Privacy Policy

1. Controller Identity & Contact

The data controller is TURIAN OVIDIU - TNM S.R.L., CUI 41160580, VAT RO41160580, ONRC J2019000673316, registered seat Str. Onisifor Ghibu nr. 26, Stables Office, birou PD02, parter, Cluj-Napoca, jud. Cluj, România. Contact: privacy@rhope.app.

2. Data-Protection Contact / DPO

For privacy questions, contact privacy@rhope.app. A Data Protection Officer is not mandatory for a service of this size; we will state here if one is appointed.

3. Scope & EU Establishment

We are established in the EU (Romania), so no Article 27 EU representative is required. This policy covers personal data processed through the rhope website and applications.

4. Categories of Personal Data

• Account data: email address and name.
• Authentication identifiers (via Supabase, Google, or Apple).
• Billing identifiers — handled by Stripe; we do not store your card data.
• Product usage and analytics data.
• Your inputs: watchlists and portfolio entries.
• IP address, device, and log data.
• Cookies / local storage (theme, density, and session state).

5. Purposes & Legal Bases

• Providing the Service — performance of a contract (Art. 6(1)(b)).
• Billing, tax, and record-keeping — legal obligation / contract.
• Security, fraud prevention, and product analytics — legitimate interests (Art. 6(1)(f)).
• Marketing email, where applicable — consent (Art. 6(1)(a)).

6. Cookies & Local Storage

We use only strictly necessary storage: an authentication/session cookie and your theme and density preferences (kept in your browser's local storage). We do not use advertising cookies or third-party tracking cookies.

Any usage analytics we use are cookieless and store no personally identifiable information, and our error-monitoring is configured to set no cookies and to minimise personal data. Because we set no non-essential cookies, no cookie-consent banner is required under Law 506/2004; you can still block cookies via your browser settings.

7. Recipients, Processors & Sub-Processors

We share personal data with the following recipients, as processors unless noted otherwise:

We do not store your payment card information — Stripe handles it. We also obtain market data from third-party providers (Financial Modeling Prep, Finnhub, and Massive); we send them only instrument queries such as ticker symbols and never your personal data, so they are not recipients of your personal data.

8. International Data Transfers & Safeguards

Some recipients are located outside the EEA. Where that is the case, transfers are made under an appropriate Article 46 safeguard — the Standard Contractual Clauses or, where applicable, the EU–US Data Privacy Framework, as applicable to each recipient. You can request a copy of the relevant safeguard from us.

9. Data Not Obtained From You

When you sign in with Google or Apple, we receive limited profile data about you from those providers. Our Situations news feed processes third-party content (news, posts) — which we summarise using OpenAI — that may contain personal data of individuals who are not users. This content pipeline does not receive your account data; where it processes a third party's personal data, our legal basis is our legitimate interest in providing news information (Art. 6(1)(f)), subject to the Article 14(5) exemptions.

10. Data Retention

We keep account data while your account is active and for a limited period after closure. Billing and tax records are retained for the period required by Romanian law. Logs are short-lived.

These retention periods apply to records under our control. Records of your purchases held by our merchant of record (Sold through Link, LLC / Stripe) are retained under Stripe's own policies; if you make an erasure request to Stripe, Stripe may delete those records — including the copies in our payment systems — and notifies us when it does.

11. Your Rights

You have the right to:

• access your personal data;
• rectify inaccurate data;
• erase data ("right to be forgotten");
• restrict or object to processing (including under Art. 6(1)(f));
• data portability;
• withdraw consent at any time.

To exercise these rights, contact privacy@rhope.app. We respond within the statutory timeframe.

12. Right to Lodge a Complaint

You may complain to the Romanian supervisory authority (ANSPDCP) or to the authority in your country of residence.

13. Is Provision Mandatory?

Some data is required to use the Service — for example, an email address is needed to create an account. Without it we cannot provide the account.

14. Automated Decision-Making / Profiling

We do not carry out automated decision-making that produces legal or similarly significant effects on you.

15. Security

We use HTTPS across the Service (via Cloudflare), row-level security in our database, scoped API access, and we do not store card data.

16. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children.

17. California & U.S. Residents

We do not sell or share your personal information for money or for cross-context behavioural advertising. If you are a California resident, you have the right to know what personal information we hold about you, to request its deletion, to correct it, and to opt out of any sale or sharing (we do not sell or share, but you may still send a request). You will not be discriminated against for exercising these rights. To make a request, contact privacy@rhope.app. These rights are in addition to the rights in Section 11.

18. Changes to this Policy

We may update this policy. We will notify you of material changes; the "last updated" date and version above govern.

19. Contact

TURIAN OVIDIU - TNM S.R.L. · privacy@rhope.app