🔒 Privacy Policy
Last Updated: September 21, 2026
📋 PRIVACY NOTICE
This Privacy Policy describes how cruisefolio ("Company," "we," "us") collects, uses, and protects your personal data. Please read this policy carefully. By using cruisefolio, you consent to our data practices as described herein.
This policy applies to users worldwide, including those in the EU (GDPR), California (CCPA), and other jurisdictions. We comply with the strictest privacy standards, even for users outside those regions.
1. Information We Collect
1.1 Information You Provide
We collect the following personal data when you register and use cruisefolio:
- Account Registration: Email address, username, password hash, account creation date
- Broker Credentials: API keys and tokens from your brokerage (Alpaca, Webull, etc.)
- Account Preferences: Trading strategies selected, risk parameters, notification settings
- Payment Information: Billing address, payment method (processed securely by Stripe; we do not store full card numbers)
- Communication: Emails, support tickets, feedback you send to customer support
1.2 Information Collected Automatically
When you use the Service, we automatically collect:
- Trading Data: Orders placed, positions held, fills, strategy activations (collected from your broker APIs)
- Device & Network Information: IP address, browser type, device type, operating system (via server logs)
- Usage Analytics: Pages visited, features used, time spent (via Google Analytics - anonymized)
- Cookies & Session Data: Session tokens, authentication cookies, user preferences stored locally
1.3 Information We Do NOT Collect
We explicitly do NOT collect, store, or log:
- Your full social security number (we never ask for it)
- Your broker account number or full account details
- Underlying order payloads or internal broker API responses
- Personal financial portfolio composition beyond what you see on the dashboard
- Trading rationale, strategy preferences, or investment goals (unless you voluntarily tell us)
- Health information, political affiliation, or other sensitive personal data
- Biometric data
- Location data (we use IP address only to prevent fraud)
2. How We Use Your Information
2.1 Service Delivery
Primary Purpose: We use your data to operate cruisefolio and provide trading services:
- Execute API calls to your broker on your behalf (using your API keys)
- Authenticate your account and manage your session
- Display your account balance, positions, and order history
- Execute automated trading strategies you activate
- Synchronize order status with your broker
- Send transactional emails (order confirmations, strategy activations, alerts)
2.2 Legitimate Business Operations
We also use your data for legitimate business interests:
- Security & Fraud Prevention: Detect unauthorized access, prevent account takeovers, analyze suspicious activity patterns
- Service Improvement: Understand feature usage, identify bugs, improve performance (via anonymized analytics)
- Customer Support: Respond to your inquiries, troubleshoot issues, provide assistance
- Legal Compliance: Comply with SEC regulations, maintain audit trails, respond to lawful requests
- System Monitoring: Monitor service health, detect outages, ensure uptime
2.3 What We Do NOT Do With Your Data
- ❌ We do NOT sell your data to third parties
- ❌ We do NOT rent your data to brokers or exchanges
- ❌ We do NOT use your data for marketing or advertising (except transactional account emails)
- ❌ We do NOT build behavioral profiles to "recommend" strategies to you
- ❌ We do NOT share your trading history with other users
- ❌ We do NOT use your data to train AI models
3. How We Store Your Information
3.1 API Key Storage (Your Most Sensitive Data)
🔐 Critical: How We Protect Your API Keys
API keys are the "master key" to your brokerage account. We treat them with the highest level of security.
