashFolio Automator Privacy Policy.

2. Information We Collect

2.1 Information you provide

• Account information: email address, username, and password (stored only as a salted hash).
• Broker credentials: Flex Web Service tokens, Flex Query IDs, and broker account numbers.
• Uploaded data: CSV and XML files you choose to import (trades, dividends, cash transactions, positions).
• Manual entries: positions, lifecycles, strategy assignments, portfolio configurations.
• Billing information: your subscription plan and billing history. Payment card details are collected and processed directly by our payment processor, Stripe; we never see or store your full card number.
• Support communications: messages you send us through our contact page.
• Reports and suggestions: what you write when you use the Report a problem or Add a suggestion button, the email address you give us for our reply, and any screenshots you attach. With each report, the Service adds the page you were on, your browser and its language, your screen size and time zone, the portfolio you had selected, your plan, and up to ten recent errors from that page. For a failed request, it records the address and the outcome, never what the request contained.

2.2 Information collected from your broker

When you connect a broker via the Flex Web Service, we fetch the reports you have configured: typically trades, cash transactions, dividend accruals, open positions, and cash balances. This data is fetched on the schedule you choose (1× to 5× per day) using your read-only token. Because this is financial information, we treat it as sensitive and process it only with your express consent, given when you connect the broker.

When you connect a broker through SnapTrade, our connection partner, you sign in to your broker in SnapTrade's window, never on DashFolio. SnapTrade then sends us your accounts, positions, balances and transactions (trades, deposits, dividends and fees). The access is read-only: DashFolio cannot place trades through it.

2.3 Information collected automatically

• Server logs: the date, time, path, and outcome of requests to the Service, kept briefly for troubleshooting. Our hosting infrastructure may record your IP address in standard access logs for security purposes.
• OrderClerk agent: if you install the agent, the device name, operating system, and agent version, so you can recognize your devices.
• Session data: a session cookie for authentication.
• Sign-in security: the IP address and browser you sign in from, which we use to protect your account. When you sign in from a new browser, we show them in the email that carries your sign-in code, so you can spot a sign-in that was not yours.
• Broker region: when you connect a broker through SnapTrade, we note your region (for example Canada or the United States), estimated from your browser's time zone. We keep neither the time zone nor your location. We use the region only to list first the brokers our users connect most in that region, from counts that never cover fewer than 20 users. We delete it when you delete the broker connection.

We collect this information ourselves, on our own servers. We do not use third-party analytics or error-monitoring services. Apart from the broker region above, we do not use technology that locates you or builds a profile of your interests or behaviour. See Section 8 for details.

2.4 Screenshots in reports

When you attach a screenshot to a report or suggestion, our server checks that the file is a real PNG, JPEG or WebP image, then redraws it as a new PNG. We keep only that copy. It holds the pixels you saw on screen; the server discards anything else the original file carried, such as camera details or a location.

A screenshot can show financial information, such as your balances or account numbers, which we treat as sensitive. You give your express consent by ticking a box before you send one, and we keep a record of that consent as described in Section 9.

We encrypt each screenshot before we store it. Only the DashFolio team can view your screenshots, in our administration console. They stay on the servers that host the rest of your data. We do not send them by email or pass them to any other company. Our encrypted backups hold a copy until our backup rotation removes it.

2.5 Statements we can't read yet

If DashFolio can't read a broker statement you upload, you can let us keep it so we can learn its layout. A statement shows balances and account numbers, which we treat as sensitive. You tick a box to agree. We record that consent as described in Section 9.

We encrypt the file before we store it. Only the DashFolio team opens it, to write the code that reads it. We delete it when DashFolio can read that layout or 90 days after you sent it, whichever comes first. You can delete it sooner from Settings, which also withdraws your consent.

