Privacy policy

In short: we only collect what we need to make Ripely work. We don't sell your data, we don't track you, and everything stays in the EU. Below you can read exactly how it works.

1. Who are we?

Ripely is a service of [company name], located at [address], registered with the Dutch Chamber of Commerce under number [KvK number]. We are responsible for processing your personal data. Questions? Email [privacy@ripely.eu].

2. Which data do we process?

• Account data: your email address and an encrypted version of your password (we can never see your password itself).
• Security: the secret key for two-step verification (stored encrypted), recovery codes (only as a one-way hash), and for each session your IP address, browser type and sign-in time.
• Your investment data: the lines from the CSV files you upload yourself, like transactions, dividends, fees, prices and balance. We delete the uploaded file itself right after processing it.
• Preferences: your language, theme and whether the menu is collapsed.
• Technical logs: server logs with, among other things, IP address and time, to find errors and abuse. Passwords and codes never end up in the logs.

We never ask for your DEGIRO password and we don't connect to your broker or bank.

3. Why do we process this data?

• To provide the service (performance of the contract): your account, your overview of positions, dividends and diversification, and the emails that come with it, like confirming your email address and resetting your password.
• To keep Ripely safe (legitimate interest): two-step sign-in, limiting sign-in attempts and detecting abuse.

We don't use your data for ads, don't build marketing profiles and don't sell anything.

4. Cookies

We only use functional cookies that Ripely needs to work: one to keep you signed in, one to protect forms and, if you pick a language without an account, one that remembers that choice. We don't use tracking or analytics cookies. That's why there's no cookie banner asking for consent.

5. Where is your data and who helps us?

All your data is stored on servers in the European Union. We work with these parties, with whom we have a data processing agreement:

• Hosting: OVHcloud (OVH SAS), France.
• Backups: OVHcloud makes a daily backup of our server, in the EU.
• Email: Brevo (Sendinblue SAS), France, only to send emails about your account.
• Errors and performance: AppSignal B.V., the Netherlands. When something breaks, AppSignal receives technical data to fix it, like the page and the time. We never send passwords, codes, email addresses or session data.

We don't transfer your data to countries outside the EU.

6. How long do we keep your data?

• Your account and investment data: as long as your account exists. When you delete your account, we delete everything right away.
• Uploaded CSV files: right after processing.
• Accounts with an unconfirmed email address: after 7 days.
• Sessions: 30 days at most.
• Backups: [retention period, for example 30 days] at most. After that, deleted data is gone from the backups too.
• Server logs: [retention period] at most.

7. How do we protect your data?

Everyone signs in with two-step verification. We only use encrypted connections (HTTPS), encrypt sensitive data in the database, limit sign-in attempts and keep our software up to date. Staff only get access when they need it.

8. Your rights

You have the right to access, correct, delete and take your data with you. You can also object to processing. On the Settings page you download all your data yourself (JSON and CSV) and delete your account with everything in it. For the other rights, email [privacy@ripely.eu]; we reply within a month.

Not happy with how we handle your data? You can file a complaint with the Dutch Data Protection Authority, the Autoriteit Persoonsgegevens.

9. Changes

When we update this policy, you'll see a new date at the top. For important changes, we'll email you in advance.