- Encryption Method: AES-256 (military-grade encryption) at rest
- Key Management: Data Encryption Keys (DEKs) are themselves encrypted using AWS KMS or equivalent
- Access Control: Even our engineers cannot decrypt your API keys without explicit AWS KMS authorization
- Database Isolation: API keys stored in separate, access-restricted table
- Audit Logging: Every access attempt (decryption, use, viewing) is logged and monitored
- Backup Encryption: Database backups are encrypted with separate KMS keys
- Deletion: Upon request, API keys are crypto-erased (overwritten with random data) before backup rotation
3.2 All Other Data Storage
| Data Type |
Storage Method |
Encryption |
Retention |
| Email, Password Hash |
PostgreSQL (production) / SQLite (development) |
Database encryption + TLS in transit |
Until account deleted, then 30 days |
| Order History |
PostgreSQL |
Database encryption + TLS in transit |
7 years (SEC requirement) |
| Session Tokens |
Redis cache + secure cookies |
Encrypted cookies + HTTPS only |
10 minutes inactivity, then auto-delete |
| Usage Logs |
Application logs (AWS CloudWatch) |
AES-256 at rest |
30 days, then deleted |
| Database Backups |
DigitalOcean managed backups |
AES-256 with separate KMS keys |
30-day rolling window |
3.3 Data Location
All data is stored on DigitalOcean App Platform infrastructure in US data centers. We do not store data in EU, Asia, or other regions by default. If you are in the EU and wish your data stored in Europe for GDPR compliance, contact [email protected] to request transfer (manual setup required).
4. Who We Share Your Data With
4.1 Required Sharing (Necessity for Service Operation)
Your Broker (Alpaca, Webull, etc.)
- What: API credentials (sent securely), trade requests, market data requests
- Why: To execute your trades on your brokerage account
- Governed By: Your broker's privacy policy and API terms
- Our Control: Limited - your broker is a separate entity and we cannot control how they use your data
Cloud Infrastructure Provider (DigitalOcean)
- What: Encrypted database, application logs, backups
- Why: To host our servers and store data
- Data Processing Agreement: Signed; they cannot access unencrypted data
- Your Recourse: DigitalOcean privacy policy applies
Payment Processor (Stripe)
- What: Billing address, payment method details
- Why: To process subscription fees
- PCI Compliance: Stripe is PCI-DSS Level 1 certified; we never store full credit card numbers
- Your Recourse: Stripe privacy policy applies
Email Service (SendGrid)
- What: Email address, email content (transactional only)
- Why: To send you account notifications, weekly statements, alerts
- Governed By: SendGrid privacy policy and data processing agreement
Analytics (Google Analytics)
- What: Anonymized usage data (page views, feature clicks, session duration)
- Why: To understand how users interact with our platform and improve features
- Privacy Protection: IP addresses are anonymized; we do not link analytics to personal identities
- Governed By: Google Analytics privacy policy
4.2 Legitimate Interest Sharing (Security & Legal Compliance)
Law Enforcement
- We will disclose user data ONLY if required by:
- Court order or subpoena from a judge
- Valid law enforcement warrant
- Legally binding government request
- We will NOT voluntarily share data with police, FBI, or government agencies without legal process
- We will notify you of the request UNLESS prohibited by law
Security Investigations
- If your account is compromised (hacked), we may share limited data (email, hashed password, breach timeline) with:
- Your broker (to alert them of credential theft)
- Cybersecurity incident response teams (to contain breach)
- Law enforcement (if criminal investigation initiated)
4.3 NO Sale or Commercialization of Data
We categorically do NOT:
- Sell user data to data brokers, marketing companies, or hedge funds
- Lease trading patterns or strategy usage to other services
- Share "anonymized" insights with third parties (violates GDPR/CCPA principles)
- Use data to build competitor-targeting lists
- Commercialize your trading history in any form
5. Your Privacy Rights
5.1 GDPR Rights (For All Users, Regardless of Location)
You have the following rights under GDPR, and we honor them for all users globally (not just EU residents):
| Right |
What It Means |
How to Request |
Timeline |
| ✓ Right to Access |
Request all data we hold about you |
Email [email protected] with subject "Data Access Request" |
30 days |
| ✓ Right to Deletion |
Request permanent deletion of your account |
Use account settings → "Delete Account" or email [email protected] |
24 hours (after confirmation) |
| ✓ Right to Portability |
Receive your data in machine-readable format (JSON/CSV) |
Email [email protected] with subject "Data Portability Request" |
30 days |
| ✓ Right to Correction |
Request fixes to inaccurate information |
Email [email protected] with corrections needed |
30 days |
| ✓ Right to Restrict Processing |
Pause use of your data (e.g., analytics only) |
Email [email protected] with restriction details |
14 days |
| ✓ Right to Object |
Opt out of non-essential processing (analytics, future feature testing) |
Use account settings → "Privacy Preferences" or email [email protected] |
Immediate |
| ✓ Right to Lodge Complaint |
File complaint with your data protection authority |
Contact your country's data protection authority (links below) |
No deadline |
5.2 CCPA Rights (For California Residents)
California residents have the same rights as listed above, plus:
- Right to Know: What personal information is collected and how it's used
- Right to Delete: Request deletion of collected personal information
- Right to Opt-Out of Sale: We do NOT sell data, so this right is non-applicable
5.3 How to Exercise Your Rights
- Send Request Email: Compose an email to [email protected] with:
- Subject line: Your specific request (e.g., "Data Access Request", "Account Deletion", "Data Portability Request")
- Your full name
- Your email address associated with the account
- Last 4 digits of your SSN or ID number (for identity verification)
- Specific data/request details
- Verify Your Identity: We will respond with verification steps (security question, SMS code, etc.)
