Note⚠️ DRAFT, NOT YET REVIEWED BY A LAWYER. Written by an AI assistant on 2026-10-09 from the legal register as step L9 of the legal plan. Counsel has not read it. Square brackets mark what other steps must supply: the entity (L1), retention periods (L5), the privacy contact and the rights runbook (L6), vendor countries and transfer mechanisms (L7), and the representatives (L12). It is published at netofi.net/privacy since 2026-10-28, before counsel's review, at the product owner's request.
Version: 2026-11-01
1. Who we are#
NetoFi is a crypto portfolio, source-of-funds and tax reporting service at netofi.net, operated by [entity name, legal form, registration number, address — step L1] ("NetoFi", "we").
For the people who sign up to NetoFi for their own portfolio, NetoFi is the controller of their personal data. When an accountant or firm uses NetoFi for its own clients, the firm is the controller of its clients' data and NetoFi processes it on the firm's instructions under a data processing agreement; a client of such a firm should address privacy requests to the firm first.
Privacy contact: [[email protected] — step L6; until it exists, [email protected]]. EU representative: [name and address, or "not required" — step L12]. UK representative: [name and address, or "not required" — step L12].
2. Whose data this covers#
| You are | What this policy covers |
|---|---|
| A user with an account | Everything in section 3 |
| A visitor to netofi.net who never signs in | The visit record (row 8); we set no cookie on a visitor |
| Someone a user invited to share a portfolio | Your email, until you sign in or the owner removes it (row 11) |
| Someone who filled a pilot, demo or quote form | The form's fields (row 10) |
| Someone whose wallet address appears in a user's history | The address and the transactions that touch it (row 2) |
3. What we collect, why, and on what basis#
| # | Data | Why | Lawful basis [to confirm with counsel, Q5] |
|---|---|---|---|
| 1 | Your email address, and from Google or Microsoft your name and picture when you sign in with them | To sign you in, to tie your portfolios to you, and to reach you about your account | Performing our contract with you |
| 2 | Wallet addresses you add, and the addresses of the counterparties in their history | To read your history from public blockchains and build your reports | Contract (yours); our legitimate interest in giving you a complete history (counterparties) |
| 3 | Exchange API keys and secrets you give us | To read your exchange account. We ask for read-only keys and store them encrypted | Contract |
| 4 | Your transactions, holdings, tax results, saved tax-year snapshots and tax settings | The service itself | Contract |
| 5 | Exchange export files you upload | To read history that an exchange offers no other way | Contract |
| 6 | How you use the product: actions, pages, errors and timings, tied to your email | To find bugs, keep the service fast and see which features are used | Legitimate interest |
| 7 | Bug reports you send: your text, a screenshot and the tab, tied to your email and portfolio | To reproduce and fix the problem you reported | Legitimate interest; contract |
| 8 | Landing-page visits: a random id for that one visit, the page, the referring site, campaign tags, country, device type, and a salted hash of your network address | To count visits and see which campaigns bring people | Legitimate interest [to confirm] |
| 10 | Pilot, demo and quote forms: name, firm, email, number of clients, your note | To answer you | Steps you asked for before a contract; legitimate interest |
| 11 | An email address a user typed to share a portfolio | To let that person in when they sign in | The inviting user's contract; our legitimate interest |
| 12 | Payments for address labels: your deposit wallet, the charges, and the addresses looked up | To run your prepaid balance | Contract |
| 13 | Sign-in records and server logs: times, network address, browser | Security and abuse prevention | Legitimate interest |
| 14 | The activity log of each portfolio: who added, replaced or removed an exchange key, uploaded a file, downloaded a report, deleted something, changed a setting or a member, or opened it as support, when, from which network address and which browser. It names a key by its last four characters and never holds a secret, a file's contents or a wallet address | So the portfolio's owner can see who did what to their data, and so we can investigate a security incident. Only the owner sees a portfolio's log | Legitimate interest |
We do not sell personal data, use it for advertising, or make decisions about you by automated means that have legal or similar effects.
