1. Data controller
The controller of your personal data is the publisher of the Earnnest service (EI MARQUIS BUREAU David, sole proprietorship, SIREN 109 426 387), whose address is 5 rue Augustin Fresnel, 85600 Montaigu-Vendée. The service is available at goearnnest.com.
Data protection contact person: David MARQUIS BUREAU. Contact (GDPR): support@goearnnest.com
2. Data we collect
Earnnest collects only the data needed to provide the service:
| Category | Data | Legal basis |
|---|---|---|
| Identification | E-mail address, name, profile picture, Google identifier (Google OAuth sign-in) | Performance of the contract |
| Age | Declared date of birth, to check that you are an adult (18). No identity document or selfie is requested. | Performance of the contract (minimum age of the service) |
| Subscription | Plan, Stripe customer and subscription identifiers, end-of-period date. No card number is stored by us. | Performance of the contract |
| Portfolio and activity | Portfolio transactions (entered, imported from a statement or read from a connected broker), favourites, screener filters, goals, plans | Performance of the contract |
| Broker connection | Read-only access keys to your broker, encrypted. Earnnest cannot place any order. | Consent (you enter them) |
| Chat assistant | The messages you write to the assistant | Performance of the contract |
| Support | E-mail address and the text of your request | Performance of the contract, legitimate interest |
| Notifications | Push notification token, Telegram identifier (optional) | Consent |
| Investor profile (historical) | Collection stopped on 20 July 2026. Answers given earlier are kept but neither read nor used. | Consent (collection ceased) |
Earnnest collects no location data and no sensitive data within the meaning of Article 9 GDPR, and no bank card number: payments are processed exclusively by Stripe (PCI-DSS level 1).
3. Purposes of processing
- Creating and managing your user account
- Providing the platform's features (analyses, screener, portfolio…)
- Managing the subscription and invoicing: payments are processed by Stripe, our payment provider
- Sending push and Telegram notifications if you have consented
- User support
- Improving the service and detecting abuse
- Complying with legal obligations
4. Recipients of the data
Your data is passed on to the following processors, strictly as far as necessary:
| Processor | Role | Region | Transfer safeguard |
|---|---|---|---|
| Supabase | PostgreSQL database | EU: Paris | Hosted in the EU: no transfer |
| Upstash | Redis cache | EU: Frankfurt | Hosted in the EU: no transfer |
| Google Cloud | Application servers (Cloud Run) | EU: Belgium | Hosted in the EU: Google Cloud data processing agreement |
| Sign-in (OAuth) | Worldwide | Google terms; only your e-mail, name and picture are received | |
| Stripe | Payments and invoices (PCI-DSS level 1) | United States | Standard contractual clauses and EU-US data privacy framework: Stripe data processing agreement |
| Resend | Transactional e-mails | United States | Standard contractual clauses: e-mail only |
| Anthropic / Groq | Artificial intelligence (analyses, assistant) | United States | Analyses: tickers and market data only. Assistant: the messages you write are sent to Groq; do not enter any personal data. |
| Telegram | Notifications (optional) | Netherlands / worldwide | Standard contractual clauses, only if you enable Telegram |
Standard contractual clauses: model adopted by the European Commission (decision 2021/914). No data is sold to third parties. No transfer for targeted advertising.
5. Retention periods
| Category | Period | Basis |
|---|---|---|
| Account data (e-mail, name, profile) | Life of the account, then deleted within 30 days | Art. 5(1)(e) GDPR |
| Activity data (portfolio, favourites, filters, plans) | Life of the account, then deleted within 30 days | Art. 5(1)(e) GDPR |
| Support requests | Identifying content emptied when the account is deleted | Art. 5(1)(e) GDPR |
| Contractual data (accepted terms, subscription history) | 5 years after the end of the contract | Art. L.110-4 French Commercial Code |
| Proof of consent (acceptance of the Terms of Use and Sale) | 5 years | Art. 2224 French Civil Code |
| Billing data (invoices, transactions) | 10 years from the transaction | Art. L.123-22 French Commercial Code |
| Technical logs (servers) | 90 days maximum | CNIL recommendation |
When each period expires, data is deleted or irreversibly anonymised. Deleting your account from the settings immediately deletes active data; data subject to a legal retention obligation stays archived until its period expires.
6. Data security
- TLS encryption between the browser and the servers
- Authentication by a signed token with a limited lifetime
- Broker access keys encrypted (Fernet, AES-128-CBC)
- Database access restricted to the application servers
- No password stored (authentication delegated to Google)
7. Your rights
Under Articles 15 to 22 GDPR, you have the following rights:
- Access (Art. 15) and portability (Art. 20): export your data from Settings → Account & data
- Rectification (Art. 16): from your Google account settings
- Erasure (Art. 17): immediate deletion from Settings → Account & data
- Restriction (Art. 18) and objection (Art. 21): write to us
- Withdrawal of consent (Art. 7): at any time, without affecting earlier processing
To exercise your rights, write to support@goearnnest.com. We reply within one month (the GDPR maximum).
If a complaint is not resolved, you may refer it to the CNIL (opens in a new window) or to the data protection authority of your country of residence.
8. Cookies and trackers
Earnnest uses only strictly necessary functional cookies. These cookies are exempt from prior consent (CNIL guidelines, deliberation 2020-091, and Article 82 of the French Data Protection Act).
| Cookie | Purpose | Lifetime | Necessary |
|---|---|---|---|
| next-auth.session-token | Authentication session | 30 days | Yes: exempt |
| theme | Theme preference | 1 year | Yes: exempt |
No advertising or audience-measurement cookie (Google Analytics, Matomo…) and no third-party tracker (Facebook pixel, LinkedIn Insight Tag…) is set. No cookie consent banner is therefore required.
9. Changes to this policy
In the event of a substantial change, you will be informed by e-mail or by in-app notification at least 30 days before the changes take effect.