1. Controller
4vor4 UG (haftungsbeschränkt)Bromberger Straße 20
25474 Ellerbek
Germany
Email: Email address is displayed in the browser
Further mandatory information is available in our legal notice.
2. foluno's privacy principle
foluno generally processes the wealth data you enter within your current browser session. Positions, holdings, valuations, valuation dates, groups, and change histories are currently stored neither in a foluno user account nor in a foluno database. This data may be lost when the session is closed or reloaded.
To use your data again later, you can export a backup file and store it locally on your device. foluno has no access to its storage location or to backup copies that you manage afterwards.
3. Hosting by Vercel and technical logs
foluno is delivered through Vercel. The hosting and infrastructure provider is Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. When the website is accessed, Vercel processes technically necessary connection and usage data. This may include the IP address, time and destination of the request, referrer, browser and device information, approximate location based on the IP address, and status, diagnostic, and error data.
Static content is delivered through Vercel's global Edge Network. Server functions execute in the regions configured for the Vercel project; processing exclusively within the EU or EEA is not currently guaranteed. Processing may therefore take place in the United States in particular. Vercel identifies the EU-U.S. Data Privacy Framework and, where required, the EU Standard Contractual Clauses as transfer mechanisms.
Vercel currently makes runtime logs available for one hour (Hobby), one day (Pro), three days (Enterprise), or up to 30 days with Observability Plus, depending on the subscribed plan. The subscribed plan is authoritative. Unless longer statutory retention or preservation of a specific incident is required, logs are not processed for longer than necessary for operation, security, and error analysis.
The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is the secure, stable, and abuse-resistant operation of the service. Further information is available in Vercel's Privacy Notice and its Data Processing Addendum.
4. Local settings and necessary cookies
foluno currently uses only technically necessary storage:
This storage is necessary for the functionality you request (Section 25(2)(2) TDDDG). Where the information is personal data, processing is necessary to provide the service or is based on our legitimate interest in consistent and protected use (Article 6(1)(b) or (f) GDPR). foluno currently uses no advertising, profiling, or analytics cookies.
5. foluno account and license management through Supabase
No account is required for Free. To buy or manage Private Premium, you create a foluno account with your email address. Passwordless authentication with a numeric email code, session management, and the license database are provided through Supabase. The service provider is Supabase, Inc.
This involves processing your email address, a technical user ID, authentication and session data, and, where applicable, technical security and log data. For license management we store only the plan and license status, license source and any expiry date, voucher and redemption identifiers, Creem customer, order, checkout, and product identifiers, and purchase, redemption, and update timestamps. Entered voucher codes are stored only as a non-reversible verification value. Portfolios, positions, holdings, values, groups, valuation dates, histories, and export files are not stored in Supabase and are not linked to your identity.
Sign-in codes are delivered through Resend, a service provided by Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA. Resend processes in particular your email address, message content, and delivery metadata. According to Resend, this data is stored in the United States; Resend identifies the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses as transfer mechanisms. Open and link tracking are disabled for these authentication emails. Further information is available in Resend's Privacy Policy and its Data Processing Addendum.
Processing is necessary to take steps before and perform the user or license contract (Article 6(1)(b) GDPR) and to protect account access and prevent abuse based on our legitimate interests (Article 6(1)(f) GDPR). Account and license data is generally retained while the account exists or the license and resulting claims need to be administered; statutory retention duties and the establishment, exercise, or defence of legal claims remain unaffected. Further information is available in Supabase's Privacy Policy.
You can delete your foluno account yourself in the account settings. This deletes the authentication user and the associated license, checkout, and code-redemption data from our Supabase database. Data that Creem must retain as merchant of record to comply with its own legal obligations remains unaffected.
6. Ordering and payment through Creem
Private Premium is offered through Creem, Armitage Labs OÜ, registry code 16977866, Rotermanni 14, 10111 Tallinn, Estonia, as merchant of record and contractual reseller for the transaction. In checkout, Creem processes in particular name, email address, billing address, payment details, order, and transaction data for ordering, payment, invoicing, taxes, refunds, fraud prevention, and legal obligations.
foluno sends Creem the signed-in account's email address, a technical reference to that account, and the product identifier. Creem returns the customer, order, checkout, and product identifiers and the payment, refund, or dispute status required to manage the license. We do not receive complete card or bank details. The legal basis is Article 6(1)(b) GDPR; legally required retention is based on Article 6(1)(c) GDPR. Details and retention periods for Creem's processing are available in Creem's Privacy Notice. Additional contractual information about ordering is available in Section 8 of our Terms of Use.
