Privacy Policy
Last updated: 16 October 2026
This policy explains what personal data BullLens collects, why, who it is shared with, how long we keep it and what rights you have. We collect only what we need to run the service. We do not sell your data and we do not use it for advertising.
1. Who is responsible
The data controller is Thomas Violi, a private individual, Reggio Emilia, Italy. For anything about your data write to info@bull-lens.com.
2. What we collect
| Data | What it is | Why |
|---|---|---|
| Account | Email, username, password (stored only as a secure hash), second factor (2FA) secret if you enable it, account status and dates, when you accepted these terms | To create and protect your account |
| Sign-in with Google, GitHub or eToro | The identifier the provider gives us, your email (Google, GitHub, eToro when shared) and your eToro username | To let you sign in without a password and link the right account |
| eToro connection | Your eToro username, and the eToro access you approve with "Connect with eToro" (an access token and a refresh token, renewed automatically, with their expiry dates), and the eToro API keys you saved before BullLens moved to "Connect with eToro" only (no longer used), all stored encrypted | To read your eToro data for you |
| Portfolio and trading data | What eToro returns for your account: positions, closed trades, performance, balance history, dividends, risk score, feed posts statistics, copiers; and the figures BullLens computes from them | To show your analytics |
| Other investors' public data | Public eToro profiles you open in BullLens (performance, portfolio, risk) | To show those public profiles |
| Preferences | Settings you choose, such as your benchmarks and your My Lens layout | To remember your choices |
| License and free trial | Plan, license key, validity dates; for the free trial, its start and end and the eToro username it was used for | To give you the features of your plan, and to allow one free trial per account and per eToro account |
| Payments | For a PayPal subscription: the subscription id, plan, status, next payment date and the date and amount of the last payment, and the notices PayPal sends us about it (type and subscription id). PayPal handles the payment itself: we never receive your card or bank details, and we do not store the name or email of your PayPal account | To start, renew, cancel and support your subscription, and to keep the records the law requires |
| Security and usage | IP address and browser (user agent) recorded with sign-ins, sign-ups, password and 2FA changes and other security events; time and page of your last visit; the web server's access logs (IP address, page, time) | To keep accounts safe, prevent abuse and support you |
| Referrals | The referral code and source carried in the address of the link you followed (not stored on your device), which account invited you, daily counts of visits and sign-ups per link (no visitor identity in the counts) | To run the referral program |
| Invites | The invite code you signed up with and, when it was another user's code, that this user invited you; the codes you hand out and whether they were used | To run invite-only sign-ups and credit the people who invite others |
| Feedback | What you write with the Feedback button, its kind (problem, idea, other), the page you were on and the app version | To fix problems and improve BullLens |
| Emails | Messages we send you (email confirmation, password reset, security notices) | To operate your account |
3. Legal bases
- Contract: to provide the service you signed up for (account, eToro connection, analytics, license, free trial, subscription, emails about your account).
- Legitimate interest: to keep BullLens secure, prevent abuse (including repeated free trials), fix problems, and count referral visits and sign-ups in aggregate.
- Legal obligation: when the law requires us to keep or disclose data, such as payment records for tax purposes.
We do not send marketing emails without your consent and we do not run advertising or profiling.
4. Who receives data
- eToro: we call eToro's API with your eToro access or your keys to read your data, and eToro handles "Sign in with eToro" and "Connect with eToro". eToro processes your data under its own privacy policy.
- Google and GitHub: only if you choose to sign in with them.
- PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg): only if you subscribe. PayPal processes your payment as an independent controller under its own privacy policy; we tell it your BullLens account number so that it can link the subscription to your account.
- Hosting and email: OVHcloud (France, EU) provides our servers, network and email.
- Market data sources (Yahoo Finance, Nasdaq, Massive): we send them only instrument symbols, never your identity.
- jsDelivr: our pages load a chart library from this CDN, which sees your IP address like any website you visit.
- Authorities, when the law requires it.
Some of these providers are outside the European Economic Area (for example Google and GitHub in the United States). In that case the transfer relies on the safeguards the GDPR provides, such as the EU-US Data Privacy Framework or standard contractual clauses.
5. How long we keep it
- Account, connection, preferences and license: as long as your account exists.
- Free trial record (eToro username and dates): also after the account is deleted, so that the same eToro account cannot start a second trial.
- Payment records (subscription, dates, amounts): 10 years, as Italian tax and accounting law requires.
- Portfolio data and analytics: refreshed at every sync while your account exists; caches of public profiles are kept by eToro username and refreshed or removed over time.
- IP address and browser in security logs: 12 months, then removed automatically (the events themselves stay, without them). Web server access logs: at most 12 months.
- Sessions: until you sign out or after 30 days without activity.
- After you ask us to delete your account we delete or anonymise your data within 30 days, except what we must keep by law. Backups are overwritten within their normal cycle.
6. Your rights
Under the GDPR you can ask to access your data, correct it, delete it, restrict or object to its use, and receive it in a portable format. Write to info@bull-lens.com; we answer within one month. You can disconnect your eToro access and delete your eToro keys yourself in Account settings at any time. You also have the right to complain to a data protection authority; in Italy this is the Garante per la protezione dei dati personali (garanteprivacy.it).
7. Security
Connections use HTTPS. Passwords are hashed, eToro access tokens and keys are encrypted, two-factor authentication is available, and access to the back office is restricted and logged. No system is perfectly secure: if a breach affecting your data happens, we will inform you and the authority as the law requires.
8. Children
BullLens is not meant for people under 18 and we do not knowingly collect their data.
9. Cookies
We use only the cookies needed to run BullLens. Details in the Cookie Policy.
10. Changes
We will update this policy when our data handling changes, and tell you in the app or by email when the change is important. The date at the top shows the latest version.