Privacy Policy

GeoGM is operated by Álvaro Vidorreta ("GeoGM"), a sole trader established in Spain, who is the controller of your data. Contact for any privacy matter: hola@geogm.org. The tax ID and registered address are in the Legal Notice.

• Account — email, password (encrypted), and name/avatar if you sign in with Google/Facebook/GitHub. To create and maintain your account and authenticate you. Basis: performance of the contract (art. 6.1.b GDPR).
• Profile and preferences — language, theme, terminal configuration, watchlists, notes, calendars, goals. To provide the service and sync it across your devices. Basis: performance of the contract.
• Billing — name, billing address, country, tax/VAT number if you provide one. Card details are collected and held by Stripe; they never reach our servers. To charge your subscription, issue receipts and meet tax obligations. Basis: contract + legal obligation (art. 6.1.c).
• Brokerage connection (optional) — if you connect your broker via SnapTrade: connection identifier, positions, transactions and balances of the accounts you choose to link. To show your real portfolio inside GeoGM. Basis: contract, at your initiative — only if you enable it.
• AI queries — the text of your questions and conversations with the AI features (Jarvis, analysis). To generate the answers you request. Basis: contract.
• Telegram (optional) — your Telegram chat identifier and the content of the alerts you configure. To send you alerts on Telegram. Basis: consent (art. 6.1.a), revocable by disconnecting the bot.
• Technical data — IP address, browser type, technical errors and their context. For security, anti-abuse limits and error diagnosis. Basis: legitimate interest (art. 6.1.f): keeping the service stable and secure.
• Product usage — usage events recorded on our own servers (e.g. signup completed, features used), linked to your account. To measure and improve the product. Basis: legitimate interest. When you use geoGM with your account, we also record which days you used it (only the date, no pages and no device), to measure the service's overall activity; it is kept for 400 days. We use no advertising tracking. Page views on the site are also measured with Vercel Web Analytics, which sets no cookies and keeps no persistent identifier; it is off when your browser sends Global Privacy Control. You may object to this measurement by writing to us (art. 21 GDPR).
• Contact form and email — your name, email and message, plus anything you choose to add (for a team, its size and what it does); the same when you write to an @geogm.org address. To reply to you. Basis: legitimate interest / pre-contractual steps.

• Account and content — for as long as the account exists. You can delete your account from Settings; deletion removes your personal data and disconnects and attempts to delete your identity at SnapTrade and Stripe (except what tax law requires us to keep).
• Billing — receipts are kept for the years required by Spanish tax law.
• Technical and error data — kept for the minimum time needed for diagnosis (automatic rotation).
• Days of use — 400 days, then deleted automatically.
• AI conversations — linked to your account; deleted with it.

You can exercise at any time your rights of access, rectification, erasure, objection, restriction and portability, and withdraw any consent you have given (without retroactive effect), by writing to hola@geogm.org from your account email. We reply within the legal deadline (1 month). If you believe we have mishandled your data, you can lodge a complaint with the Spanish Data Protection Agency (aepd.es).

GeoGM is not directed at children under 14. If we detect an account belonging to a child under that age, we will delete it.

We apply encryption in transit and at rest (Supabase encrypts the stored data), row-level access control in the database, credential isolation and the data-minimisation principle: card details never touch our servers, and your broker credentials are held by the specialised provider.

If we change this policy substantially, we will announce it in the application with reasonable notice. Date of this version: October 2026.