Our Commitment to Data Protection

We understand that financial data is among the most sensitive information you can share. Our platform is built on industry-leading security practices and complies with major data protection regulations worldwide.

GDPR Compliance (EU Users)

We fully comply with the General Data Protection Regulation (GDPR) for all European Union users.

Your Rights Under GDPR:

✓Right to Access: Request a copy of all personal data we hold about you
✓Right to Rectification: Correct any inaccurate personal data
✓Right to Erasure ("Right to be Forgotten"): Request deletion of your data
✓Right to Data Portability: Receive your data in a machine-readable format
✓Right to Restrict Processing: Limit how we use your data
✓Right to Object: Object to certain types of processing

Legal Basis for Processing: We process your data based on your consent and our legitimate interest in providing retirement planning services. You can withdraw consent at any time.

Security Measures

Encryption Standards

•AES-256 encryption at rest
•TLS 1.3 encryption in transit
•Encrypted database backups

Access Controls

•Multi-factor authentication
•Role-based access control (RBAC)
•Regular security audits

Data Storage & Retention

Where We Store Data: Your financial data is stored in Supabase's secured cloud infrastructure with redundant backups and encryption at rest.

How Long We Keep Data: We retain your personal and financial data for as long as your account is active. If you delete your account, all personal data is removed within 30 days, except where we're legally required to retain certain information.

Anonymized Data: We may retain anonymized, aggregated data for research and service improvement purposes. This data cannot be linked back to you.

Data Sharing & Third Parties

We Never Sell Your Data

Your financial information is never sold to third parties, advertisers, or data brokers. Period.

Service Providers: We work with trusted service providers for hosting, analytics, and customer support. All providers are contractually bound to protect your data and comply with GDPR.

Legal Requirements: We may disclose information if required by law, court order, or government regulation.

Exercise Your Rights

To exercise any of your data protection rights:

Email us: privacy@freefinancialplan.com

Include: Your name, email, and specific request

Response Time: We'll respond within 30 days (as required by GDPR)

Certifications & Standards

TLS Encryption

Data encrypted in transit

Data Control

Export or delete anytime

No Data Selling

Your data stays yours

Data Protection Officer

For privacy-related inquiries or to exercise your rights:

Email: dpo@freefinancialplan.com

Privacy Portal: Available in account settings

EU users can also file a complaint with their local data protection authority.