1. Who we are and what this policy covers
WOLF Financial Puerto Rico, LLC operates ETF Tracker and determines how personal information is processed for its website, account services, watchlists, email updates, issuer tools, portfolio analysis, and sharing features. In this policy, “we” and “our” refer to that company. Where data-protection law uses the term, we are the controller for our own processing. This policy describes information that identifies, relates to, or can reasonably be linked to an individual or household.
This policy covers our processing through the Service and associated support interactions. Independent brokers, identity providers, SnapTrade, issuers, and external websites have their own policies. Their processing is not controlled by this policy merely because you reach them through ETF Tracker. The Terms of Service address your contractual use of the Service; acknowledging this policy does not waive a privacy right or supply a separate consent where the law requires one.
2. Information we collect and where it comes from
We collect information directly from you, automatically from your use of the Service, from an identity provider you choose, from an institution or connection provider you authorize, and from public or licensed financial sources. The categories below are collected only as relevant to the features you use. You can browse public content without connecting a brokerage.
- Identifiers and account details: email address, internal user ID, provider identifiers, name and profile information shared by a chosen sign-in provider, and account or session status. We do not need your identity-provider password.
- Preferences and activity: saved funds, watchlist names and membership, fund-email choices, pause and unsubscribe settings, newsletter subscriptions, theme, pending saves, and interactions with account features.
- Financial and portfolio information: the connection and account information described in the next section, including holdings, balances, values, cash, quantities, masked account details, and calculated portfolio characteristics.
- Content you provide: portfolio thesis, shared portfolio material, issuer applications and claims, videos, documents, support messages, feedback, and any other information you choose to submit.
- Technical and security information: IP address, browser or device characteristics, user agent, request times and paths, error and access logs, authentication cookies, connection status, and identifiers needed to protect and operate the Service. Our application hashes request addresses for rate limiting; infrastructure providers may process underlying request information.
- Consent and administration records: policy versions, acceptance timestamps, consent entry point, user agent, provider-document links associated with connection consent, email opt-in and opt-out times, and correspondence about rights or complaints.
- Derived information: allocation, exposure, concentration, overlap, estimated costs and income, comparisons, classifications, summaries, and other inferences calculated from submitted, connected, or market data. These calculations may be incomplete or inaccurate.
3. Connected portfolio data and sensitive financial information
If you choose to connect a brokerage, we use SnapTrade to facilitate access to the accounts you authorize. Depending on the institution and permissions, we receive institution and authorization identifiers, broker and account names, account type and currency, masked account numbers, holdings and security identifiers, quantities, balances, cash, market values, cost information where available, refresh times, and connection permissions or errors. Provider APIs may make additional information available; the current feature primarily processes account, position, and balance data needed for portfolio analysis.
Brokerage credentials are entered in the broker or provider flow and are not collected through ETF Tracker’s own forms. We store provider-issued user IDs, connection credentials, and authorization identifiers on the server to retrieve authorized information. Our stored account-number display uses only the last four digits. Do not put full account numbers, passwords, tax identifiers, multifactor codes, or other sensitive secrets in a thesis, issuer upload, or support message.
We may refresh authorized information when you connect, return to a portfolio, or request a refresh, and retain periodic portfolio snapshots while the integration remains active. Data can be stale, partial, or inconsistent with your broker. Trading information or instructions are processed only if the trading feature is enabled and you separately grant the required permissions and submit an instruction. Data consent alone never authorizes us to trade or manage your account.
Financial information can receive heightened protection under applicable law. We use and disclose it for the purposes described here and under your permissions, applicable privacy requirements, and provider restrictions. A general agreement to the Terms does not eliminate those protections.
4. How we use information
We determine how information is used within the Service for the purposes below, subject to applicable law and the permissions and choices described in this policy. Some purposes are necessary to provide the feature you requested; others support legitimate operation, development, and protection of the platform where legally permitted.
- Create and authenticate accounts, maintain sessions, verify authority, and provide support.
- Save watchlists and preferences, synchronize them across devices, and send the optional updates you request.
- Connect and refresh authorized portfolios; show holdings and cash; calculate exposures, overlap, fees, income, comparisons, and other portfolio insights; and generate user-directed share pages and graphics.
- Personalize platform views and develop, test, measure, improve, and commercialize features, analysis methods, datasets, and user experiences, including new or paid platform tools.
