Privacy Policy

1. Who We Are

This Privacy Policy explains how DashFolio collects, uses, discloses, and safeguards personal information when you use the DashFolio service (the "Service"). The Service is operated by DashFolio Inc., 1020 Bouvier Street, Suite 400, Québec G2K 0K9, Canada ("DashFolio", "we", "us", "our").

DashFolio is responsible for the personal information it holds. For the purposes of Québec's Act respecting the protection of personal information in the private sector (as amended by Law 25), Canada's PIPEDA, and similar privacy legislation, DashFolio acts as the controller of personal information processed through the Service.

Person in charge of the protection of personal information. The person exercising the highest authority within DashFolio Inc. is in charge of the protection of personal information. You can reach that person through our contact page.

The DashFolio Automator Chrome extension has its own policy: see the DashFolio Automator Privacy Policy.

2. Information We Collect

2.1 Information you provide

• Account information: email address, username, and password (stored only as a salted hash).
• Broker credentials: Flex Web Service tokens, Flex Query IDs, and broker account numbers.
• Uploaded data: CSV and XML files you choose to import (trades, dividends, cash transactions, positions).
• Manual entries: positions, lifecycles, strategy assignments, portfolio configurations.
• Billing information: your subscription plan and billing history. Payment card details are collected and processed directly by our payment processor, Stripe; we never see or store your full card number.
• Support communications: messages you send us through our contact page.

2.2 Information collected from your broker

When you connect a broker via the Flex Web Service, we fetch the reports you have configured: typically trades, cash transactions, dividend accruals, open positions, and cash balances. This data is fetched on the schedule you choose (1× to 5× per day) using your read-only token. Because this is financial information, we treat it as sensitive and process it only with your express consent, given when you connect the broker.

2.3 Information collected automatically

• Server logs: the date, time, path, and outcome of requests to the Service, kept briefly for troubleshooting. Our hosting infrastructure may record your IP address in standard access logs for security purposes.
• OrderClerk agent: if you install the agent, the device name, operating system, and agent version, so you can recognize your devices.
• Session data: a session cookie for authentication.

We collect this information through our own server logs only. We do not use third-party analytics or error-monitoring services, and we do not use technology that geolocates you or builds a profile of your interests or behaviour. See Section 8 for details.

3. How We Use Information

We process information for the following purposes:

• Provide, operate, and maintain the Service (performance of our contract with you).
• Authenticate you and secure your account.
• Ingest, normalize, and analyze your trading data to produce dashboards, reports, and analytics.
• Match dividends, cash transactions, and corporate actions to your positions and lifecycles.
• Process payments and manage your subscription.
• Communicate with you about service updates, security notices, and support requests.
• Send you product news and marketing communications, where you have agreed to receive them (see Section 10).
• Detect, investigate, and prevent fraud, abuse, and security incidents (our legitimate interest in protecting the Service).
• Comply with applicable legal obligations, including tax and accounting record-keeping.

We do not use your trading data to train machine-learning models that are exposed to other users, and we do not sell your personal information.

Automated decision-making. We do not make decisions about you based solely on automated processing that would have legal or similarly significant effects on you.

4. Broker Data

Broker connections are central to the Service. You acknowledge that:

• Your Flex token is a read-only credential you generate yourself within IBKR Account Management.
• We do not store, request, or process your broker login credentials (username and password) at any point.
• Flex tokens are encrypted at rest. They are decrypted in memory only for the duration of each scheduled fetch.
• You may revoke your Flex token at any time directly from IBKR, with or without notifying us.

DashFolio is an independent third party and is not affiliated with Interactive Brokers or any other broker.

5. Security

We apply administrative, technical, and physical safeguards designed to protect your information in proportion to its sensitivity, including:

• Encryption in transit: all connections to the Service use HTTPS (TLS).
• Encryption at rest: sensitive credentials (Flex tokens) are encrypted using industry-standard encryption.
• Password hashing: account passwords are stored using a strong, salted hash.
• Session management: session cookies are HTTP-only and, in production, marked Secure.
• Access controls: production data is access-limited to authorized personnel under audit.

No system is perfectly secure. You are responsible for keeping your password and broker tokens confidential and for notifying us through our contact page of any suspected compromise.

Confidentiality incidents. We maintain a register of confidentiality incidents. If an incident involving your personal information presents a risk of serious injury, we will notify you and the Commission d'accès à l'information du Québec (and any other authority required by law) with diligence, and take reasonable measures to reduce the risk of harm.

