Privacy Policy
At Velafolio, protecting the confidentiality and security of your personal financial planning data is our highest priority. This policy details how we collect, safeguard, and manage your information.
1. Introduction & Overview
Velafolio (“Platform,” “Site,” “we,” “us,” or “our”) provides self-directed retirement modeling and long-term financial planning tools. We recognize that financial information is among the most sensitive personal data you possess.
This Privacy Policy explains how we collect, use, process, and protect your information when you register an account, utilize our calculators and roadmap simulators, or submit inquiries through the Platform. By using Velafolio, you consent to the data practices described in this policy.
2. Information We Collect
We collect the information needed to provide, calculate, and secure your personal financial plan, plus limited usage data that helps us improve the Platform:
A. Account & Profile Credentials
When you register, we collect your name, email address, password credentials (securely hashed via Firebase Authentication), and optional profile preferences (such as planning style and financial priorities).
B. User-Entered Financial Planning Data
To generate personalized retirement projections, you may input self-reported financial variables, including:
- Savings, investment, IRA, 401(k), and brokerage account balances.
- Real estate valuations, mortgage terms, and property tax estimates.
- Liabilities, debts, interest rates, and payoff timelines.
- Earned salaries, Social Security claiming ages, pensions, and annuity streams.
- Recurring living expenses, healthcare estimates, and one-time milestone expenditures.
- Inflation parameters, rate of return assumptions, and target retirement ages.
C. Google Authentication Data
If you choose to sign in using Google OAuth, we receive your verified name and email address to authenticate your identity. In strict compliance with the Google API Services User Data Policy, Google user data is used solely to authenticate your account and is never transferred to advertisers or used for unauthorized purposes.
D. Voluntary Advisory Consultation Inquiries
If you voluntarily submit a request for a complimentary plan review with a fiduciary advisor, we collect your contact information (name, email, optional phone number), estimated net worth bracket, target retirement horizon, primary goals, and any custom questions you submit.
E. Usage & Device Analytics
When you visit the Platform, Google Analytics collects pseudonymous usage information, such as the pages you view and how you interact with them, your device and browser type, your approximate (city-level) location, and the website that referred you. It does not receive your financial figures, plan data, name, or email address.
3. How We Use Your Information
We use the information we collect exclusively for the following purposes:
- Financial Modeling & Projections: Computing your year-by-year cash flows, tax bracket estimates, Monte Carlo probabilities, RMD requirements, and portfolio longevity metrics.
- Account Administration: Authenticating your identity, managing password resets, and providing customer support.
- Fiduciary Strategy Routing: Connecting you with qualified, fee-only fiduciary financial advisors when you explicitly submit a consultation intake request.
- Service Integrity & Security: Monitoring platform performance, preventing fraudulent activity, and maintaining secure database backups.
- Product Improvement: Understanding, in aggregate, how visitors use the Platform (for example, which tools are most helpful and where people get stuck) so we can improve it.
4. Information Sharing & Third-Party Service Providers
We do not sell, rent, or trade your personal or financial data to third parties.
We only share data with trusted service providers that process it on our behalf under contractual confidentiality and data-protection terms:
- Cloud Infrastructure & Database: Google Cloud Platform / Firebase provides encrypted cloud database storage, authentication, and hosting under strict enterprise security terms.
- Usage Analytics: Google Analytics (provided by Google LLC) receives the pseudonymous usage data described in Section 2E. We have turned off Google signals and ad personalization for Velafolio. Google explains how it uses this data at policies.google.com/technologies/partner-sites.
- Transactional Communications: Resend API delivers transactional emails, such as consultation request notifications and password resets.
- Payment Processing: If you choose to provide voluntary community sponsorships (“Buy Me a Coffee”), payments are securely processed directly by Stripe. Velafolio does not store or process payment card numbers.
- Legal & Compliance Disclosures: We may disclose information if required to do so by lawful subpoena, court order, or applicable legal process, or when necessary to protect the safety and property of our users.
5. Data Security & Storage
We implement comprehensive technical and organizational safeguards designed to protect your information against unauthorized access, loss, or alteration:
- Encryption in Transit: All web traffic is encrypted using modern Transport Layer Security (TLS/HTTPS).
- Encryption at Rest: All stored database documents in Google Cloud Firestore are encrypted at rest using 256-bit AES encryption.
- Database Authorization Rules: Granular server-side Firestore security rules enforce that user scenario data can only be read or modified by the verified authenticated owner of that account.
6. Your Rights & Complete Data Control
You maintain full sovereignty over your personal and financial information:
- Access & Modification: You can view, update, and modify all financial figures, account details, and scenario models at any time directly through your dashboard.
- One-Click Account Deletion: You can permanently delete your account at any time from your Profile settings. Deletion immediately erases from our database your profile, every plan and everything in it, any consultation requests you sent, and any files stored for you, followed by your sign-in record. It cannot be undone. It does not erase records kept outside our database: Stripe’s records of any donation you made, which Stripe keeps as payment rules require, and emails already exchanged with us, such as consultation request notifications. To ask about those, email admin@quantlance.com.
- California & State Privacy Rights (CCPA/CPRA): California residents and residents of states with equivalent consumer privacy legislation have the right to know what personal data is collected, request its deletion, and not receive discriminatory treatment for exercising privacy rights.
7. Cookies & Local Storage
Velafolio uses essential local storage and session tokens that are strictly necessary for secure authentication and for remembering interface preferences (such as your chosen light or dark theme).
We also use first-party analytics cookies set by Google Analytics (such as _ga) to measure visits and understand how the Platform is used. We do not use advertising cookies or cross-site behavioral tracking. You can opt out of Google Analytics at any time with the Google Analytics opt-out browser add-on, or by blocking or deleting cookies in your browser settings.
8. Children’s Privacy
Velafolio is designed for adult financial planning and is not intended for use by individuals under the age of eighteen (18). We do not knowingly solicit or collect personal information from children. If we become aware that personal data from a minor has been collected, we will take immediate steps to delete that data.
9. Updates to This Privacy Policy
We may occasionally update this Privacy Policy to reflect changes in our software features, legal requirements, or security best practices. Any revisions will be posted on this page with an updated “Effective Date.” We encourage you to review this policy periodically.
10. Contacting Us About Privacy
If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact our data privacy team directly: