what we hold,and why.

• We collect only what the site needs: your account, the pensions you add, and your cookie choice.
• Your data is stored and processed in the EU (Amsterdam, Netherlands). We never sell it, and there is no advertising, tracking or analytics.
• You can export it, correct it or delete it yourself at any time from Settings.
• CSV downloads are made on your own device — nothing is sent to us.

PensionIQ ("we", "us") is the data controller for information collected through this site. We are [PLACEHOLDER: legal entity name and registered address]. For any privacy question or to exercise your rights, contact [PLACEHOLDER: privacy contact email].

• Account: your name and email address, and your password, stored only as a salted one-way hash (scrypt) that can't be turned back into the password. If you sign in with Google, Google shares your name and email with us.
• Your portfolio: what you enter for each holding — the fund, an optional name, its value and statement date, monthly contributions (yours and your employer's) and any charges — plus when you last viewed your portfolio. This is financial information about you, so we treat it with care: only you can read it.
• Report emails: only if you turn them on — how often you want them (monthly, quarterly or yearly), when the next one is due and when the last was sent, and whether you've confirmed your email address. Each report is made fresh on our server when it's sent; we don't keep a copy of the PDF.
• Cookie choice: kept in your browser, and a copy on our server with the time, your account (if signed in) and a salted, one-way hash of your IP address — never the IP address itself.
• AI Suggestions messages: when live AI is switched on, the text you type is sent to Google to write a reply. We don't store it.
• Technical logs: our hosting providers record standard request logs (such as IP address and browser) to keep the service running and secure.

We never ask for your PPS number, bank details, policy or scheme numbers, or payment details — please don't type them into holding names or AI messages.

• Account and portfolio — to provide the service you signed up for (contract, Art. 6(1)(b) GDPR).
• Report emails — to send the reports you asked for, until you turn them off (your request; contract).
• Cookie-choice records — to show we respected your choice (legal obligation and legitimate interest).
• AI Suggestions — to answer the question you chose to ask (your request; contract).
• Technical logs — to keep the site secure and working (legitimate interest).
• Optional analytics — only with your consent. We don't run any analytics today.

Projections, estimates and charge figures are calculated automatically from what you enter. They are illustrations only: no decision with legal or similar effect is made about you.

We do not sell your data or share it for marketing. These processors run the service for us:

• Railway — hosts the website, its database, the weekly fund update and the daily price and report jobs. All of them run in Railway's EU region (Amsterdam, Netherlands), so your account and portfolio are stored and processed in the EU. Railway Corporation is a US company, so its staff may access systems from outside the EU for support and operations.
• Resend — sends our emails (address confirmations and the portfolio reports you ask for) from its EU region (Ireland). An emailed report contains your portfolio figures as a PDF attachment. Resend keeps delivery records, and the emails themselves for a limited time, to run and secure its service. Resend is a US company, so its staff may access systems from outside the EU.
• Google sign-in — only if you choose "continue with Google": Google confirms who you are and shares your name and email with us.
• Google (Gemini API) — only when live AI Suggestions is on, and only the message text and our public fund list; never your name, email or account. See Google's Gemini API terms.

Where data leaves the EU we rely on [PLACEHOLDER: confirm the transfer mechanism for each provider — e.g. the EU-US Data Privacy Framework or Standard Contractual Clauses in their data processing agreements].

We only use what is strictly necessary — no advertising, cross-site tracking or analytics:

• piq_session (cookie) — keeps you signed in for up to 30 days. Removed when you log out.
• piq_oauth (cookie) — only during Google sign-in, for up to 10 minutes, to protect the sign-in from forgery.
• pensioniq_cookie_consent (browser storage) — remembers your cookie choice.

Change or withdraw your choice at any time with cookie settings in the footer or on the Settings page.

• Account and portfolio — until you delete your account. Deletion is immediate.
• Cookie-choice records — 24 months, then deleted automatically (or straight away when you delete your account).
• Sign-in sessions — until you log out or 30 days without use, then deleted.
• AI Suggestions messages — not stored by us.
• CSV and JSON exports — created on your device; we never receive a copy.
• Hosting logs and database backups — kept by our providers for their short standard periods, then deleted.

• Encrypted connections (HTTPS with HSTS) and strict browser security headers.
• Only our server talks to the database, and every request is checked against your session: each account can only read and change its own holdings.
• Sign-in cookies are HTTP-only and only work on this site; login attempts are rate-limited.
• Passwords are never stored in plain text, and session tokens are stored only as hashes.
• New passwords are checked against known data breaches (Have I Been Pwned). Only the first five characters of a one-way hash of the password are sent — never the password itself.
• Database credentials and keys are kept as secrets in our hosting provider and never sent to browsers.

Under GDPR you can, free of charge:

• See and take your data — Settings → export my data (JSON), or holdings as CSV.
• Correct it — update any holding on the Portfolio page, or contact us.
• Delete it — Settings → delete account removes everything immediately.
• Restrict or object to processing — contact us.
• Withdraw consent — cookie settings, at any time, as easily as you gave it.
• Complain to the Data Protection Commission (Ireland), or the authority where you live.

We answer requests within one month.

PensionIQ is for adults. Accounts are for people aged 16 or over, and we don't knowingly collect data from children.

If this policy changes materially we'll update the date above. See also our terms & disclaimer.