Privacy Policy

Who is responsible for your data

Remate Obstinado Uni LDA operates Worth Dock and is the data controller for the personal data processed to provide the service as described in this policy. Its Portuguese company and tax identification number (NIPC) is 517495708, and its registered office is at Rua Cidade de Setúbal, 2975-220 Setubal, Portugal.

For questions about your personal data or this policy, contact support@worthdock.com.

Information we process and where it comes from

• Account information: your name, email address, account identifiers, authentication and session information, and the date you accept the legal documents. You provide this when registering, or it is supplied through your chosen sign-in provider, such as Google.
• Financial tracking information: the assets, balances, investments, retirement accounts, property, monthly snapshots, goals, assumptions and settings you enter or import. We use this information to calculate and display your tracker.
• Optional country of residence: the country you choose in onboarding or settings. You can remove it at any time. We do not infer this profile field from your network location.
• Subscription information: customer and subscription identifiers, selected plan and currency, trial and billing dates, payment status and related events received from our billing provider. Payment details are entered in the provider's checkout, not stored as full card numbers in our application database.
• Support information: the messages and contact details you send to support. Messages are delivered by email and handled in our support inbox. Our application database stores request metadata, including account ID, request reference, category, timestamps, sending status, provider message ID and hashes used to prevent duplicate sending. It does not store the subject, message text or reply email address in that support request record.
• Technical and security information: network and device information, request and session identifiers, access and authentication events, and error diagnostics generated when you use the service. Our application error reporting is configured to exclude request bodies, cookies, request headers and query strings, while retaining an internal account identifier where needed to investigate errors.

Account and authentication information is needed to create and secure your account; without it we cannot provide signed-in access. You choose which financial entries to add, and country of residence is optional. Billing information is required only if you proceed to checkout. Do not send passwords, verification codes, or full card or bank account numbers in support messages.

Why we use information and our legal bases

• Performing our contract with you: registering and authenticating your account, storing and displaying your financial entries, providing calculations and settings, managing your subscription and service messages, and responding to requests about the service.
• Legitimate interests: keeping Worth Dock secure and reliable, investigating errors, preventing fraud, abuse and duplicate requests, and managing disputes and legal claims. These interests are balanced against your rights and reasonable expectations.
• Aggregate product insights: we use optional country-of-residence information to understand, in aggregate, where Worth Dock is used and to guide product and marketing decisions. Our legal basis is our legitimate interest in understanding our audience. We do not use this field for individual advertising; you can remove it in settings or object by contacting us.
• Legal obligations: keeping records required by applicable law, handling privacy requests, and responding to lawful requests from competent authorities.

Accepting the Terms of Service or acknowledging this policy does not subscribe you to marketing messages or give consent to optional advertising tracking. If we introduce processing that requires consent, we will request it separately. You can withdraw that consent without affecting the lawfulness of earlier processing.

Who receives information

Authorised people working on Worth Dock can access information where needed to operate the service, provide support or meet legal obligations. We also use specialist providers in the following categories:

• Hosting, storage and website delivery: infrastructure providers process application data, backups and network request information to host the tracker, deliver pages and protect the service.
• Authentication and account security: providers process account details, sign-in methods, sessions and legal acceptance records to manage access.
• Email delivery and support communications: providers process recipients, reply addresses, subjects, message content and delivery metadata. Operational notification services may receive request references, categories, diagnostic information and billing event details needed to alert our team.
• Error monitoring and background processing: providers process technical diagnostics, operational identifiers and job histories needed to detect failures and coordinate subscription, account and maintenance tasks.
• Payments and billing: Stripe and Link process checkout, payment, subscription, tax and fraud-prevention information as described below.

Providers acting on our behalf process information under data-processing agreements. Some providers also act as independent controllers for their own legal, security or payment obligations. We may disclose information to authorities or professional advisers where required by law or necessary to establish, exercise or defend legal claims. You can contact us for more information about the recipients relevant to your data.

We do not sell or rent your personal data, or share your financial tracking entries with third parties for their own advertising or marketing.

Payments through Stripe and Link

Subscriptions use Stripe Managed Payments, with Link acting as the merchant of record for the transaction. The checkout provider collects payment and billing details and uses relevant identity, device and location information for payments, tax compliance and fraud prevention. We receive the subscription information needed to manage your access and support billing enquiries, not your full card number.

Their handling of payment information, including records retained for their own legal obligations, is also explained in the Stripe Privacy Policy and the notices presented during checkout. The optional country-of-residence field in your Worth Dock profile is separate from location information used by the payment provider.

Where data is processed

Our production API and application database are hosted in the European Union, in the EU Central region. Our production background-processing namespace is also hosted in EU Central. This does not mean that every part of the service processes data only in the EU.