7. Market, instrument, and currency data
When you start a live search or price update, foluno sends the search query or an instrument identifier through a server-side interface to external market or instrument data providers. This recipient category includes providers of securities reference data, prices, and compositions. The providers used may change where data coverage, quality, or availability requires it.
For currency conversion, foluno uses the Frankfurter API. The base currency, target currency, and, where applicable, a date are sent to the service. According to the service, the reference rates provided originate from the European Central Bank and other central banks.
Your holdings, quantities, manually entered values, groupings, and total wealth are not transmitted. The external providers receive the relevant request from our server rather than directly from your browser. The legal basis is Article 6(1)(b) GDPR where the request forms part of the requested function and Article 6(1)(f) GDPR for the reliable provision of current data.
You can request current information about the specific recipients using our contact address. Any processing outside the EU or EEA takes place only subject to the requirements of Articles 44 et seq. GDPR.
8. Minimal usage and purchase events and no AI analysis
When a wealth overview is successfully created or imported from a backup file, or when Creem confirms a successful Private Premium purchase, foluno sends a minimal event through a server-side interface to a Discord channel operated by us. The message contains only the event type “Portfolio created”, “Portfolio imported”, or “Private Premium purchased” and, for a purchase, whether it was a test or live transaction. It does not contain an email address, name, account or order identifier, the name or contents of the wealth overview, file name, positions, holdings, values, groups, device identifiers, or any other wealth data.
Discord receives the message from our server rather than directly from your browser. The recipient is Discord Netherlands B.V., Schiphol Boulevard 195, 1118 BG Schiphol, Netherlands; according to Discord, further processing may also take place in the United States. Discord identifies the EU-U.S. Data Privacy Framework and Standard Contractual Clauses as relevant transfer mechanisms. Further information is available in Discord's Privacy Policy.
The events are used solely to understand the use of these two core functions in broad numbers and to assess product operation. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is the needs-based development and secure operation of foluno. No cross-session user profiles are created. foluno does not sell or share your wealth data for advertising. Wealth data entered in foluno is neither transmitted to nor analysed by an AI model. No automated decision-making within the meaning of Article 22 GDPR takes place.
9. Contacting us
If you contact us by email, we process your sender address, message content, and any other information you provide to handle your request. The legal basis is Article 6(1)(b) GDPR for pre-contractual or contractual matters and otherwise Article 6(1)(f) GDPR. We delete this data once your request has been resolved unless statutory retention duties or legitimate reasons require continued storage.
10. Recipients and retention
Recipients of personal data may include Vercel as the hosting and infrastructure provider, Supabase for authentication and license management, Resend for delivering sign-in codes, Creem for ordering and payment, the categories of external data providers described in Section 7, the Frankfurter API identified there, and Discord for the minimal usage events described in Section 8. We also disclose data where legally required or necessary to establish, exercise, or defend legal claims.
Wealth data in the current browser session is not permanently stored by foluno on a server. Other data is retained for the periods described in the relevant sections. Where no specific period is stated, we store data only for as long as the purpose continues and afterwards only to the extent required by statutory retention duties or ongoing legal claims.
11. Your rights and right to lodge a complaint
Subject to the GDPR, you have rights including access, rectification, erasure, restriction of processing, data portability, and objection. You may withdraw consent at any time with effect for the future. To exercise your rights, send a message to Email address is displayed in the browser.
You may also lodge a complaint with a data protection supervisory authority. Our competent authority is, in particular, the Independent Centre for Privacy Protection Schleswig-Holstein (ULD), Holstenstraße 98, 24103 Kiel, Germany. Information and contact details are available at datenschutzzentrum.de.
12. Security and changes
We use appropriate technical and organisational measures to protect data against loss, manipulation, and unauthorised access. No internet-based service can guarantee absolute security. We update this policy when functions, providers, or legal requirements change. The version published on this page is authoritative.