Privacy Policy

This Privacy Policy describes how Bodri Tamás EV("we", "us", "our") collects, uses, shares and protects personal data when you visit returnolio.com, use the application at app.returnolio.com, or otherwise interact with us (the "Service"). It is written to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1. Data controller

Bodri Tamás EV (sole proprietor), Hajnal utca 10., 2000 Szentendre, Hungary, EU. Tax number: 92208980-1-33. For all data-protection matters, contact support@returnolio.com.

2. What personal data we collect

2.1 Marketing site (returnolio.com)

• Anonymous page-view, scroll-depth and click events (only with your consent);
• Theme preference (functional, no consent required);
• A campaign tag (utm_source, utm_medium, utm_campaign) when the link you arrived by carries one. On this site it stays in your address bar and is not stored; it is passed along on the links to the app and on a Stock Deep Dive request, and section 2.2 says what happens to it there;
• A visit tally per day, page and source type (search engine, AI assistant, social network, newsletter, direct or other), kept as plain counts with no IP address, cookie, user ID or browser details, so it cannot identify you and needs no consent;
• Information you submit in support tickets (name, email, message).

2.2 Application (app.returnolio.com)

• Account data: email address, password (stored only as a hash), authentication metadata;
• Profile data: display name, optional preferences (digest cadence, time zone);
• Usage data: which pages you visit, which tickers you search, alert and watchlist activity;
• Portfolio data, if you choose to use the My Portfolio feature: holdings, cash positions and transactions you input;
• Billing data via our payment provider: name, billing address, last 4 digits of card and processor token (we never see full card numbers);
• Acquisition data: the campaign tag your sign-up link carried, so we know which page or post brought you. Kept on your account and, if you subscribe, on the subscription record; never shared;
• Support data: messages you send us and our replies;
• Technical data: IP address, browser, OS, device type, server logs (security and abuse prevention);
• A visit tally per day, page and source type (search engine, AI assistant, social network, newsletter, direct or other), kept as plain counts with no IP address, cookie, user ID or browser details, so it cannot identify you and needs no consent.

3. Why we process this data (legal basis)

4. How long we keep it

• Active account data: while your account is open;
• Deleted account data: 30 days after deletion request, except where law requires longer retention;
• Billing & tax records: 8 years (Hungarian tax law);
• Support conversations: 24 months after closure;
• Server logs: 30 days rolling;
• Visit tallies: kept as long as we publish, since they contain no personal data;
• Marketing analytics events: 12 months;
• Consent records: 6 months from last interaction.

5. Who we share data with (sub-processors)

We use the following carefully selected sub-processors:

• Hetzner Online GmbH (Germany, EU) - hosting and infrastructure;
• Cloudflare, Inc. - DDoS protection, CDN (EU edge nodes; SCCs in place);
• Paddle.com Market Limited (30 Old Bailey, London EC4M 7AU, United Kingdom) and its group entities in Ireland, the United States and Canada - merchant of record, payment processing and subscription billing. As merchant of record Paddle is the seller for your purchase and an independent controller of your payment data;
• Hostinger Operations Limited - domain mailbox hosting and outgoing transactional email (digests, password resets, support replies);
• Microsoft Ireland Operations Limited (Clarity) - usage analytics and session recording on the marketing site, loaded only after you accept analytics cookies;
• Resend, Inc. (United States) - delivery of the newsletter and of the free analysis you request, for the email address you give us when you subscribe or ask for a report. The subscriber list itself is held on our own servers at Hetzner, not at Resend;
• Licensed financial data providers - market and fundamentals data sources (we do not share your personal data with them; they receive only aggregate, anonymous server-to-server requests).

We do not sell, rent, or trade your personal data. Beyond the sub-processors above we share data only when required by law, court order, or to defend our rights, and we will, where lawful and practicable, notify you first.

6. International data transfers

Cloudflare, Paddle, Hostinger, Microsoft and Resend may process data outside the European Economic Area. Such transfers are protected by EU Standard Contractual Clauses (SCCs) and supplementary security measures (encryption in transit and at rest). You can request a copy of the applicable SCCs by writing to support@returnolio.com.

7. Cookies and similar technologies

A cookie is a small text file your browser stores when you visit a site. We use cookies and related browser-storage technologies (local storage, session storage, web beacons, SDK identifiers) and apply the absolute minimum needed to keep the Service usable and - only with your consent - to measure how people find and use it.

7.1 Categories

7.2 Specific cookies

7.3 What we do NOT use

• Device fingerprinting;
• Third-party advertising trackers without explicit opt-in;
• Behavioural ad pixels (Meta Pixel, Google Ads tag) without consent.

7.4 Session recording (Microsoft Clarity)

If you accept analytics cookies, we load Microsoft Clarity. It records how a page gets used: clicks, scrolling, mouse movement, and the order you visited pages in. We watch those recordings to find where a page confuses people, and for nothing else.

Clarity masks text you type, so form fields are not captured. It runs only on this marketing site. It is not loaded inside the app at app.returnolio.com, so your portfolio, watchlist and holdings are never recorded. Reject analytics cookies and it does not load at all.

7.5 Managing your preferences

On your first visit, the cookie banner asks for consent for analytics and marketing cookies. To change your choice, clear your site cookies for returnolio.com - the banner will reappear on your next visit. If you reject non-essential cookies, the Service continues to work; some convenience features (e.g. ad-attribution credit on signup) simply won't be available.

