Privacy policy

The short version

• We store your Google email, name and picture link, plus the portfolio, trades and settings you enter.
• We use it only to run BuyPlusHold for you. No ads, and we never sell your data.
• Google Analytics tells us which pages people open, only if you accept the cookie banner. It is not tied to your portfolio.
• Cookies keep you signed in and protect the site. The visit cookie is optional.
• You can download your data as CSV, or delete your account and all your data, yourself on your profile page. Questions go to [email protected].

Who is responsible

BuyPlusHold is run by Daniel Scarpim as a private person in Germany. He is the controller for your personal data under the EU General Data Protection Regulation (GDPR). For anything about your data, write to [email protected].

What we store and why

Your account

You sign in with Google. Google tells us your email address, your name, a link to your profile picture and an account ID, after you agree to share them on Google’s sign-in screen. We use them to create your account, recognise you when you come back and show who is signed in. Anyone with a verified Google account can sign in. Legal basis: running the service you signed up for (Art. 6(1)(b) GDPR).

Your portfolio

The companies you add, their targets and statuses, the trades you record and your settings, such as your monthly amount, whether you buy fractional shares and the broker you named in the guide. This is what BuyPlusHold calculates your buy list, value and history from. It is only visible to you. Legal basis: Art. 6(1)(b) GDPR.

The guide

Before you sign in, your answers stay in your browser. Signing in to continue carries those answers in the page address, so the guide can resume. Company names and scores are only shown after you sign in. Nothing is stored on our side until you save the portfolio.

Visiting the site

Like any website, our servers and Cloudflare (see below) see your IP address, the pages you request, the time and your browser type. We use this only to deliver the pages, keep the site secure and fix problems, and keep it no longer than needed for that. Legal basis: our legitimate interest in a working, secure site (Art. 6(1)(f) GDPR).

Google Analytics

Google Analytics runs in your browser only after you accept it on the cookie banner. It tells Google which pages you open, the time, your browser and device, and a rough location worked out from your IP address. A cookie stores a random ID so a later visit from the same browser can be counted as a return visit. We use this to see which pages are used, so we can improve the site. It is not used for ads, and it is not connected to your account, portfolio or trades. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw that consent any time with Cookies in the footer. We then stop loading Google Analytics and clear its cookies in this browser.

Cookies

Some cookies are strictly necessary: one that keeps you signed in, short-lived ones that protect the sign-in against forgery, and one that remembers your cookie choice. Cloudflare may set a cookie to tell people from bots. Those cookies don’t track you across other sites, so we don’t ask for consent for them (§ 25(2) TDDDG).

If you accept, Google Analytics sets its own cookies, such as _ga, to count visits and recognise a return visit. They can last up to two years. They are not advertising cookies. If you decline, they are not set.

Who else is involved

We use a few providers to run BuyPlusHold. They only process data on our behalf, or as needed to provide their part:

• Contabo GmbH, Germany: hosts the server and database.
• Cloudflare, Inc., USA: delivers the site and protects it against attacks. Your requests pass through Cloudflare’s network. Transfers to the USA are covered by the EU-US Data Privacy Framework and standard contractual clauses.
• Google: handles sign-in, and your browser loads your profile picture from Google’s servers. Google’s own privacy policy applies to your Google account.
• Google Ireland Ltd. and Google LLC, USA: Google Analytics, as described above. Your browser sends the visit data straight to Google. Transfers to the USA are covered by the EU-US Data Privacy Framework and standard contractual clauses.

Prices and company data come from public sources such as Yahoo Finance and the SEC. Our server fetches them without sending anything about you. The site’s fonts are served from our own server.

How long we keep it

Your account and portfolio are kept until you delete your account on your profile page, or ask us to. Deleting removes your account, portfolio, trades and settings from the live database right away and signs you out on every device. A daily backup of the database is kept for 14 days so data can be recovered after a failure, so deleted data disappears from backups within 14 days.

Your rights

Under the GDPR you can ask us to:

• tell you what we store about you and give you a copy (Art. 15); you can also download it yourself on your profile page
• correct anything that is wrong (Art. 16)
• delete your data (Art. 17)
• limit how we use it (Art. 18)
• give you your data in a machine-readable format (Art. 20)
• stop using it where we rely on legitimate interest (Art. 21)

Write to [email protected] and we will reply within a month. You can also complain to a data protection authority, for example the one where you live.

Good to know

You don’t have to give us any data, but without a Google account you can’t sign in or save a portfolio. The buy list is a calculation to help your own decisions, not an automated decision about you. If this policy changes, the date at the top changes with it.