- Processing: Upon verification, we process your request within the timeframe above
- Confirmation: You receive email confirming the action was completed
5.4 Deletion Process & Timeline
How Your Data Is Removed
When you delete your account or disconnect a broker, here's exactly what happens to your data:
- Immediate (within 1 hour):
- API keys marked for deletion (moved to secure quarantine table)
- Broker token refresh tokens revoked (disconnect signals sent to brokers)
- Account flagged as deleted (login disabled)
- Session tokens invalidated (you're logged out everywhere)
- Short-term (within 24 hours):
- All API keys crypto-erased from primary database
- Email address hashed (cannot reconstruct to send marketing email)
- Personal profile data anonymized
- Medium-term (within 7 days):
- All API keys and credentials removed from database backups
- Backup snapshots rotated (old backups discarded)
- Cache entries purged
- Exceptions (Not Deleted):
- Order History: Kept for 7 years (SEC requirement) - anonymized so it cannot be linked to your identity
- Aggregated Analytics: Kept indefinitely (cannot identify you)
- Legal Holds: If you're under investigation, data held per legal requirement
Confirmation Email: You receive an email confirming "Account deletion complete. Your encrypted API keys have been permanently removed. Order history retained 7 years per SEC requirement (anonymized)."
6. Data Security Measures
6.1 Infrastructure & Network Security
- HTTPS/TLS 1.3: All data in transit encrypted (no unencrypted HTTP)
- SSL Certificates: Valid, auto-renewed Let's Encrypt
- Firewalls: Network firewalls restrict database access to application servers only
- VPC Isolation: Database in private VPC subnet (not internet-accessible)
- IP Allowlist: Database accepts connections only from approved application server IPs
6.2 Application Security
- Authentication: Django session-based auth with secure cookies (HttpOnly, Secure, SameSite flags)
- 2FA Availability: Two-factor authentication available via authenticator app
- Password Policy: 8+ character minimum, hashed with bcrypt + salt
- Session Timeout: Automatic logout after 10 minutes of inactivity
- CSRF Protection: CSRF tokens on all state-changing forms
- SQL Injection Prevention: Django ORM parameterized queries (no string concatenation)
- XSS Protection: HTML auto-escaping in templates
6.3 Monitoring & Incident Response
- Real-time Monitoring: Intrusion detection system monitors for suspicious access patterns
- Rate Limiting: Brute-force protection limits login attempts to 5 per 5 minutes per IP
- Anomaly Detection: Alerts on:
- Bulk API key decryption attempts
- Unusual geographic login locations
- Failed authentication spikes
- Database access outside normal hours
- Breach Response Protocol:
- If breach detected: Isolate affected systems within 1 hour
- Notify affected users within 24 hours with:
- What data was compromised
- When it happened
- What we're doing about it
- Steps to secure your accounts (disconnect API keys, change passwords at broker)
- Credit monitoring or account recovery assistance
- Preserve evidence for law enforcement investigation
- Publish transparency report on website
6.4 Penetration Testing & Audits
- Annual third-party penetration testing (contracted security firm)
- Quarterly internal security audits
- Dependency vulnerability scanning (automated)
- Code review for security issues before deployment
7. Third-Party Services & APIs
CruiseFolio uses the following third-party services, which have their own privacy policies:
| Service |
Purpose |
Data Shared |
Privacy Link |
| Alpaca Securities API |
Trade execution, market data |
API key, trade requests, account info queries |
alpaca.markets/privacy |
| Webull OpenAPI |
Trade execution, market data |
API key, trade requests, account info queries |
