Privacy Policy — LIUV | AI Wealth Agent

1. Data Controller

LIUV Ventures is the data controller responsible for your personal data.

Registered address: Rotterdam, Netherlands
Contact email: contact@liuv.io

If you have any questions about how your data is processed, or wish to exercise your rights under GDPR, please contact us at the email address above.

2. Data We Collect

We collect the minimum data necessary to provide and improve our services. The categories of data we process include:

Category	Data	Purpose
Account Data	Email address, name, hashed password	Account creation and authentication
Profile Data	Investment preferences, risk tolerance, onboarding selections	Personalizing AI agent analysis
Usage Data	Pages visited, features used, session duration	Service improvement (only with consent)
Technical Data	IP address, browser type, device information	Security, fraud prevention, analytics (with consent)
Payment Data	Subscription plan, payment status (processed by Stripe)	Subscription management

We do not collect or process special categories of personal data (health, biometric, political opinions, etc.).

3. Legal Basis for Processing

Under GDPR Article 6, we process your personal data based on the following legal grounds:

Contract performance (Art. 6(1)(b)): Processing necessary to provide you with our services, including account management, AI analysis delivery, and subscription handling.
Consent (Art. 6(1)(a)): Analytics and marketing cookies (Google Analytics, LinkedIn Insight Tag) are only activated after you provide explicit consent via our cookie banner. You can withdraw consent at any time.
Legitimate interest (Art. 6(1)(f)): Security monitoring, fraud prevention, and service improvement, balanced against your data protection rights.
Legal obligation (Art. 6(1)(c)): Where required by applicable law, such as financial regulatory record-keeping requirements.

4. Cookies & Tracking Technologies

We use a minimal set of cookies to operate our service:

Cookie	Type	Purpose	Duration
liuv_session	Essential	Authentication session token (httpOnly, secure)	30 days
liuv_cookie_consent	Essential	Stores your cookie preference (localStorage)	Persistent
_ga, _gid	Analytics (requires consent)	Google Analytics — website usage statistics	Up to 2 years
LinkedIn Insight	Marketing/Analytics (requires consent)	LinkedIn Insight Tag — conversion tracking and audience insights	Up to 2 years

Google Analytics and the LinkedIn Insight Tag are not loaded unless you explicitly accept analytics cookies through the cookie consent banner. If you decline, no analytics or marketing cookies are set and no usage data is sent to Google or LinkedIn. You can change your preference at any time by clearing your browser's local storage for this site.

Essential cookies (authentication session) are strictly necessary for the service to function and do not require consent under GDPR Recital 30 and the ePrivacy Directive.

5. Data Sharing & Third Parties

We share personal data only with the following categories of processors, and only to the extent necessary:

Stripe: Payment processing. Stripe acts as an independent data controller for payment data. See Stripe's Privacy Policy.
Google Analytics: Website analytics (only if you consent). IP anonymization is enabled. See Google's Privacy Policy.
LinkedIn: Conversion tracking and audience insights via the LinkedIn Insight Tag (only if you consent). See LinkedIn's Privacy Policy.
Netlify: Hosting and serverless infrastructure. Data is processed in accordance with Netlify's Privacy Policy.

We do not sell, rent, or trade your personal data to any third party. We do not share data with advertisers or data brokers.

6. International Data Transfers

LIUV Ventures is headquartered in the Netherlands (EU). Some of our processors (Stripe, Google, Netlify) may transfer data to the United States. These transfers are protected by:

EU-US Data Privacy Framework (where applicable)
Standard Contractual Clauses (SCCs) approved by the European Commission
Additional technical and organizational safeguards (encryption, access controls)

7. Data Retention

We retain personal data only as long as necessary for the purposes outlined in this policy:

Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
Usage/analytics data: Aggregated data retained for up to 26 months (Google Analytics default). Individual data is anonymized.
Payment records: Retained as required by financial regulations and tax law (typically 7 years).
Authentication sessions: Expire after 30 days and are not retained thereafter.

8. Your Rights Under GDPR

As a data subject, you have the following rights under GDPR (and equivalent rights under LGPD for Brazilian users):

Right of access (Art. 15): Request a copy of the personal data we hold about you.
Right to rectification (Art. 16): Request correction of inaccurate or incomplete data.
Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten").
Right to restrict processing (Art. 18): Request that we limit how we use your data.
Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
Right to object (Art. 21): Object to processing based on legitimate interest.
Right to withdraw consent (Art. 7(3)): Withdraw consent at any time (e.g., for analytics cookies) without affecting prior processing.

To exercise any of these rights, contact us at contact@liuv.io. We will respond within 30 days as required by GDPR.

9. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

All data transmitted to and from LIUV is encrypted using TLS 1.3.
Passwords are hashed using bcrypt with appropriate salt rounds.
Authentication tokens are stored in httpOnly, secure cookies to prevent XSS attacks.
Access to personal data is restricted to authorized personnel only.
Regular security reviews and dependency audits are conducted.

10. Children's Privacy

LIUV is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

11. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated via email (for registered users) or through a notice on our website. The "Last updated" date at the top of this page indicates the most recent revision.

12. Supervisory Authority

If you are not satisfied with our response to a data protection concern, you have the right to lodge a complaint with a supervisory authority. For the Netherlands, the relevant authority is:

Autoriteit Persoonsgegevens
Website: autoriteitpersoonsgegevens.nl