Privacy Policy

1. Introduction

Aureum Sentinel ("we," "us," "our," or "Aureum Frontiers B.V.") is committed to protecting your privacy. This Privacy Policy explains how we collect, process, store, and protect personal data when you use the Aureum Sentinel platform (the "Platform"). This Policy applies to all users, whether institutional or individual.

We comply with the General Data Protection Regulation (GDPR) and Netherlands data protection law. If you have questions, please contact our Data Protection Officer at support@aureumfrontiers.com.

2. Data Controller and Processor Information

Data Controller:

Aureum Frontiers B.V. (KvK 42097431)
Registered address: Overtoom 390 2, 1054 JS Amsterdam, Netherlands
Contact: support@aureumfrontiers.com
DPO Contact: support@aureumfrontiers.com

Data Processor (if applicable): When you authorize integration with third-party services or cloud platforms, those providers may act as data processors under separate Data Processing Agreements (DPAs).

3. Legal Basis for Processing

We process personal data under the following legal bases under GDPR Article 6:

Contract (Article 6(1)(b)): Processing necessary to perform services under your Subscription Agreement and to manage your account (authentication, billing, customer support).
Legal Obligation (Article 6(1)(c)): Processing required by Netherlands law, financial regulations, AML/KYC requirements, or court orders.
Legitimate Interests (Article 6(1)(f)): Processing for fraud prevention, security, audit logging, performance optimization, and business analytics, balanced against your privacy rights and conducted with appropriate safeguards.
Consent (Article 6(1)(a)): For marketing communications and optional analytics, we obtain explicit opt-in consent. You may withdraw consent at any time.

4. Data We Collect

4.1 Account and Authentication Data

Full name, email address, organization name, job title
Phone number (optional)
Authentication credentials (encrypted passwords or OIDC/SSO identity tokens)
Account creation and last login timestamps

4.2 Client Data (Portfolio and Financial Information)

Portfolio holdings, ticker symbols, share counts, valuations
Sector classifications, asset class designations
Strategy and benchmark selections
Risk parameters (VaR confidence levels, time horizons)
Historical price and dividend data (sourced from third parties: Yahoo Finance, etc.)

Important: You control what Client Data you upload. We do not collect Client Data without your explicit input.

4.3 Platform Usage Data

Pages and features accessed, time spent, analysis queries
Reports generated, backtests run, export history
IP address, browser type, operating system, device information
Referrer source and exit pages
Cookie and session identifiers

4.4 Support and Communication Data

Support tickets, chat messages, email correspondence
Feedback, bug reports, feature requests
Call recordings (if you opt-in to phone support with consent)

4.5 Audit and Compliance Data

Login attempts and authentication events
Data access logs (who accessed what, when)
Configuration changes and administrative actions
System events and error logs

We do not collect sensitive personal data (racial origin, religion, political affiliation, health) except as required by law or with explicit consent.

5. How We Use Your Data

Account Management:

Provision of Platform services and features
User authentication, access control, and authorization
Billing, invoicing, and payment processing
Account recovery and security
Technical support and customer service

Analytics and Optimization:

Understanding Platform usage patterns
Identifying and fixing bugs and performance issues
Improving user experience and feature design
Generating anonymized statistical reports

Compliance and Risk Management:

Detecting and preventing fraud, abuse, and unauthorized access
Responding to legal requests and regulatory inquiries
Maintaining audit trails for compliance purposes
Protecting Platform security and data integrity

Communications:

Sending service announcements, maintenance notices, security alerts
Responding to support inquiries
Marketing communications (only with your consent)

We will never:

Sell or rent your personal data to third parties
Use your Client Data to develop competing products without authorization
Share your data with unaffiliated third parties without consent or legal obligation

6. Data Sharing and Recipients

Internal Sharing: Your data may be accessed by authorized Aureum Sentinel employees and contractors who need it to provide support, perform analytics, or ensure compliance.

Third-Party Processors (with Data Processing Agreements):

Supabase: database, authentication, and file storage. This is where your account and portfolio data lives.
Hostinger: the virtual private server that runs the Sentinel web application.
Vercel: hosting for this marketing website.
Fly.io: API and risk-compute hosting.
Resend: transactional email such as sign-in links and alerts.
SnapTrade and Tink: read-only brokerage and bank connectivity, only if you link an account.
Stripe: payment processing. Card details go to Stripe and never reach our servers.
Sentry: error and performance monitoring, loaded only after you consent.
Market data: Yahoo Finance, Tiingo and Alpha Vantage for prices and reference data. These receive no personal data.

Legal Obligations: We may disclose your data when required by law, court order, or regulatory request (AML/KYC, tax authorities, law enforcement).

Business Transfer: If Aureum Sentinel is acquired or merged, your data may be transferred as part of that transaction. We will notify you of any such change.

All third-party processors are bound by contractual confidentiality and data protection obligations at least as stringent as these Terms.