- Perform internal product research, quality checks, debugging, reliability monitoring, and usage analysis consistent with the sensitivity of the information.
- Prevent fraud, unauthorized access, abuse, market-data misuse, and security incidents; enforce contracts and provider restrictions; and protect people, property, and legal rights.
- Review issuer claims, applications, documents, and videos; administer ownership and publication permissions; and publish approved material.
- Keep consent receipts, respond to privacy requests, comply with legal obligations, resolve disputes, and administer business transactions and records.
5. Platform discretion, analytics, and commercial use
By authorizing the portfolio feature, you permit us to process and combine your data with market and fund information for the stated platform purposes. We decide how those features organize, analyze, compare, and present the information. This includes producing derived statistics and insights and using information to research, improve, and develop our commercial platform. It does not make personal information our unrestricted property or authorize an unrelated purpose without required notice or consent.
We may aggregate or deidentify information to create statistics, benchmarks, research, reports, and commercial analytics that do not reasonably identify you. Such information may be used, published, or licensed to others where lawful and permitted by provider agreements. We take reasonable steps to prevent identification, maintain information represented as deidentified in that form, and require appropriate restrictions from recipients. We do not attempt to reidentify it except where legally permitted to test deidentification.
Identifiable holdings are not made public simply because you connect. We do not sell your identifiable connected financial information or disclose it to third parties for their independent marketing. Broader uses, including a new sensitive-data purpose or a materially different disclosure, require updated notice and any separate consent or opt-out mechanism mandated by law before they begin. We do not currently provide account data to a general-purpose external AI model for training; a new materially different use would be subject to the same requirements.
7. Providers used by the current Service
Cloudflare provides website and infrastructure hosting, security, content delivery, and issuer-video services. Supabase provides the database and account authentication. SnapTrade facilitates optional brokerage connections and receives the information needed to operate those connections. Resend supports email delivery and newsletter or notification administration when delivery is enabled. Google or Apple processes sign-in information if you choose that method. Your broker remains responsible for its account services.
Market and fund information comes from the sources identified on our Data sources page, including licensed data providers, issuer material, and regulatory filings. We do not need to send your identifiable connected holdings to a public fund-data source just to obtain general fund information. A provider may process technical requests or account information necessary for the particular integration.
Providers can act under our instructions for some activities and independently for others, such as maintaining their own security or satisfying legal obligations. Review their current privacy notices, particularly before connecting a broker or choosing an identity provider. We may change service providers as the Service develops while maintaining legally required protections and notices.
Provider notices: Cloudflare, Supabase, SnapTrade Privacy Policy, Resend. See our Data sources.
8. Share links, exports, and public material
A portfolio is not public by default. If you create a share link, we store a share snapshot and make it available to anyone with its token. The current link format includes portfolio percentages, selected analysis, and your thesis; it excludes dollar balances, broker names, account names and identifiers, and cost basis. A thesis may still identify you or reveal information you type. Link-preview services can request and cache the shared image.
Exported images can include dollar values if you enable that option. Always review a graphic before saving or posting it. Recipients may copy, screenshot, redistribute, or post a link publicly. Disabling a link stops future access through our link when processed, but cannot remove independent copies, screenshots, previews, or search caches. A request not to index a page is not a guarantee of privacy.
Issuer profiles, approved videos, descriptions, documents, and other material intended for publication can be publicly accessible. Do not include personal or confidential information that you do not want published. We can remove our copy in appropriate circumstances but cannot control copies held by independent recipients.
10. Sales, targeted advertising, and browser privacy signals
We do not currently sell personal information or share it for cross-context behavioral advertising as those terms are defined by the California Consumer Privacy Act, and we do not use connected financial information for third-party targeted advertising. Provider disclosures needed to operate a feature are subject to the relevant restrictions and are not permission for a provider to use your portfolio for independent marketing. Deidentified analytics are handled as described above.
Because the current Service does not engage in those sale or targeted-advertising practices, there is no such application activity for a Global Privacy Control signal to opt you out of today. We will honor applicable universal opt-out signals if an activity subject to them is introduced and provide any required opt-out mechanism. We do not change essential service processing in response to the older Do Not Track header, for which there is no uniform technical standard.
