Draft for review. This text was prepared for approval by the operator and a qualified lawyer before the public launch. Items marked To be confirmed are still open.
Privacy policy
Last updated: 12 October 2026
Opes is a private dashboard for tracking your assets, bank balances and income. This policy explains what personal data we hold, why, who else handles it, how long we keep it and how you can control it. It applies to the EU General Data Protection Regulation (GDPR), the French Data Protection Act and the UAE Personal Data Protection Law (PDPL).
1. Who is responsible
The data controller is To be confirmed: legal name of the operating company or individual, To be confirmed: registered address and registration number. Contact for any privacy question or request: contact@opeswealth.app. To be confirmed: Data protection officer or EU/UK representative, if one is required.
2. What we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Account: email, name, password (stored only as a hash by our authentication provider), second-factor and passkey registrations, language and display preferences | Create and secure your account, sign you in, send security emails | Contract; legitimate interest (security) |
| Wealth records you enter or import: assets, valuations, loans, co-ownership shares, bank accounts, transactions, income streams, plans, notes and uploaded documents (title deeds, statements, contracts) | Provide the dashboard, calculations, charts and reports you ask for | Contract |
| Bank statements and files you upload: the file is read to extract rows; scanned PDFs may be sent to an OCR service (see section 4) | Import your transactions and balances | Contract |
| Sessions and security log: IP address, approximate city, region and country, browser and device type, time of each sign-in and of sensitive actions (export, sharing, deletion, second-factor changes) | Show you where your account is signed in, let you end sessions, detect abuse and investigate incidents | Legitimate interest (security and fraud prevention) |
| Sharing and advisers: the shares you grant, the modules shared, comments and the history of those events; for advisory firms, the firm and adviser identities | Let a person you choose view your dashboard read-only | Your consent (each share is your instruction and can be revoked) |
| Help chat and bug reports: messages you type in the help widget and bug reports you submit | Answer questions and fix defects | Contract; legitimate interest |
| Audience measurement: pages viewed, referrer, country, browser, operating system and device type, collected without cookies by Vercel Web Analytics (the page address can contain the identifier of an item in your account, never amounts or names) | Count visits and find faults or confusing screens, in aggregate; Vercel Speed Insights also records page loading and responsiveness timings to find slow screens | Legitimate interest (service improvement) To be confirmed: lawyer to confirm |
| Bot check: a challenge token and technical signals processed by Cloudflare Turnstile on sign-in, sign-up and password reset | Block automated attacks | Legitimate interest (security) |
We do not sell your data, we do not use it for advertising and we do not build advertising profiles. You can object to audience measurement by writing to the contact in section 1. Opes does not move money and cannot trade on your behalf.
3. Financial and sensitive information
Your wealth records are confidential financial information. They are protected by row-level security in the database (each account can read only its own rows), encryption in transit and at rest, a mandatory second factor, and a private storage area for documents served only through short-lived signed links. Bank connection tokens are encrypted with a separate key. Staff of the operator do not browse client data; access for support or incident investigation is limited to what is necessary and is To be confirmed: logged / to be confirmed.
4. Who else handles your data
We use a small number of service providers (processors) to run the service. They act on our instructions. The full list, with the data each receives and where it is processed, is on the service providers page. Where a provider processes data outside the EU/EEA or the UAE, we rely on the transfer mechanism described there (for example the EU Standard Contractual Clauses).
We may disclose data if the law requires it (for example a court order), and only the minimum needed. If the business is sold or reorganised, your data would transfer to the successor under this policy.
5. Where your data is stored
The database and file storage are hosted by Supabase in the Mumbai (India) region. The web application runs on Vercel, currently configured to serve from Mumbai. To be confirmed: Confirm regions before launch; consider an EU region for EU clients. Because the data is held outside the EU/EEA and the UAE, the transfer safeguards in section 4 apply.
6. How long we keep it
- Account and wealth records: until you delete your account.
- Deleting your account: you can request it in Settings, under Your data. There is a 14-day cooling-off period during which you can cancel. After it, a daily job erases your records, documents and sessions, and anonymises the security-log entries that must remain for integrity.
- Security log and session locations: To be confirmed: retention period, for example 12 months.
- Backups: erased data leaves backups within To be confirmed: backup retention period.
- Legal obligations: if a law obliges us to keep a record longer, we keep only that record.
7. Your rights
You can, at any time and free of charge:
- Access and portability: download everything we hold about you as a machine-readable file (Settings, Your data, Download all my data; the second factor is asked first).
- Rectification: correct your records in the app or ask us to.
- Erasure: delete your account as described in section 6.
- Restriction and objection: object to processing based on legitimate interest, or ask us to restrict it, by writing to the contact in section 1.
- Withdraw consent: revoke any share from the Sharing page.
- Complain: to the supervisory authority: in France the CNIL (cnil.fr); in the UAE the UAE Data Office; or the authority of your own country.
We answer within one month. We may ask you to confirm your identity first.
8. Cookies and local storage
We use only the cookies and browser storage that the service needs. No advertising trackers are used, and the audience measurement tool we use sets no cookies. Details are on the cookies page.
9. Security
Mandatory two-factor authentication, passkeys, 12-character minimum passwords, automatic sign-out after 15 minutes of inactivity, security headers, a bot check on authentication forms, an activity log you can read, and per-device session control. No system is perfectly secure. If a breach is likely to harm you, we will tell you and the competent authority within the legal time limit (72 hours to the authority under the GDPR).
10. Children
Opes is for adults. We do not knowingly collect data from anyone under 18.
11. Changes
When we change this policy in a way that matters, we will notify you in the app or by email before it applies. The date at the top shows the latest version.