3. How We Use Information

We process information for the following purposes:

• Provide, operate, and maintain the Service (performance of our contract with you).
• Authenticate you and secure your account.
• Ingest, normalize, and analyze your trading data to produce dashboards, reports, and analytics.
• Match dividends, cash transactions, and corporate actions to your positions and lifecycles.
• Process payments and manage your subscription.
• Communicate with you about service updates, security notices, and support requests.
• Send you product news and marketing communications, where you have agreed to receive them (see Section 10).
• Detect, investigate, and prevent fraud, abuse, and security incidents (our legitimate interest in protecting the Service).
• Comply with applicable legal obligations, including tax and accounting record-keeping.

We do not use your trading data to train machine-learning models that are exposed to other users, and we do not sell your personal information.

Automated decision-making. We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you.

4. Broker Data

Broker connections are central to the Service. You acknowledge that:

• Your Flex token is a read-only credential you generate yourself within Interactive Brokers Account Management.
• We do not store, request, or process your broker login credentials (username and password) at any point.
• Flex tokens are encrypted at rest. They are decrypted in memory only for the duration of each scheduled fetch.
• You may revoke your Flex token at any time directly from Interactive Brokers, with or without notifying us.
• When you paste your Flex token on the site yourself, a checkbox asks for your consent before anything is sent: the token is not tested or saved until you tick it. Your consent is recorded on your account with its date and the version of this policy (current version: 1), and kept as described in Data Retention. When you set up an auto-sync that uses the DashFolio Automator extension, the site asks for the same consent before it creates the connection, and the extension asks again before it sends your token and query IDs, as described in its own privacy policy. Each consent is recorded separately, for each auto-sync connection you create. You can withdraw it at any time from the auto-sync connection on the Add Trades page: imports from that account stop, including the scheduled ones, your withdrawal is recorded with its date, and the trades already imported are kept. Your token stays stored, encrypted, until you delete the connection. To resume, give your consent again from the same place: imports restart with the stored token.
• If you connect a broker through SnapTrade, you enter your broker login in SnapTrade's window. We never see it. We keep an encrypted key that lets us read the accounts you chose. Before that window opens, you tick a box to give your consent. We record it with its date and the version of this policy. You can disconnect at any time. Imports from that broker then stop. We record your withdrawal and keep the trades already imported.

DashFolio is an independent third party and is not affiliated with Interactive Brokers or any other broker.

5. Security

We apply administrative, technical, and physical safeguards designed to protect your information in proportion to its sensitivity, including:

• Encryption in transit: all connections to the Service use HTTPS (TLS).
• Encryption at rest: sensitive credentials (Flex tokens) and the screenshots you attach to reports are encrypted using industry-standard encryption.
• Password hashing: account passwords are stored using a strong, salted hash.
• Session management: session cookies are HTTP-only and, in production, marked Secure.
• Access controls: production data is access-limited to authorized personnel under audit.

No system is perfectly secure. You are responsible for keeping your password and broker tokens confidential and for notifying us through our contact page of any suspected compromise.

Confidentiality incidents. We maintain a register of confidentiality incidents. If an incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information du Québec (and any other authority required by law) with diligence, and take reasonable measures to reduce the risk of harm.

6. Sharing & Disclosure

We do not sell your personal information. We may share information only in the following circumstances:

• Service providers: providers acting on our behalf under written contracts. Our current service providers are listed below. We will update this list when a provider changes.

• Broker APIs: we transmit your Flex token to Interactive Brokers' Flex Web Service to fetch the reports you have configured.
• Legal obligations: when required by law, court order, or governmental request. Where permitted, we will notify you of such requests.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to confidentiality safeguards and notice where required.
• With your consent: when you explicitly authorize a disclosure.

Within DashFolio, access to your personal information is limited to personnel who need it to operate and support the Service.

7. International Transfers

DashFolio is based in Québec City, Québec, Canada, and the Service and its database are hosted in Québec. Our payment and email providers listed in Section 6 process limited personal information in the United States. SnapTrade may store the data of the brokers you connect through it in the United States or elsewhere. Before communicating personal information outside Québec we assess the privacy impact of the transfer, as required by Québec law, and we transfer information only where it will receive adequate protection, under written agreements with the recipient. Information stored outside Canada may be subject to access by the authorities of that country under its laws.