webull.com/privacy |
| Google Analytics |
Usage analytics (anonymized) |
Page views, feature clicks, session duration (no personal identifiers) |
policies.google.com/privacy |
| Stripe Payments |
Billing & subscription processing |
Email, billing address, payment method (PCI-compliant) |
stripe.com/privacy |
| SendGrid Email |
Transactional emails |
Email address, account status, notification content |
sendgrid.com/privacy |
| DigitalOcean Hosting |
Cloud infrastructure |
Encrypted database, application logs, backups |
digitalocean.com/legal/privacy |
Important: We are not responsible for how these third parties handle your data. Each has its own privacy policy, and your use of CruiseFolio means you also agree to their policies.
8. Data Protection Authority Contacts
If you have privacy concerns and wish to file a complaint with your country's data protection authority:
- EU: European Data Protection Board (https://edpb.eu) - contact your country's DPA
- UK: Information Commissioner's Office (ico.org.uk)
- California, USA: California Attorney General Consumer Privacy Bureau (oag.ca.gov)
- Canada: Office of the Privacy Commissioner of Canada (priv.gc.ca)
9. Children's Privacy
CruiseFolio is not intended for children under 18 years old. We do not knowingly collect personal information from children. If we discover that a child under 18 has provided us information, we will delete it immediately and notify the parent/guardian. If you are a parent and believe your child has registered with CruiseFolio, contact [email protected] immediately.
10. International Data Transfers
Data Storage Location: All data is stored in US data centers (DigitalOcean, US regions). If you are in the EU and GDPR requires your data to stay within the EU, contact [email protected] and we can explore EU-region hosting (manual setup, may require fee).
Legal Basis for US Storage: You consent to US data storage by using the Service. The EU-US Data Privacy Framework (formerly Privacy Shield) has been deemed adequate for transfers. We also use Standard Contractual Clauses with our cloud provider to ensure GDPR compliance.
11. Retention of Data
11.1 Active Account Data
- Account profile: Retained while account is active, deleted 30 days after account closure
- API keys: Deleted immediately upon disconnection/deletion
- Session data: Deleted after 10 minutes inactivity or explicit logout
- Usage logs: Deleted after 30 days
11.2 Regulatory/Legal Retention
- Order history: Retained for 7 years (SEC requirement), anonymized after deletion request
- Audit logs: Retained for 1 year for security review
- Database backups: 30-day rolling window, older backups auto-deleted
- Tax records: Retained 7 years per IRS requirement (payment records only, not order data)
12. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in our practices, technology, law, or other factors. We will:
- Post the updated policy on this page with a new "Last Updated" date
- Notify you via email of material changes (30 days advance notice)
- Require you to re-accept the policy if material changes reduce your privacy rights
Your continued use of CruiseFolio after changes constitute acceptance of the updated Privacy Policy.
13. Contact Us
For privacy questions, concerns, or to exercise your rights, contact:
Privacy Officer - CruiseFolio
📧 Email: [email protected]
💼 Address: [Your Business Address]
📞 Phone: [Your Phone Number]
Response Time: We aim to respond within 5 business days for non-formal requests, 30 days for formal GDPR/CCPA requests.
14. Acknowledgment
BY USING CRUISEFOLIO, YOU ACKNOWLEDGE THAT YOU HAVE READ AND UNDERSTOOD THIS PRIVACY POLICY.
You consent to the collection, processing, and storage of your personal data as described herein, including your API keys on cloud infrastructure with encryption and industry-standard safeguards.