Privacy Policy
Version in force since 16 October 2026
Provider identification
- Brand
- The BullValue (Bullocracy)
- suporte@thebullvalue.com
We explain what personal data we process, why, for how long, with whom we share it and what rights you have, under the General Data Protection Regulation (GDPR), Portuguese Law 58/2019 and Law 41/2004.
1. Controller
The controller is the entity identified at the top of this page (the same as in the Terms of Service). Contact for privacy matters and to exercise rights: suporte@thebullvalue.com.
2. What data we process, why and on what legal basis
We do not take decisions based solely on automated processing with legal effects on you, and we do not sell your data.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Create and manage the account, authentication, support | Name, e-mail, password (hashed), sign-up date, plan | Performance of contract (Art. 6(1)(b) GDPR) | While the account exists; afterwards what is needed to defend legal claims (up to 5 years) |
| Provide features (portfolio, watchlist, saved DCF analyses, settings) | Data you enter: positions, tickers, notes, assumptions | Performance of contract | Until you delete or close the account |
| Optional broker connection (Trading212) | Read-only API key (stored encrypted) and positions read | Consent (Art. 6(1)(a)), which you can withdraw | Until you disconnect or close the account |
| PRO access | E-mail, subscription status and identifiers sent by Whop (we receive no card data) | Performance of contract; legal obligation (invoicing, by whoever invoices) | While the subscription exists; then tax retention periods |
| AI Analyst and AI-generated texts | Chat messages, company consulted and financial context sent to the AI provider | Performance of contract | Deleted with the account; the AI provider processes them under its own terms |
| Security and abuse prevention (rate limiting) | IP address, request type | Legitimate interest (Art. 6(1)(f)): protecting the service | Windows of minutes; we do not keep IPs in a permanent log |
| Own usage statistics (Pulse) | Approximate country, page, referrer, a derived session identifier renewed daily. The IP is used only to derive that identifier and is not stored. We honour Do Not Track and Global Privacy Control | Legitimate interest: understanding and improving the service | 180 days |
| Site statistics (Google Analytics) | Identifiers and aggregated browsing data | Consent (cookies), which you can withdraw at any time | As per Google's configuration (by default up to 14 months) |
| Marketing and remarketing (Meta Pixel) | Browsing identifiers and events | Consent (cookies), which you can withdraw at any time | As per Meta |
| Service e-mails (confirmation, password, account notices) | E-mail and name | Performance of contract | As needed to send |
3. Who receives the data (processors)
We use providers that process data on our behalf, under contract (DPA) and with adequate safeguards:
- Supabase — authentication and database.
- Vercel — application hosting and delivery network; Fly.io and Render — task execution and supporting services.
- Whop — subscription, payment and (as applicable) invoicing; it acts under its own terms and privacy policy.
- Google — Gemini (AI text generation; your chat messages and company context are sent to it) and Google Analytics (if you consent).
- Meta — Meta Pixel (if you consent).
- Resend — service e-mails.
- Upstash — request rate limiting (IP address, transiently).
- Financial data and news providers — receive technical requests; we send them no personal data.
4. Artificial intelligence
Messages you write in the chat and the company you consult are sent to Google (Gemini) to produce the answer. They may contain personal data if you type it: do not enter personal or sensitive financial data. Google processes this data under the terms applicable to the Gemini API; see the provider's terms for details.
5. Transfers outside the EEA
Some providers are in the United States. These transfers rely on the EU–US Data Privacy Framework adequacy decision (for certified providers) and, where needed, on the European Commission's standard contractual clauses, with supplementary measures where applicable. You can ask us about the safeguards at suporte@thebullvalue.com.
6. Cookies
We use essential cookies and, only with your consent, analytics and marketing cookies. Details and how to change your choice are in the Cookie Policy.
7. Your rights
We reply within one month. To exercise rights: suporte@thebullvalue.com. We may ask for proof of identity.
- Access, rectification and erasure (you can correct and delete your account in Settings; you can also export your data).
- Portability: export your data in a structured format in Settings.
- Restriction of processing and objection (in particular to processing based on legitimate interest).
- Withdraw consent at any time, without affecting earlier processing.
- Lodge a complaint with the supervisory authority: Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt.
8. Security
We use encrypted connections (TLS), hashed passwords, encrypted integration keys, access control and rate limiting. No system is infallible; in case of a personal data breach that puts you at risk we notify the CNPD and, where required by law, you.
9. Minors
The platform is for people aged 18 or over. If we learn that an account belongs to a minor we close it and delete the data.
10. Changes
We update this policy when processing changes. The version in force and its date are at the top; material changes are communicated by e-mail or on the platform.