Privacy notice

SmartDividend is operated by the operator of SmartDividend, available on request via the contact address below. For anything in this notice, including any request about your data, contact the contact address published on our website.

• Your account — name, email address, and a hash of your password. We never store the password itself.
• Your portfolio records — the accounts, holdings, transactions, dividends, cash movements and goals you enter or import. This is the substance of the service and the most sensitive thing we hold.
• Broker statements you import — parsed in memory and turned into the records above. We keep a summary of each import (file name, row counts, outcome); we do not retain the uploaded file.
• Credentials you choose to add — exchange API keys, a Telegram bot token, market-data or AI provider keys. These are encrypted before storage and are never displayed back to you in full.
• Security records — sign-in events, and the IP address and browser user-agent attached to them, so that account access can be audited and abuse detected.

• To provide the service you asked for — storing and analysing your portfolio. Basis: performance of our contract with you.
• To keep the account secure — sign-in, password reset, rate limiting, fraud and abuse prevention. Basis: our legitimate interest in preventing unauthorised access to your financial records, and our legal obligation to keep them secure.
• To send you the emails the service depends on — sign-in codes, password resets, address verification. Basis: contract.
• To send optional summaries — the email or Telegram digest, only if you switch it on. Basis: your consent, withdrawable at any time in Settings.

We do not sell your data, and we do not share it for advertising. Data reaches a third party only where the service cannot work otherwise, or where you have connected something yourself:

• Brevo (email delivery) — your email address and the contents of messages we send you.
• Market-data providers (Yahoo Finance, Alpha Vantage, Twelve Data, FRED, TMX, SEC EDGAR) — we send them ticker symbols only. They are not told who is asking, and receive no account or personal data.
• Services you connect yourself — a crypto exchange or wallet provider, Telegram, or an AI provider. These are optional and inactive unless you add credentials. Where you enable the AI features, the relevant portfolio figures form part of the request.
• Our hosting provider — a third-party cloud hosting provider.

Your records are kept for as long as your account exists. You can delete your account at any time from Settings; doing so removes your portfolios, holdings, transactions, dividends and stored credentials.

Security and audit records are retained for a limited period after that so we can investigate abuse — no longer than 24 months.

Depending on where you live, you have some or all of the following. We do not charge for exercising them, and we will respond within one month.

• Access — a copy of what we hold about you.
• Portability — your records in a machine-readable format. Your financial history is yours; you can export it whether or not your subscription is active.
• Rectification — correct anything inaccurate. Most of it you can edit directly.
• Erasure — delete your account and its data.
• Objection and restriction — including objecting to preference cookies on our cookies page.
• Complaint — to your local data protection authority. In Canada that is the Office of the Privacy Commissioner; in the UK, the ICO; in the EU, your national authority.

Credentials you store are encrypted at rest. Passwords are hashed, not stored. Access to the production database is restricted to the operator. No system is perfect, and we will tell you promptly if something happens that affects your data.

If this notice changes materially we will say so before the change takes effect, not afterwards. The date at the top always reflects the current version.