8. Cookies & Tracking

We use a small number of cookies and similar technologies:

• Session cookie (strictly necessary): required to keep you signed in.
• "Keep me signed in": when checked at sign-in, your session cookie persists for up to thirty (30) days; otherwise it expires when you close your browser.
• Interface preferences: stored in your browser's local storage to remember choices such as your theme and dismissed notices. They never leave your browser.

We do not use third-party advertising trackers, analytics services, or technologies whose functions identify, locate, or profile you.

We do not currently respond to "Do Not Track" browser signals because we do not track you across third-party sites.

9. Data Retention

We retain your personal information only as long as necessary for the purposes described above, then delete or anonymize it:

You may export your data at any time using the export features available in the Service, and you may permanently delete your account and all associated data yourself from your account settings, except the billing and consent records listed above, which we keep for the periods stated.

10. Marketing Communications

We send transactional messages (password resets, security notices, billing, service changes) that are necessary to operate your account. We send product news or marketing emails only with your consent, in accordance with Canada's Anti-Spam Legislation (CASL). You can withdraw that consent at any time using the unsubscribe link in any such email, without affecting the Service.

11. Your Rights

Depending on your jurisdiction, you have rights including:

• Access: request a copy of the personal information we hold about you and information about how it is used and to whom it is disclosed.
• Correction: request that inaccurate, incomplete, or ambiguous information be corrected.
• Deletion: request deletion of your personal information, or delete your account yourself from your settings.
• Portability: receive the computerized personal information you provided to us in a structured, commonly used technological format.
• Withdraw consent: withdraw your consent at any time where processing is based on consent, including by disconnecting a broker or unsubscribing from marketing.
• De-indexing / cessation of dissemination: where provided by Québec law.
• Automated decisions: be informed if a decision concerning you is based solely on automated processing, and submit observations (we currently make no such decisions).

How to exercise your rights. Use our contact page. We may ask you to verify your identity, typically by confirming access to the email address on your account. We respond in writing within thirty (30) days of receiving your request. If we refuse a request in whole or in part, we will explain why and tell you how to seek a review. Exercising your rights is free of charge, except where the law allows a reasonable fee for copies.

Complaints. If you are dissatisfied with how we handle your personal information, write to the person in charge named in Section 1. We will acknowledge your complaint, investigate it, and respond within thirty (30) days.

12. Users in the European Economic Area and United Kingdom

If you are located in the EEA or the UK, our legal bases for processing are: performance of our contract with you (account, broker ingestion, analytics, billing); our legitimate interests (security, fraud prevention, service improvement); your consent (marketing); and compliance with legal obligations (tax records). Canada has been recognized by the European Commission as providing adequate protection for personal information transferred to organizations subject to PIPEDA; for transfers to our providers in the United States, we rely on standard contractual clauses or an equivalent mechanism.

13. Children's Privacy

The Service is not directed to individuals under the age of majority in their jurisdiction, and we do not knowingly collect personal information from such individuals. If you believe a minor has provided us with personal information, contact us and we will take appropriate steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and publish the revised policy in the same way as this one. Where the change is material, we will also notify you through the Service or by email before it takes effect.

15. Privacy Governance

DashFolio maintains internal policies and practices governing the protection of personal information throughout its life cycle, from collection to destruction. These policies are approved by the person in charge of the protection of personal information (Section 1).

Roles and access. Access to personal information is restricted to authorized personnel who require it to perform their duties. Authorized personnel are bound by confidentiality obligations and may use personal information only for the purpose for which access was granted.

Responsibilities of the person in charge. The person in charge oversees compliance with applicable privacy laws, handles requests and complaints (Section 11), and maintains the register of confidentiality incidents (Section 5).

Retention and destruction. Retention periods and destruction rules are set out in Section 9.

16. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, contact us through our contact page.