PortivaPrivacy Policy
LAST UPDATED 3 AUGUST 2026 · APPLIES TO PORTIVA.AI AND APP.PORTIVA.AI
Portiva is a portfolio awareness service operated by Avatar AI ("we", "us"). This policy explains what personal data we process when you use Portiva, why we process it, and the rights you have over it. We have tried to write it the way we write everything else: plainly.
The short version
- We collect what you give us to run the service: your account details, your holdings, and the reasoning you choose to record.
- Your held quantities and cost basis are encrypted at rest.
- We never ask for, receive, or store broker credentials, and no part of Portiva can place a trade.
- We do not sell your data to anyone: not to brokers, not to data companies, not to advertisers. There is no advertising on Portiva.
- Everything you write about your investments is yours. You can ask for a copy or ask us to delete it at any time.
What we collect
- Account data. Email address, a password (stored only as a modern cryptographic hash, never in plain text), your name, and optionally business details you choose to provide (company name, role, billing address).
- Portfolio data. The instruments you tell us you hold or watch, quantities and cost basis (encrypted at rest), and portfolio structure such as buckets. If you import a broker statement, we extract the positions from it and then discard the file: the statement itself is not stored.
- Your record. The theses, assumptions, conviction levels, check-in answers and notes you choose to write. This is the heart of the product and it belongs to you.
- Conversations. Messages you exchange with the Portiva assistant, in writing or by voice, including transcripts of voice calls, so that the assistant can remember your prior conversations. Documents you upload in chat are retained as searchable text, encrypted and visible only to your account.
- Preferences and delivery data. Language, timezone, news source choices, alert opt-ins, and push notification subscriptions.
- Service and security data. Login events, basic usage activity, records of the emails and alerts we sent you, and technical logs and error reports needed to keep the service working and secure.
We also process market data (prices, filings, news). That is data about markets and companies, not about you.
What we use it for, and on what legal basis
- Running Portiva (Art. 6(1)(b) GDPR, performance of a contract): valuing your book, writing your daily brief, answering your questions, keeping your record, and sending the service emails the product is built around.
- Optional notifications (Art. 6(1)(a), consent): intraday alerts and push notifications are off until you switch them on, and you can switch them off at any time in Settings.
- Security and reliability (Art. 6(1)(f), legitimate interests): login records, abuse prevention, error monitoring and operational logs.
Portiva personalises what it shows you based on your holdings and your written record. That is the service, not hidden profiling: nothing we do produces legal or similarly significant automated decisions about you, and Portiva never gives investment advice.
Who processes data for us
We use a small number of service providers to run Portiva, acting on our instructions: cloud hosting and database infrastructure, an email delivery provider (our account and brief emails are sent from an EU region), AI model providers that process conversation and portfolio context to generate briefs and assistant replies, a voice processing provider for spoken conversations, an error monitoring service, and a bot-protection service on our sign-up forms. A current list of providers is available on request.
Some providers process data outside the EEA. Where that happens we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
We do not sell or rent personal data, and we do not share it with anyone for their own marketing.
How long we keep it
For as long as your account exists. If you delete your account, or ask us to, we delete your personal data within 30 days, except for minimal records we are legally required to keep or need to resolve disputes. Backups roll off on their own schedule shortly after.
Your rights
Under the GDPR you can ask us for access to your data, a portable copy of it, correction, deletion, restriction of processing, and you can object to processing based on legitimate interests, or withdraw a consent at any time. Contact us and we will act on it: a dedicated privacy address is being set up and will appear on this page. You can also complain to your local data protection authority, though we would appreciate the chance to fix things first.
Security
Held quantities and cost basis are encrypted at rest. Passwords are hashed with a modern memory-hard algorithm. All traffic is encrypted in transit. We never hold broker credentials, and Portiva is read-only by construction: no order pathway exists in the product.
Cookies
The app uses one session cookie to keep you signed in. It is not used for tracking, and there are no advertising or analytics cookies. Our sign-up forms use a bot-protection challenge that may set its own functional cookie.
Children
Portiva is not directed at anyone under 18, and we do not knowingly process their data.
Changes
If we change this policy in a way that matters, we will say so plainly on this page and, for significant changes, by email. The date at the top always tells you when it last changed.
Contact
Avatar AI · privacy@portiva.ai