Privacy Policy
Last updated: August 21, 2026
1. Data controller
Kamteo (SASU, SIRET 106 851 884 00010), 138 Avenue Victor Hugo, 75016 Paris, France, publisher of Anelior.
2. What data we collect
- Account: email, name (optional), password (hashed, never stored in plain text).
- Financial data: accounts, transactions, positions, portfolio history that you enter or import.
- Billing: fully managed by Stripe. Anelior does not store any card data; only a subscription identifier and payment status are kept on Anelior's side.
- Support: messages exchanged via the in-app support widget, possibly reviewed by an automated assistant (see §5).
- Technical: application error logs (with automatic redaction of detected secrets before storage), infrastructure-level IP address (Vercel/Railway), for security and diagnostic purposes only.
3. Why we process this data
- Providing the service (cost basis/TTWROR/IRR calculations, portfolio tracking): legal basis, contract performance.
- Subscription billing: legal basis, contract performance.
- User support: legal basis, contract performance / legitimate interest.
- Security and fraud prevention (lockout after failed logins, audit log): legal basis, legitimate interest.
4. Where your data is hosted
- Database (accounts, transactions, portfolios): Neon, infrastructure hosted on AWS, eu-central-1 region (Frankfurt, Germany); your financial data stays within the European Union.
- Site and application: Vercel Inc. (United States).
- Application backend: Railway Corporation (United States).
- For providers located outside the EU (Vercel, Railway), data transfer is governed by the European Commission's Standard Contractual Clauses, included in these providers' data processing agreements (DPA).
5. Subprocessors and third parties
| Provider | Role | Data involved |
|---|---|---|
| Stripe | Payment, billing | Email, amount, subscription status (no card data on Anelior's side) |
| Resend | Transactional emails (verification, password reset) | |
| Third-party market data provider | Market data (security prices) | No personal data sent: requests concern tickers, not your data |
| Anthropic (Claude) | Automated support assistant | Content of messages sent to the support widget, only during a conversation with the automated assistant |
| Vercel / Railway | Hosting | IP address, technical metadata |
6. Your rights (GDPR)
Under GDPR, you have the following rights over your personal data:
- Right of access and portability: export your data from the application.
- Right to erasure: delete your account and all your data from the application, or by request to support.
- Right to rectification: edit your data directly in the application.
- Right to object: for any processing based on legitimate interest.
To exercise these rights, contact contact@anelior.com.
7. Automatic deletion of inactive accounts
An account with no active subscription and prolonged inactivity may be deleted automatically, in accordance with the GDPR data minimization principle.
8. Retention period
- Active account data: retained as long as the account exists.
- Billing data: retained for 10 years, in accordance with the legal obligation to retain accounting records (Article L123-22 of the French Commercial Code).
- Technical logs: retained for 90 days, then automatically deleted.
9. Security
- Passwords are hashed (never stored in plain text).
- Two-factor authentication available for administrator accounts.
- Progressive lockout after repeated failed login attempts (brute-force protection).
- Audit log on every sensitive administrative action.
- Automatic redaction of secrets detected in error logs before storage.
10. Cookies
See the Cookie Policy.
11. Changes to this policy
This policy may be changed at any time. Users will be informed of any substantial change.
12. Contact / complaints
For any question about your personal data: contact@anelior.com. You also have the right to lodge a complaint with the CNIL (cnil.fr).