6. Sharing & Disclosure

We do not sell your personal information. We may share information only in the following circumstances:

• Service providers: providers acting on our behalf under written contracts that impose confidentiality, security, purpose-limitation, and incident-reporting obligations. Our current service providers are listed below. We will update this list when a provider changes.

• Broker APIs: we transmit your Flex token to Interactive Brokers' Flex Web Service to fetch the reports you have configured.
• Legal obligations: when required by law, court order, or governmental request. Where permitted, we will notify you of such requests.
• Business transfers: in connection with a merger, acquisition, or sale of assets, subject to confidentiality safeguards and notice where required.
• With your consent: when you explicitly authorize a disclosure.

Within DashFolio, access to your personal information is limited to personnel who need it to operate and support the Service.

7. International Transfers

DashFolio is based in Québec City, Québec, Canada, and the Service and its database are hosted in Québec. Our payment and email providers listed in Section 6 process limited personal information in the United States. Before communicating personal information outside Québec we assess the privacy impact of the transfer, as required by Québec law, and we transfer information only where it will receive adequate protection, under written agreements with the recipient. Information stored outside Canada may be subject to access by the authorities of that country under its laws.

8. Cookies & Tracking

We use a small number of cookies and similar technologies:

• Session cookie (strictly necessary): required to keep you signed in.
• "Keep me signed in": when checked at sign-in, your session cookie persists for up to thirty (30) days; otherwise it expires when you close your browser.
• Interface preferences: stored in your browser's local storage to remember choices such as your theme and dismissed notices. They never leave your browser.

We do not use third-party advertising trackers, analytics services, or technologies whose functions identify, locate, or profile you.

We do not currently respond to "Do Not Track" browser signals because we do not track you across third-party sites.

9. Data Retention

We retain your personal information only as long as necessary for the purposes described above, then delete or anonymize it:

You may export your data at any time using the export features available in the Service, and you may permanently delete your account and all associated data yourself from your account settings.

10. Marketing Communications

We send transactional messages (password resets, security notices, billing, service changes) that are necessary to operate your account. We send product news or marketing emails only with your consent, in accordance with Canada's Anti-Spam Legislation (CASL). You can withdraw that consent at any time using the unsubscribe link in any such email, without affecting the Service.

11. Your Rights

Depending on your jurisdiction, you have rights including:

• Access: request a copy of the personal information we hold about you and information about how it is used and to whom it is disclosed.
• Correction: request that inaccurate, incomplete, or ambiguous information be corrected.
• Deletion: request deletion of your personal information, or delete your account yourself from your settings.
• Portability: receive the computerized personal information you provided to us in a structured, commonly used technological format.
• Withdraw consent: withdraw your consent at any time where processing is based on consent, including by disconnecting a broker or unsubscribing from marketing.
• De-indexing / cessation of dissemination: where provided by Québec law.
• Automated decisions: be informed if a decision concerning you is based solely on automated processing, and submit observations (we currently make no such decisions).

How to exercise your rights. Use our contact page. We may ask you to verify your identity, typically by confirming access to the email address on your account. We respond in writing within thirty (30) days of receiving your request. If we refuse a request in whole or in part, we will explain why and tell you how to seek a review. Exercising your rights is free of charge, except where the law allows a reasonable fee for copies.

Complaints. If you are dissatisfied with how we handle your personal information, write to the person in charge named in Section 1. We will acknowledge your complaint, investigate it, and respond within thirty (30) days.

12. Users in the European Economic Area and United Kingdom

If you are located in the EEA or the UK, our legal bases for processing are: performance of our contract with you (account, broker ingestion, analytics, billing); our legitimate interests (security, fraud prevention, service improvement); your consent (marketing); and compliance with legal obligations (tax records). Canada has been recognized by the European Commission as providing adequate protection for personal information transferred to organizations subject to PIPEDA; for transfers to our providers in the United States, we rely on standard contractual clauses or an equivalent mechanism.

13. Children's Privacy

The Service is not directed to individuals under the age of majority in their jurisdiction, and we do not knowingly collect personal information from such individuals. If you believe a minor has provided us with personal information, contact us and we will take appropriate steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and publish the revised policy in the same way as this one. Where the change is material, we will also notify you through the Service or by email before it takes effect.

15. Contact

If you have questions about this Privacy Policy or wish to exercise your rights, contact us through our contact page.