Legal
This policy explains what personal data Investicus.eu collects, why, who can see it, and what rights you have over it. It applies to everyone who visits or uses the site.
Investicus.eu is operated by the Operator: [Operator legal name], [Operator registered address], registration number [Operator registration number] (“the Operator”, “we”, “us”). For any question about this policy or your personal data, contact us at privacy@investicus.eu.
Account data: your email address and, once you add it on the Account page, your full name. Your password is handled entirely by our authentication provider and stored only as a salted hash — we never see or store it in plain text. Claim participation data: if you join a claim, the investment amount, investment date, and transaction reference you submit. Content you or Claim Admins submit: claim proposals, claim updates, claim links, company entries, and blog posts. Technical data: our hosting providers keep standard request logs (such as IP address and timestamp) for security and abuse prevention. We do not use advertising or analytics tracking cookies, and we do not collect payment details, bank statements, or ID documents — Investicus.eu never asks you to upload files of any kind.
We process your account and claim data because it is necessary to provide the service you asked for — creating your account, letting you join a claim, and showing you your own dashboard (performance of a contract, Article 6(1)(b) GDPR). We process technical/security logs, and compute public aggregate statistics (like “320 investors, €450,000 total loss”), on the basis of our legitimate interest in keeping the platform secure and in helping claims attract legal representation (Article 6(1)(f) GDPR). Aggregate statistics never identify you individually. We do not use your data for advertising, do not build behavioural profiles, and do not make automated decisions about you.
Investicus.eu is built hub-and-spoke: your personal participation in a claim is private by default, and only aggregate numbers are public. Anonymous visitors and other registered users see only a claim’s title, description, status, and aggregate stats — never your name, email, investment amount, or transaction reference. The Claim Admin assigned to a claim you joined can see your full name, email, investment amount, investment date, and transaction reference — but only for that one claim, and only so they can prepare the participant roster for the law firm handling the claim. Global Admins have the same visibility as a Claim Admin, across all claims, to administer the platform and approve or reject claim proposals. This separation is enforced at the database level using Postgres Row-Level Security, not only by what the interface shows you — a technical safeguard against a compromised or misused client application.
We use a small number of service providers (“processors”) to run Investicus.eu: Supabase (database, authentication, and file-free application hosting) and Vercel (application hosting), plus a transactional email provider for account confirmation and password-reset emails. When you join a claim, the assigned Claim Admin exports your data (as part of the full roster) to hand to the law firm coordinating that claim — this is a disclosed, deliberate part of how the service works, not third-party sharing for marketing or other purposes. We do not sell your personal data, and we do not share it with advertisers.
Some of our processors may store or process data outside the European Economic Area. Where that is the case, we rely on an adequacy decision or Standard Contractual Clauses to protect your data. [Operator note: confirm and list the specific hosting regions and safeguards used by Supabase and Vercel for this project once finalized.]
We keep your account data for as long as your account exists. We keep claim participation data for as long as the claim is active and for a reasonable period afterwards to support the legal process the claim was created for. We do not yet have an automated data-retention schedule — deletion happens on request today (see “Your rights” below); self-service tools for this are on our roadmap.
Under the GDPR, you have the right to access, correct, delete, restrict, or receive a copy of your personal data, and to object to certain processing. To exercise any of these rights, email privacy@investicus.eu — some requests are still handled manually while we build self-service tools. You also have the right to lodge a complaint with a data protection supervisory authority, in particular the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or the authority in your own EU member state.
Access to your data is controlled at the database level, not only by the application’s interface, so that even a compromised client cannot read another user’s private data. We do not store any uploaded files, which removes an entire category of data-breach risk. No system is completely secure; please use a strong, unique password, and contact us immediately at privacy@investicus.eu if you suspect unauthorized access to your account.
We use only strictly necessary cookies — for keeping you signed in and remembering your language preference. We do not currently use advertising or analytics cookies. If that changes, we will update this policy and ask for your consent where required.
Investicus.eu is intended for adult retail investors and is not directed at, or knowingly used to collect data from, anyone under 18.
We may update this policy as the service evolves. We will update the “last updated” date above, and where a change is material, we will highlight it on the site.
Questions, requests, or complaints about this policy or your data: privacy@investicus.eu.