Privacy Policy

This is a courtesy translation. If there is any discrepancy, the Spanish version prevails.

Version 2.16

Ruki Portfolio (hereinafter, "the application", which includes the mobile app and the website app.rukiportfolio.com) is operated by Brenda Vázquez Ballán ("the controller"). This policy describes what personal data we process, why, on what legal basis, for how long and what rights you have.

1. APPLICABLE LAW

• If you live in Argentina: Ley N° 25.326 (Argentina's Personal Data Protection Act) and its complementary regulations.
• If you live in the European Union or the European Economic Area: Regulation (EU) 2016/679 (GDPR) and your country's national legislation (in Spain, Ley Orgánica 3/2018, the Spanish data protection act).
• In any other country: this policy, plus any local regulations that apply.

2. WHAT DATA WE PROCESS

We collect only what the application needs in order to work:

• Sign-up data: email address; name, if you sign in with Google or Apple; country and province of residence; the investment region you choose.
• Your portfolio data, entered by you: assets, transactions (purchases, sales, dividends, coupons), any prices and exchange rates you enter, goals, brokers and notes. We DO NOT receive credentials or access to your broker or bank accounts: Ruki doesn't execute trades or hold money.
• Usage preferences and application settings.
• Notification identifier (push token), only if you enable notifications.
• Subscription data: the purchase identifier from the App Store or Google Play, plan and expiration date. Payment details (your card) are processed exclusively by Apple or Google; they never reach Ruki.
• Technical and usage data: user identifier, device model, operating system, application version, approximate city and usage events (for example, "asset added", with the type, the market and the ticker). These records DO NOT include quantities, prices or the value of your portfolio.
• The device's advertising identifier (IDFA on iOS, advertising ID on Android): used solely to know whether an installation of the application came from one of our ads. On iOS it's used only if you allow it in the tracking prompt the system shows you; if you decline, measurement is aggregated and doesn't identify you.
• Technical errors: application crash reports (Sentry), identified by an installation code, with no personal data.
• "Import from file": when you import, we log the STRUCTURE of the file (column headers, data types and the result of the analysis) in order to support more brokers. We DO NOT log amounts, quantities, prices, transaction dates or the securities in your portfolio. If a file can't be imported, you can choose to send it to us in full with the "Send file for review" button — it's only sent if you confirm it, and we use it solely to analyze the format.
• Communications: the messages you send us through support or feedback and our replies.

3. WHY, AND ON WHAT LEGAL BASIS

• Providing the service (creating your account, storing and calculating your portfolio, syncing it across devices, exporting it): performance of the contract you accept by using the application.
• Securing your account, preventing abuse and fixing errors: legitimate interest in a secure and stable service.
• Aggregated usage statistics to improve the application: legitimate interest. You can object (see section 8).
• Push notifications, analytics and advertising cookies on the website, measuring the effectiveness of our ads in the application and voluntarily sending files for review: your consent, which you can withdraw at any time (by turning off notifications, declining cookies, revoking the tracking permission in your device settings or writing to us).
• Answering your support requests: performance of the contract and legitimate interest.
• Complying with legal obligations (for example, requests from an authority): legal obligation.

We DO NOT sell your information. We DO NOT use your portfolio data for advertising purposes or share it with advertisers.

4. WHO WE SHARE DATA WITH

We use providers that process data on our behalf (data processors), each with its own privacy policy:

• Google (Firebase): authentication, database, file storage, cloud functions, push notifications and analytics (Firebase / Google Analytics).
• Google Sign-In and Apple Sign-In: optional sign-in.
• Apple App Store and Google Play: subscription management.
• Sentry: technical error reports, with no personal identifiers.
• Meta: on the website, the pixel. If you access from the European Union or the European Economic Area, only if you accept cookies; in every other country it loads as you browse, and in any case you can decline it from the Cookies link in the site footer. In the application, its software development kit (SDK), which reports the installation, session starts, the fact that you recorded a transaction or started a subscription, and purchases processed by the App Store or Google Play, to measure the effectiveness of our ads. The transaction and subscription signals go WITHOUT detail: the asset, the quantity, the price and the amount are not sent. For a purchase processed by the App Store or Google Play, Meta may receive the amount and currency of the subscription. It DOES NOT receive your portfolio data. On iOS it can only use the advertising identifier if you allowed it in the tracking prompt.
• Market quote sources: only to show updated prices; they receive no data about you.