4. Cookies and similar storage#
| Name | What it does | Kept |
|---|---|---|
__session, __client_uat |
Clerk's sign-in session; strictly necessary | The session lasts 7 days; the token inside is renewed every minute |
portfolio, netofi_last_tab, in your browser's local storage, not a cookie |
Remember which portfolio and tab you opened last | Until you clear your browser's site data |
pilot_email and one session-storage key |
Carry your email to the pilot form; read once and cleared | Until read |
| Cloudflare's bot-protection cookies | Tell people from automated traffic; strictly necessary | Set by Cloudflare |
The site loads two outside scripts, both for sign-in: Clerk's, from clerk.netofi.net, and Cloudflare Turnstile's bot check, shown when a new email signs up.
5. Who receives it#
We share personal data only with the vendors that run parts of the service for us, each for the purpose shown.
| Recipient | What | Why | Where [step L7] | Safeguard [step L7] |
|---|---|---|---|---|
| Google Cloud | Everything above | Hosting, in Belgium | EU | — |
| Clerk | Email, name and picture from Google or Microsoft, sign-in records, network address | Sign-in and sign-in code emails | US | [DPF or SCCs] |
| Cloudflare | Visit records, product telemetry, network traffic, mail routing | Delivering the site, security, monitoring | [ ] | [ ] |
| Google Workspace | Form fields, our email with you | Forms and support mail | [ ] | [ ] |
| GitHub | The text of bug reports, without your email | Tracking fixes, in a private repository | [ ] | [ ] |
| Arkham Intelligence | Wallet and counterparty addresses, when you buy labels | Address labels | [ ] | [ ] |
| Blockchain data providers ([list — step L7]) | Wallet addresses, never your name or email | Reading your history | [ ] | [ ] |
| Exchanges you connect | Your own API key, to read your account | Reading your history | The exchange's | Your contract with it |
We may also disclose data when the law requires it, or to protect NetoFi or others from fraud or abuse.
6. Transfers outside Israel and the EU#
Some recipients are in the United States or other countries. Where a transfer needs a safeguard, we rely on the EU-US Data Privacy Framework where the vendor is certified, and on the EU standard contractual clauses (with the UK addendum) otherwise. [Confirmed per vendor by step L7.]
7. How long we keep it#
[Periods set by step L5 on 2026-11-01; tax-record periods wait on counsel, Q6.]
| Data | Kept |
|---|---|
| Your account, portfolios, histories and reports | While your account exists. When you delete a portfolio it is erased from our servers at once, and its last backup copy within 35 days [tax-record periods after you leave: counsel, Q6] |
| Product telemetry | 28 days for request timings, 365 days for actions and syncs |
| Landing-page visits | 365 days |
| Bug reports | One year from when you send one, and never after you delete the portfolio it is about. The issue we track the fix in names no person and stays |
| Form submissions | Until you ask us to delete them |
| Share invitations | Until the invitee signs in or the owner removes it |
| The activity log (row 14) | 2 years, then deleted. When you delete a portfolio its log stays for that period, but within 28 days your email, network address and browser are removed from it |
| Backups of a portfolio | 60 days for older versions while the portfolio exists; up to 35 days after you delete it |
| Server logs (row 13) | 28 days. Sign-in records are kept by our sign-in provider for its own period [Clerk's period: L7] |
| Address labels you buy | The label of an address is kept, with nothing that says who asked for it. Your purchases and charges are kept as billing records [period: counsel, Q6] |
8. Security#
Exchange keys are encrypted at rest and opened only in memory; they never appear in logs. Every request is checked against your signed-in session at the edge and again by our server. The server is not reachable from the internet except through an encrypted tunnel, and production is changed only by a person, by hand. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.
9. Your rights#
You can ask us to:
- tell you what we hold about you and give you a copy;
- correct it;
- delete it, or your whole account;
- give it to you in a portable format;
- stop or restrict a use, or object to a use based on our legitimate interest;
- withdraw a consent you gave, at any time.
Write to [the privacy contact]. We answer within one month. You can delete a portfolio yourself, in the app, today; [account deletion and export: step L6, then buttons in L18].
You can also complain to a regulator: in Israel, the Privacy Protection Authority; in the EU, the data protection authority of your country; in the UK, the Information Commissioner's Office.
10. Children#
NetoFi is not meant for anyone under 18, and we do not knowingly collect their data.
11. Changes#
When we change this policy we update the date at the top, and if the change matters we update the version at the top and ask signed-in users to accept it again, together with our terms of service.