Providers supporting authentication, email, website delivery, security and payments may process data outside the European Economic Area, including in the United States. Depending on the provider and transfer, applicable safeguards include European Commission adequacy decisions or Standard Contractual Clauses incorporated into data-processing agreements, with additional measures where required. Contact us for information about the safeguards applying to your data and how to obtain a copy.

How long we keep information

• Account and financial entries: we retain these while your account remains open so you can use your tracker. Cancelling a subscription alone does not delete the account or its entries.
• Account closure: closing your account blocks access immediately, requests cancellation of the trial or subscription, and records a data deletion request. Deletion is a separate process, not an instant purge when you press the closure button. We handle the request without undue delay, normally within one month, subject to applicable legal exceptions.
• Background execution histories: our production workflow service is configured to retain execution histories for 30 days after a workflow closes. Running workflows retain the state needed to complete their work. This period does not set the retention period for your account, financial entries or backups.
• Support, security and operational records: retention depends on the time needed to handle the request or incident, prevent abuse and duplicate processing, and resolve related disputes. We consider whether a request is still open, whether the record is needed for an investigation, and any applicable legal requirement when deciding whether it remains necessary.
• Legal and billing records: records required for accounting, tax, compliance or legal claims may be kept after closure for the applicable statutory or claims period. Payment providers may retain records for their own obligations.
• Backups: our hosting provider keeps database backups with a point-in-time recovery window covering the previous 3 days. Logical exports, if created, are retained by the provider for at least 7 days after creation. We do not currently keep database backup copies outside that provider. These recovery copies have a separate retention cycle; a deletion request does not instantly remove data from every backup. They are not used to restore a closed account to active service.

Cookies and browser storage

Authentication and security services use cookies and similar technologies to maintain sessions and protect sign-in. Worth Dock also uses browser storage for preferences such as appearance and displayed billing currency. You can manage cookies and local storage in your browser, but blocking session or security technologies can prevent sign-in or disrupt the service.

We use Vercel Web Analytics on our production landing page, public demo, Terms of Service and Privacy Policy to understand visits and improve our public website. It does not use analytics cookies. Vercel processes page views and technical information, such as referral source, country, browser and device, to provide aggregate reports. We remove query parameters and fragments from measured page URLs. We do not enable this analytics on sign-in, registration confirmation or private dashboard pages, or send account identifiers or financial entries as analytics events.

Where advertising measurement is enabled, we ask separately before loading the Meta Pixel on our public landing page and registration confirmation page. If you accept, Meta receives page visits and a completed-registration event, together with browser, network and advertising-cookie information. Meta may link these events to your Facebook or Instagram account to measure advertising. We do not load this Pixel on sign-in forms or financial dashboard pages, enable automatic advanced matching, or send your financial entries, balances or first-asset milestone to Meta.

Rejecting advertising cookies does not affect access to Worth Dock. Your choice is stored in this browser for up to 180 days. You can change it through Cookie preferences on our landing page. We respect a browser Global Privacy Control signal as a rejection. With consent, campaign labels from an advertising link are retained for the browser session and associated with the registration to help us assess campaigns. We do not collect arbitrary URL parameters for this purpose. Meta handles its received data under its own Privacy Policy.

Internally, we record registration and the time an account first saves a cash account, investment, retirement account or property. These milestones help us understand product adoption and campaign effectiveness, based on our legitimate interest in improving the service. The records contain no asset amounts or names, are retained while the account is open, and are included in account-deletion handling. Contact us to object to this internal product measurement.

Your rights and how to exercise them

Subject to applicable law, you can request access to your personal data, correction of inaccurate data, erasure, restriction of processing, and a portable copy where the right to portability applies. You can object to processing based on legitimate interests, including the use of your optional residence field for product insights. Where processing relies on consent, you can withdraw it at any time.

Send requests to support@worthdock.com. Requests for a copy or deletion of data can be handled through support; they do not depend on a self-service export or deletion feature. We may ask for proportionate information to verify your identity before disclosing or changing personal data.

We respond without undue delay and within one month. Where the law permits an extension because of the complexity or number of requests, we will explain the reason and extension within that first month. If a request cannot be fulfilled, we will explain why and the available complaint options.

You may complain directly to the Portuguese supervisory authority, the Comissão Nacional de Proteção de Dados (CNPD), or the supervisory authority where you live, work or believe an infringement occurred. You do not have to contact us before making a complaint.

Automated processing

Worth Dock uses calculations and projections to organise the information you enter; these are informational, not decisions about eligibility for credit, insurance or investments. We also automate subscription access rules and security checks. Payment and authentication providers may use their own fraud and security checks under the notices applicable to their services. Contact support if you believe an automated check has incorrectly affected your access.

Changes to this policy

We may update this policy when our service or data practices change. The date above identifies this version. Material changes will be brought to your attention through the service or an appropriate account communication before the new practices take effect.