7.6 Do-Not-Track & Global Privacy Control

We honour the Global Privacy Control (GPC) signal: if your browser sends GPC, we treat it as opting out of all non-essential cookies, regardless of any prior banner choice.

7.7 Embedded third-party content - TradingView charts

Individual ticker pages in the app embed a price chart rendered by TradingView, Inc. The widget loads its own JavaScript from TradingView's CDN and does not set first-party cookies on returnolio.com. When the chart loads, TradingView's servers receive your IP address and the symbol being displayed; this processing is governed by TradingView's own privacy policy. You can block the embed with any standard ad-blocker or by blocking s3.tradingview.com; the rest of the page continues to work and a fallback message is shown in place of the chart.

7a. Automated decision-making

Returnolio does not subject any user to a decision based solely on automated processing that produces legal or similarly significant effects, within the meaning of GDPR Art. 22 (and equivalent provisions). Our scoring, ranking and analytical outputs (RTEP, Top-10, fair-value) are decision-support tools to inform your human decisions; they do not by themselves produce any binding outcome for you, your account, or any third party.

8. Security

We protect personal data with industry-standard measures, including TLS encryption in transit, encryption at rest for backups, hashed passwords (bcrypt), least-privilege access controls, multi-factor authentication on admin accounts, and regular security reviews. No method of transmission or storage is 100% secure; if a personal-data breach occurs, we will notify the Hungarian DPA (NAIH) and affected users in line with GDPR Art. 33 - 34.

9. Children

The Service is not directed at, and we do not knowingly collect data from, children under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

10. Your rights

Subject to applicable law and identity verification, you can ask us to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data;
• Delete your data (right to be forgotten), where retention is not legally required;
• Restrict certain processing;
• Object to processing based on legitimate interests;
• Data portability - receive your data in a structured, machine-readable format;
• Withdraw consent at any time, without affecting prior lawful processing;
• Lodge a complaint with the Hungarian DPA (NAIH) at naih.hu or your local EU supervisory authority.

To exercise a right, email support@returnolio.com from the address on your account. We respond within 30 calendar days, as the GDPR requires.

11. U.S. residents - state privacy rights

Although we are based in the EU, we serve a significant U.S. readership and we extend to all U.S. residents the rights described below, regardless of state of residence. If your state's law grants broader rights, those broader rights apply.

11.1 California (CCPA / CPRA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act:

• Right to know what personal information we have collected, the categories of sources, the business or commercial purpose, the categories of third parties with whom we share, and the specific pieces of personal information;
• Right to delete personal information we hold, subject to exceptions;
• Right to correct inaccurate personal information;
• Right to limit the use of "sensitive personal information" to purposes specified by the CPRA;
• Right to opt out of the "sale" or "sharing" of personal information for cross-context behavioural advertising;
• Right to non-discrimination - we will not deny, charge differently for, or provide a different level of service in response to your exercise of any privacy right;
• Right to an authorised agent - you may designate someone to submit requests on your behalf.

Do Not Sell or Share My Personal Information. We do not sell personal information for money. We do not engage in "cross-context behavioural advertising" through third-party ad networks, except where you have provided opt-in consent through our cookie banner; if you have given such consent, you may withdraw it at any time by visiting our cookie preferences (footer link) or by emailing support@returnolio.com. We honour the Global Privacy Control (GPC) signal as a valid opt-out.

Categories of personal information collected over the past 12 months (CCPA Cal. Civ. Code § 1798.140(v) categories):

• Identifiers - email address, account ID, IP address;
• Customer records (Cal. Civ. Code § 1798.80(e)) - name and billing address (via payment processor only);
• Commercial information - subscription tier, billing history, products purchased;
• Internet or other electronic activity - page views, scroll depth, click events, in-app interactions;
• Geolocation data - approximate (city / country), derived from IP only; no precise GPS;
• Audio / visual - none collected;
• Professional or employment - none collected;
• Education information - none collected;
• Inferences - preferred theme, digest cadence, broad reading interest (derived from page-view patterns where consented);
• Sensitive personal information (Cal. Civ. Code § 1798.140(ae)) - none collected; we do not process biometric, precise geolocation, racial or ethnic origin, religious beliefs, sexual orientation, union membership, contents of mail/email/text without consent, genetic, citizenship or immigration data;
• User-provided submissions - content of support tickets, watchlist contents, optional My Portfolio holdings.

Personal information may be transferred to and stored in the United States by our payment processor (Paddle.com Inc., New York) and email provider, under EU Standard Contractual Clauses with supplementary encryption.

How to exercise California rights: email support@returnolio.com with the subject line "California privacy request". We will verify your identity (email match plus, where appropriate, a one-time code) and respond within 45 days.

11.2 Other U.S. states

If you are a resident of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon, Montana, Iowa or any other U.S. state with a comprehensive consumer privacy law, you have rights substantially similar to those described for California - typically including the rights to access, correct, delete, port, opt out of targeted advertising, and appeal a denied request. Use the same email channel above; specify your state in the subject line and we will route your request appropriately.

11.3 Children - COPPA

The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13 in compliance with the U.S. Children's Online Privacy Protection Act (COPPA). If you believe we have collected information from a child under 13, please contact us immediately and we will delete it.

11.4 Nevada

Under Nevada Revised Statutes Chapter 603A, Nevada residents may request that we not sell certain personal information. We do not sell personal information; you can confirm or update this preference by emailing support@returnolio.com.

12. Changes

We may update this Privacy Policy from time to time. Material changes will be announced by email or in-app notice at least 14 days in advance. The "Last updated" date above is always current.