7. Data Storage and Retention

Storage Location: Client Data and account information are stored in the European Union (AWS EU regions or equivalent) to comply with GDPR residency requirements. We do not routinely transfer data outside the EU.

Retention Periods:

Account Data: Retained for the duration of your subscription. After account deletion, retained for 30 days so you can recover the account, then deleted.
Client Data: You may delete portfolios and holdings at any time. Deleted data is purged within 30 days unless legally required to retain it.
Audit Logs: Retained for 7 years to comply with financial regulations and litigation holds.
Support Records: Retained for 3 years after ticket closure.
Usage Analytics (anonymized): Retained indefinitely for product improvement.

Backups: We maintain automated backups for disaster recovery. Backup retention is limited to 90 days; older backups are deleted unless a legal hold is in place.

8. Your Privacy Rights (GDPR Articles 15-22)

Right of Access (Article 15)

You have the right to request a copy of all personal data we hold about you, including the purposes of processing and recipients.

Right of Rectification (Article 16)

You have the right to correct inaccurate or incomplete personal data. You can update account information directly in the Platform; contact our DPO for complex requests.

Right to Erasure (Article 17, "Right to be Forgotten")

You may request deletion of your personal data, provided we are not required by law to retain it. Note: Legal holds, audit requirements, and fraud investigations may require us to retain certain data.

Right to Restrict Processing (Article 18)

You may request that we limit processing of your data while a request is under review or to a specific, justified purpose.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (CSV, JSON) for transfer to another service.

Right to Object (Article 21)

You may object to processing based on legitimate interests, including marketing communications and automated profiling.

Automated Decision-Making (Article 22)

You have the right not to be subject to solely automated decisions that produce legal or similarly significant effects. The Platform does not use automated profiling for access control decisions.

How to Exercise Your Rights

Submit requests in writing to: support@aureumfrontiers.com. Include "Data Subject Request" in the subject line. We will respond within 30 days (extendable to 60 days for complex requests). You may also lodge a complaint with the Dutch Data Protection Authority (AP).

9. Security Measures

We implement technical and organizational measures to protect your data:

Encryption in Transit: All data is transmitted over HTTPS/TLS 1.3. API communications are encrypted end-to-end.
Encryption at Rest: Database records and backups are encrypted with AES-256.
Access Control: Role-based access control (RBAC) limits employee access to only data necessary for their role. Administrative access requires multi-factor authentication (MFA).
Authentication: Passwords are hashed with bcrypt (>10 iterations). OIDC/SSO integration for institutional customers.
Logging and Monitoring: All data access is logged and auditable. Suspicious activity triggers alerts and investigation.
Network Security: Firewalls, Web Application Firewalls (WAF), and DDoS mitigation protect the Platform.
Incident Response: We maintain a documented incident response plan. Data breaches affecting personal data are reported to supervisory authorities and individuals within 72 hours (where legally required).
Independent Assessment: We are pursuing a SOC 2 Type II audit of our security controls. That audit is not yet complete.

While we maintain industry-standard security, no system is 100% secure. You remain responsible for protecting your own credentials and maintaining secure configuration on your end.

10. Cookies and Tracking Technologies

Session Cookies: We use HTTP-only, secure session cookies to maintain user authentication and state. These expire when you log out or close your browser.

Persistent Cookies: We use persistent cookies to remember your language and interface preferences (14-day retention).

Tracking and Analytics: We use analytics tools (anonymized, no user identification) to understand Platform usage. You can opt out by disabling cookies in your browser or contacting us.

Third-Party Cookies: Third-party services may place cookies on your device (e.g., payment processors, support widgets). Refer to their privacy policies for details.

Cookie Consent: Non-essential cookies are off until you turn them on. We ask on your first visit and default to denied, so nothing optional loads unless you choose it. You can change that choice at any time, and you can also disable cookies in your browser settings, though some Platform features may then not work correctly.

11. International Data Transfers

Aureum Sentinel is based in the Netherlands and processes data within the EU by default. If we transfer data outside the EU (e.g., to cloud providers with US operations), we rely on legal frameworks including Standard Contractual Clauses (SCCs) and, where applicable, the EU-U.S. Data Privacy Framework. By using the Platform, you consent to such transfers.

12. Children's Privacy

The Platform is not intended for users under 18 years old. We do not knowingly collect personal data from children. If we become aware that a child has provided personal data, we will delete it promptly. Parents or guardians who believe their child's data has been collected may contact us immediately.

13. Policy Changes

We may update this Privacy Policy at any time. We will notify you of material changes via email or prominent notice on the Platform. Continued use after notification constitutes acceptance of changes. If you do not agree, you may terminate your account.

14. Contact Information

For privacy inquiries:

Aureum Frontiers B.V.
Overtoom 390 2, 1054 JS Amsterdam
Netherlands
KvK 42097431
Data Protection Officer: support@aureumfrontiers.com
Privacy Email: support@aureumfrontiers.com

To file a complaint: Dutch Data Protection Authority (Autoriteit Persoonsgegevens), www.autoriteitpersoonsgegevens.nl