Privacy policy

In short: we only collect what we need to make Ripely work. We don't sell your data, we don't track you, and everything stays in the EU. Below you can read exactly how it works.

1. Who are we?

Ripely is a service of Studiooo (sole proprietorship), Lijsterbes 11, 7623 ZP Borne, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 60030887. We are responsible for processing your personal data. Questions? Email hello@ripely.nl.

2. Which data do we process?

• Account data: your email address and an encrypted version of your password (we can never see your password itself).
• Security: the secret key for two-step verification (stored encrypted), recovery codes (only as a one-way hash), and for each session your IP address, browser type and sign-in time.
• Your investment data: the lines from the CSV files you upload yourself, like transactions, dividends, fees, prices and balance. We delete the uploaded file itself right after processing it.
• Your accounts: the names you give your investment accounts and whether one is a pension account.
• Preferences: your language, theme, which account you look at and whether the menu is collapsed.
• Technical logs: server logs with, among other things, IP address and time, to find errors and abuse. Passwords and codes never end up in the logs.

We never ask for your DEGIRO password and we don't connect to your broker or bank.

3. Why do we process this data?

• To provide the service (performance of the contract): your account, your overview of positions, dividends and diversification, and the emails that come with it, like confirming your email address and resetting your password.
• To keep Ripely safe (legitimate interest): two-step sign-in, limiting sign-in attempts and detecting abuse.

We don't use your data for ads, don't build marketing profiles and don't sell anything. We don't make automated decisions about you that affect you.

Your email address and password are needed for an account. Without them, you can't use Ripely.

4. Cookies

We only use functional cookies that Ripely needs to work: one to keep you signed in, one to protect forms and, if you pick a language without an account, one that remembers that choice. We don't use tracking or analytics cookies. That's why there's no cookie banner asking for consent.

5. Where is your data and who helps us?

All your data is stored on servers in the European Union. We work with these parties, with whom we have a data processing agreement:

• Hosting: OVHcloud (OVH SAS), France.
• Backups: OVHcloud makes a daily backup of our server, in the EU.
• Email: Brevo (Sendinblue SAS), France, only to send emails about your account.
• Errors and performance: AppSignal B.V., the Netherlands. When something breaks, AppSignal receives technical data to fix it, like the page and the time. We never send passwords, codes, email addresses or session data.

We choose parties that process your data in the EU. If one of them does use a service outside the EU, that is only allowed with the safeguards the GDPR requires, like the EU standard contractual clauses.

6. How long do we keep your data?

• Your account and investment data: as long as your account exists. When you delete your account, we delete everything right away.
• Uploaded CSV files: right after processing.
• Accounts with an unconfirmed email address: after 7 days.
• Sessions: 30 days at most.
• Backups: 7 days at most. After that, deleted data is gone from the backups too.
• Server logs: we only keep the newest logs, 30 MB per part at most. Older lines are overwritten automatically, usually within a few days.

7. How do we protect your data?

Everyone signs in with two-step verification. We only use encrypted connections (HTTPS), encrypt sensitive data in the database, limit sign-in attempts and keep our software up to date. Only we have access to the server, and only with a personal key.

8. Your rights

You have the right to access, correct, delete and take your data with you. You can also ask us to restrict processing, or object to it. On the Settings page you download all your data yourself (JSON and CSV) and delete your account with everything in it. For the other rights, email hello@ripely.nl; we reply within a month.

Not happy with how we handle your data? You can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

9. Changes

When we update this policy, you'll see a new date at the top. For important changes, we'll email you in advance.