Privacy Policy

Last updated October 18, 2026

This Privacy Policy describes how Individual Entrepreneur Steffan Kharmaaiarvi, doing business as Borderfolio ("we", "us"), processes personal information in connection with Borderfolio for Advisors (the "Service"). It covers two different situations, and the roles differ:

• Advisers' account data (members of an organisation): we decide how and why it is processed, so we are the controller. Sections 1 to 8 apply.
• Clients' financial data (the people an advisory firm acts for): the firm decides how and why it is processed and we process it on the firm's documented instructions, so the firm is the controller and we are its processor. The Data Processing Addendum in section 9 applies.

Clients of advisory firms are not users of the Service and have no account in it. If you are such a client and have questions about your data, please contact your adviser; we will assist the firm with your request.

1. What we collect about advisers

When a member registers or is invited: name, e-mail address, password (stored as a hash), country, organisation membership and role, second-factor enrolment status (the shared secret is stored encrypted; recovery codes are stored as hashes). While using the Service: the actions recorded in the organisation's audit trail (for example client created, statement uploaded, report generated), with the acting member, target and timestamp, and the IP address at the time of the action; technical logs (request metadata, errors) kept for operations and security. On this marketing site, with your consent, product analytics as described in the Cookie Notice.

We do not process special-category data about advisers and do not collect information about advisers from third parties.

2. Why and on what legal basis

• To provide the Service to the firm and authenticate members: performance of the contract with the firm and our legitimate interest in serving its members.
• To keep the Service secure, enforce the Terms and keep the audit trail owners rely on: legitimate interest; legal obligation where applicable.
• To send service communications (invitations, security notices, changes to terms): contract and legitimate interest. We do not send marketing e-mail to members without consent.
• Analytics on this marketing site: consent.

3. Sharing

We share personal information with service providers that process it on our behalf under contract: cloud hosting and data storage, e-mail delivery, payment processing (Freemius, as merchant of record, if and when fees apply), error monitoring, and product analytics (PostHog, EU Cloud). We may disclose information in a business transfer or where required by law. We do not sell personal information.

4. International transfers

Our servers and those of our providers may be located in the United States and other countries. Where personal information of residents of the EEA, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses, available on request.

5. Retention

Member account data is kept while the member belongs to an organisation and for as long as needed afterwards to resolve disputes, enforce the Terms and meet legal obligations. The audit trail is kept for the life of the organisation. Operational logs are kept for a limited period. When an organisation is deleted, its data is removed from active systems and purged from backups in the ordinary backup cycle.

6. Security

We apply technical and organisational measures appropriate to the risk, including TLS in transit, encrypted storage of second-factor secrets, hashed passwords and recovery codes, organisation-scoped authorisation on every request, validated uploads, audit logging and least-privilege access. No method of transmission or storage is completely secure. The Security & data handling page describes the measures in more detail.

7. Your rights as a member

Depending on where you live you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict processing, and to lodge a complaint with a supervisory authority. Write to [email protected]. We will verify your identity and respond within the period required by law. Deleting your member account does not delete client data that belongs to the firm's organisation.

8. Changes and contact

We may update this Policy and will indicate the date at the top; material changes will be notified to organisation owners. Questions: Individual Entrepreneur Steffan Kharmaaiarvi, 29 Tornike Eristavi Street, Building 5, Entrance 1, Floor 1, Apartment 3, Tbilisi, Tbilisi 0192, Georgia, [email protected].

9. Data Processing Addendum

This Addendum forms part of the Terms of Service between Borderfolio (the "Processor") and the advisory firm (the "Controller") and governs the processing of personal data of the Controller's clients ("Client Personal Data").

9.1 Subject matter, nature and purpose

Hosting, extraction, storage, analysis and reporting of investment information about the Controller's clients, for the Controller's purpose of advising those clients, for the duration of the Terms.

9.2 Categories of data and data subjects

Data subjects: the Controller's clients. Data: name, contact e-mail (optional), country of residence, base currency, tax residence, citizenship, US-person indicator, planned relocation, account types; brokerage statements and the positions, transactions, cash flows and balances extracted from them; derived analytics and findings; the Controller's notes and commentary; generated report snapshots. No special-category data is required by the Service; the Controller undertakes not to enter any.

9.3 Instructions

The Processor processes Client Personal Data only on the Controller's documented instructions, which are the Terms, this Addendum and the Controller's use of the Service's functions (for example uploading a statement, confirming an import, generating a report, archiving or deleting a client). The Processor will inform the Controller if an instruction in its opinion infringes applicable data protection law.

9.4 Confidentiality and security

Persons authorised to process Client Personal Data are bound by confidentiality. The Processor implements the measures in section 6 above and in the Security & data handling page, including organisation isolation, server-side authorisation, optional mandatory two-factor authentication, upload validation, audit logging, and retention of original statement files for seven days after import followed by purge.

9.5 Sub-processors

The Controller gives general authorisation to the sub-processors in section 3 (cloud hosting and storage, e-mail delivery, payment processing, error monitoring). The Processor will give at least 30 days' notice of an intended change by e-mail to organisation owners; the Controller may object on reasonable grounds, in which case the parties will seek a solution and either may terminate the affected part of the Service. Automated extraction of statements that the deterministic converters cannot read may use a third-party AI platform under contract; statement content is sent for extraction only and is not used by that provider to train models under the Processor's terms with it.

9.6 Assistance

Taking into account the nature of the processing, the Processor assists the Controller with data-subject requests (access, rectification, erasure, portability) through the Service's export and deletion functions and, where needed, on request to [email protected], and with security, breach notification and impact assessments to the extent the information is available to it.

9.7 Personal data breaches

The Processor will notify the Controller's organisation owners without undue delay after becoming aware of a personal data breach affecting Client Personal Data, with the information reasonably available at the time, and will cooperate in the investigation.

9.8 Deletion and return

Archiving a client keeps its data; permanently deleting a client (owners only) deletes its accounts, positions, transactions, imports and reports and purges remaining source files. On termination of the Terms the Controller may export its reports and extracted data for 30 days; the Processor then deletes Client Personal Data from active systems and from backups in the ordinary cycle, unless retention is required by law.

9.9 Audit

The Processor makes available the information necessary to demonstrate compliance with this Addendum, including the organisation's audit trail and this documentation, and will allow for and contribute to audits conducted by the Controller or an auditor mandated by it, on reasonable notice, no more than once a year unless a supervisory authority requires otherwise, and subject to confidentiality.

9.10 Transfers and precedence

Transfers outside the EEA, the United Kingdom or Switzerland are made under the Standard Contractual Clauses (module two, controller to processor), available on request. In case of conflict, this Addendum prevails over the Terms with respect to the processing of Client Personal Data. Liability under this Addendum is subject to the limitations in the Terms.