Sign in / Register

Privacy Notice

Version: 25 September 2026 · Deutsche Fassung · Italiano · Português

1. Controller

The controller for processing personal data within the meaning of the GDPR is Marcel René Stoni (sole proprietor), Adi-Dassler-Gasse 2, 9073 Klagenfurt am Wörthersee, Austria, email: business@pendrai.com; see also the Legal Notice. You can contact us at this email address with any privacy question or to exercise your rights.

2. Providing the application, hosting and error logs

Pendrai is hosted by Railway Corp. (USA); the application server is located in the EU (Amsterdam, Netherlands region). Your account and portfolio data are also held in the database operated by Railway. Railway processes data as a processor under Art. 28 GDPR and only on our instructions. When you access Pendrai, the hosting provider automatically processes technical connection data (IP address, time, requested address and browser) to deliver and secure the application. These data are not linked to the user account. The legal basis is Art. 6(1)(f) GDPR.

The application fonts are served from our own server; no connection is made to third-party font servers.

For troubleshooting, Pendrai logs technical errors (time, requested route, technical error message and, where applicable, internal account number). The legal basis is Art. 6(1)(f) GDPR for operational security. Error logs are automatically deleted after 90 days; on account deletion, the account association of existing entries is removed promptly.

3. Registration and user account

An email address is required to use the Service. Passwords are stored as one-way scrypt hashes with an individual random salt. The technically necessary session cookie athena.sid (HttpOnly, SameSite=Lax, maximum 30 days) is used to sign in. It associates your browser with your session and is not used for advertising. Functional settings such as design, language, privacy mode and selected portfolio are additionally stored in the browser (local or session storage). The legal basis for account functions is Art. 6(1)(b) GDPR. Advertising and its separate consent are described in section 11.

Your email address is required to create an account. We use the email provider Resend (Resend, Inc., USA) to send account emails, including verification links, password reset or change emails, price alerts where requested and Premium subscription confirmations. Your email address and the content of the relevant message are transmitted to Resend. Verification and reset links are stored by us only as hashes and expire after a limited period. The legal basis is Art. 6(1)(b) GDPR.

We store account data while your account exists. Session data are deleted after the session expires, at the latest after 30 days. Sending and delivery information for transactional emails is retained only as long as necessary for error analysis, abuse prevention or compliance with legal obligations.

4. Portfolio, watchlist and portfolio-account data

Data that you enter or import yourself (positions, transactions, watchlists, portfolio names and settings) are processed solely to provide the functions you use and are not sold or disclosed for advertising purposes. We store them while your account exists; they are deleted completely when the account is deleted; see section 8. The legal basis is Art. 6(1)(b) GDPR.

5. Internal use and disclosure to service providers

We do not sell personal data or disclose them to third parties for their independent use. We process them only

This notice explains exceptions for particular functions: broker connections (section 6), server-side market-data requests (section 7), payment processing (section 10), and Google AdSense with consent management (section 11). Pendrai does not send your portfolio holdings or broker credentials to Google as advertising data. Art. 6(1)(b) GDPR applies to account functions; the separate requirements for advertising are set out in section 11.

No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place.

Support, error analysis and development: Where necessary in an individual case, we may access account, portfolio, depot and usage data to provide support requested by you, investigate and fix errors, defend against abuse or security incidents, and assess and improve the application's stability, performance and functions. Access is limited to the relevant purpose and the data required for it. Depending on the measure, the legal basis is Art. 6(1)(b) GDPR (providing and supporting the Service) or Art. 6(1)(f) GDPR (security, error analysis and technical improvement). You may object to processing based on legitimate interests on grounds relating to your particular situation under Art. 21 GDPR.

For platform-wide statistics, capacity planning and product improvement, we use aggregated or anonymised data where possible, such as the use of individual functions or the distribution of security types. Genuinely anonymised aggregate statistics may be published, used in reports or presentations, or shared in response to enquiries from interested third parties (for example media, market participants or researchers) only once Pendrai has had at least 1,000 active user accounts in the preceding 30-day period. Before publication or disclosure, we check that the data do not permit direct or indirect conclusions about individual people or portfolios; small or identifiable groups are not published. These analyses do not serve to assess users individually, target advertising based on portfolios or sell personal data. Where anonymisation is not possible, personal data are used only where necessary for the described purpose and legally permitted.

Transfers to third countries: Some service providers (hosting, email delivery, payment processing, market data and advertising) are based in, or have parent companies in, the USA or another third country. Where personal data are transferred to a third country, this takes place on the basis of an adequacy decision by the European Commission, such as the EU-US Data Privacy Framework where the recipient is certified, or EU Standard Contractual Clauses under Arts. 45 and 46 GDPR.

Backups: For technical recovery, data may be included temporarily in backups of the hosting provider. We do not access these copies for normal operation; they are overwritten as part of the regular backup rotation. Until then, they are used only to restore data after a security or system incident.