We may disclose data if required by law or by a competent authority.

5. INTERNATIONAL TRANSFERS

Your data is hosted on Google servers located in the United States. Google participates in the EU-U.S. Data Privacy Framework and applies the Standard Contractual Clauses approved by the European Commission, which ensure an adequate level of protection. If you live in Argentina, by using the application you consent to this transfer under Section 12 of Ley N° 25.326.

6. HOW LONG WE KEEP DATA

• Your account and portfolio data: for as long as your account is active.
• When you delete your account, your data is erased from our active systems: the account, the portfolio and the transactions immediately, and the rest (preferences, usage records tied to your user, feedback messages and files sent for review) through an automatic process that completes within 24 hours. It may remain for up to 7 days in our backups, which are deleted automatically.
• Guest accounts (no sign-up): deleted automatically 20 days after they're created, together with their data. To keep them, sign up for an account (it's free).
• Usage statistics: Google Analytics keeps event data for 14 months. We also keep pseudonymized usage records (identified only by a user code, with no name or email, and with no quantities or portfolio values) for statistical and product-history purposes; once your account is deleted, that code can no longer be linked to any person.
• Technical error reports: 90 days.
• Support communications: up to 2 years from the last communication.
• Subscription data: for as long as the subscription is active; the purchase record is kept for up to 30 days after it expires. Apple and Google keep their own records under their own policies.

7. SECURITY

• Authentication and database protected by Firebase (Google), with access rules that allow only your own account to read and modify your data.
• Encryption in transit (TLS) and at rest, and industry-standard security measures.
• Sensitive operations (deleting the account, clearing the portfolio, exporting) require you to authenticate again.

8. YOUR RIGHTS

You have the right to access your data, rectify it, update it, erase it, obtain a copy (portability), restrict or object to its processing, and withdraw your consent at any time.

• From the application you can export all your information (Account → Export) and delete your account with all its data (Account → Delete Account).
• If you want to erase your data without deleting the account, use Account → Clear portfolio: all your assets, dividends, coupons and events (splits) are erased, and your brokers and goals are kept. It's irreversible, and we ask you to confirm your identity before doing it.
• To revoke the ad-measurement permission at any time: on iOS, Settings → Privacy & Security → Tracking; on Android, Settings → Privacy → Ads.
• For any other request, write to us at info@rukiportfolio.com. We reply within the legal deadlines (generally, 10 business days in Argentina and one month in the European Union).
• If you live in Argentina: the data subject may exercise the right of access free of charge at intervals of no less than six months, unless a legitimate interest is shown. The AGENCIA DE ACCESO A LA INFORMACIÓN PÚBLICA (AAIP, Argentina's data protection authority), the supervisory body under Ley N° 25.326, handles complaints and claims regarding non-compliance with personal data protection rules.
• If you live in the European Union: you can lodge a complaint with your country's supervisory authority (in Spain, the Agencia Española de Protección de Datos, Spain's data protection authority, www.aepd.es). Given the size and nature of our processing, we're not required to appoint a Data Protection Officer or an EU representative; we handle any inquiry at info@rukiportfolio.com.

9. COOKIES (WEBSITE)

The website uses cookies and browser storage that are necessary for it to work (session, preferences), plus Google Analytics and Meta pixel cookies to measure usage and the effectiveness of our ads in aggregate. If you access from the European Union or the European Economic Area, they don't load until you accept them; in every other country they load as you browse. In any case, you can change your decision at any time from the Cookies link in the site footer: if you decline them, they stop loading from your next visit.

10. LOCAL STORAGE

We use your device's local storage to keep your session active, save your theme and configuration preferences and improve performance. This information is not shared with third parties.

11. MINORS

The application is not directed at minors, and we don't knowingly collect data from anyone under 18.

12. CHANGES TO THIS POLICY

If we make material changes, we'll let you know within the application. The current version is always the one published under Account → Privacy Policy.

13. CONTACT

Data controller: Brenda Vázquez Ballán.

For privacy inquiries or to exercise your rights: info@rukiportfolio.com

Last updated: October 2026