6. Optional broker connection

Where you voluntarily set up a broker connection, your API credentials are stored encrypted with AES-256-GCM and decrypted on the server only during synchronisation to retrieve your own transaction data. The relevant broker, currently Trading 212 or Bitpanda, processes your credentials under its own privacy policies. For each request, only data necessary for the request are sent to the broker and your transaction data are returned to us. For every synchronisation we log the time, number of imported entries and any error messages, visible under “Log” in Settings. If you delete a connection, its stored credentials and related log are deleted. The legal basis is Art. 6(1)(b) GDPR.

7. External market-data providers

For prices, exchange-rate conversion and other market information, Pendrai requests public interfaces of specialised providers from its server: Twelve Data (share and ETF prices, history and dividends), Frankfurter/European Central Bank (exchange rates), CoinGecko (cryptocurrencies), alternative.me (crypto Fear & Greed sentiment), the US Securities and Exchange Commission (public institutional-investor filings for prominent portfolios), and Elbstream (company logos). Only queried instrument identifiers, such as ticker symbols or ISINs, or currency pairs are transmitted; no data identifying you are sent. Requests are made by the Pendrai server, so your IP address is not shared with these providers. Company logos are delivered through our server; only clicking the Elbstream attribution link in the footer opens Elbstream's website. The legal basis is Art. 6(1)(b) GDPR. See section 5 for third-country transfers.

8. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent at any time with future effect; for advertising, use the “Cookie settings” in section 11. An informal message to business@pendrai.com is sufficient; we respond within one month.

Deleting your account: You can delete your account yourself at any time in Settings under “Account” using “Delete account” and password confirmation. Alternatively, send us an informal message from your account email address. Deletion is immediate and irreversible and includes your account and all associated data, including portfolio, watchlist, portfolios, budget, goals, price alerts, broker connections with credentials and logs, settings, and all ongoing sign-ins on your devices. A current Premium subscription is ended. We then send one confirmation to the former email address without retaining that address for this purpose. Legal retention obligations, for example for invoices with our payment provider under section 10, remain unaffected. Data portability: On request, we provide your data in a commonly used, machine-readable format such as CSV or JSON; the PDF evaluation in Settings does not replace this.

You also have the right to lodge a complaint with the Austrian Data Protection Authority, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.

9. Data security

We use scrypt password hashing, AES-256-GCM encryption for broker credentials, data separation by user account, and rate limiting against automated sign-in attempts.

10. Payment processing (Premium)

A paid Premium subscription is processed through Stripe (Stripe Payments Europe, Ltd., Dublin, Ireland and, where applicable, Stripe, Inc., USA). Premium can be purchased in Settings.

When purchasing, you are redirected to Stripe's payment page. You enter payment data, such as card number and billing address, there only; we do not receive them. Your email address is transmitted to Stripe for matching. Stripe provides us with the customer and subscription identifier, subscription status, billing period and amount paid. The legal basis is Art. 6(1)(b) GDPR for contract performance and Art. 6(1)(c) GDPR for legal retention obligations, in particular section 132 Austrian Federal Fiscal Code (BAO), seven years. Stripe's Privacy Policy also applies to its processing. When purchase begins, we also store the time of your express request for service to begin during the withdrawal period, as evidence for statutory consumer rights under Art. 6(1)(c) GDPR. If you redeem a promotional code, we record that and when it was redeemed.

11. Google AdSense, cookies and your choice

Pendrai uses Google AdSense. With the appropriate consent, Google and its advertising partners may use cookies or similar identifiers to provide advertising, measure its effectiveness and, where selected, personalise advertising based on your visits to this and other websites. This may involve processing IP address, browser and device information, visited pages and cookie identifiers. Google's consent message identifies the available partners and purposes.

Ad requests are initially paused when a page is opened. Pendrai releases them only once valid consent to device storage and Google has been given through Google's consent management. AdSense takes further purpose and provider decisions from that choice. If consent is refused or consent management is unavailable, ad requests remain paused and account functions remain usable. The basic Google script is loaded to provide the consent message only after Pendrai has determined through a request to its own server that no Premium account is signed in; for signed-in Premium users, neither this script nor ad requests are loaded. If the account status cannot be determined, the script is likewise not loaded. A connection to Google is made at that point and existing Google cookies may be read; pausing does not completely block all Google connections.

Consent management stores your selection in the browser. You can reopen and change it at any time using at the bottom of the page. Withdrawal applies for the future. Processing for consent-based advertising purposes relies on Art. 6(1)(a) GDPR; necessary storage for sign-in and consent management is separate.

Further information about Google, recipients, international transfers and retention is available in Google's Privacy Policy and data use on partner sites. Personalised ads can also be managed in the Google Ad Center.