We do not knowingly sell or share personal information of children under 16. Our Service is for adults. The absence of a sale or advertising program does not remove your other privacy rights.
11. Email preferences and operational messages
Newsletters and fund-email updates use their own choices and confirmation processes. Watching a fund, creating an account, or accepting legal terms does not automatically subscribe you to every email. We store which categories you enable, when choices change, and information needed to honor unsubscribe and suppression requests. A pending newsletter choice can be carried through sign-in if you expressly select it.
Use the relevant email’s unsubscribe link, update choices in Watchlist, or contact us to stop optional messages. We may retain a minimal suppression record to avoid sending messages you declined. Essential authentication, security, rights-request, and account-administration messages may continue where necessary and lawful. Delivery providers process recipient and delivery information to send and troubleshoot messages.
12. How long we keep information
We retain information for as long as reasonably necessary for the purpose for which it was collected, including operating an active account or connection, maintaining requested preferences, complying with legal and provider obligations, handling disputes, preventing abuse, and documenting consent. Retention depends on the type and sensitivity of information, account status, purpose, legal requirements, security needs, and whether a less identifying record can serve the purpose. We do not promise a single retention period for every category.
Account and watchlist information generally remains while your account is active or until a valid deletion request is processed, subject to lawful exceptions. Connected portfolio snapshots remain while the integration is active; removing the last brokerage currently deletes stored snapshots, integration credentials, connection records, and share links for that integration. A portfolio thesis and unrelated account records are not automatically deleted by disconnection. Consent receipts, suppression entries, support correspondence, and security or legal records may be retained as reasonably necessary for their documented purposes and applicable limitation periods.
Deleted information may remain for a limited period in backup, recovery, or security systems under provider retention cycles and access restrictions, or in records subject to a legal hold. It is not restored to ordinary use except as necessary for recovery, legal obligations, or another lawful purpose. Providers maintain independent records under their own terms. Information that has been properly aggregated or deidentified may be retained longer because it no longer reasonably identifies you, subject to applicable restrictions.
13. Disconnecting a broker and requesting account deletion
Use the connection controls on Portfolio to disconnect a brokerage. You can also revoke access with your broker or SnapTrade where supported. Disconnecting does not close the underlying broker account or necessarily erase information held by the broker or provider. Removing the last connection triggers deletion of the integration records described above when successfully processed; failed requests can require support to complete.
For account closure, deletion, access, correction, or questions about retained data, email charles@wolf.financial from the account address if possible. Specify whether you want to disconnect a broker, remove a share link, delete portfolio records, or close the entire account so we can handle the request accurately. We verify requests proportionately and coordinate necessary provider actions. We may retain information where a lawful exception applies and will explain relevant limitations as required. Do not send a password or full financial account number to verify your identity.
You may also clear local and session storage to remove browser-only preferences or signed-out watchlists. Clearing browser storage does not itself delete a server account, revoke a broker authorization, or erase someone else’s copy of a shared image.
14. Security and access safeguards
We use technical and organizational measures designed to protect information, including authenticated access, server-side storage of private integration credentials, database access rules intended to separate user records, restricted provider credentials, and limited access for operational purposes. Connection requests and access are handled through the relevant provider’s supported mechanisms. These descriptions are not a promise of a particular certification, audit result, or absolute protection.
No website, network, account, storage system, or third-party integration is completely secure. We cannot guarantee that unauthorized access, loss, disclosure, or interruption will never occur. Protect your email and broker accounts, use available multifactor authentication, keep devices current, and tell us promptly about suspected misuse. We will provide security-incident notices where applicable law requires them.
15. Privacy rights and how to exercise them
Depending on your location, our activities, and the applicable law’s eligibility requirements and exemptions, you may have rights to confirm processing; obtain access to categories or specific pieces of information; receive a portable copy; correct inaccuracies; request deletion; withdraw a consent; object to or restrict processing; and opt out of a covered sale, targeted advertising, or certain profiling. Sensitive information may carry additional consent or limitation rights. Not every law applies to every business or category of information.
Submit a request to charles@wolf.financial. Identify the right you want to exercise, the relevant account or interaction, and a safe way to reply. We may verify identity, account control, or an authorized agent’s authority using information proportionate to the request and sensitivity. We do not require unnecessary financial secrets. We will respond within the period required by applicable law, notify you of a permitted extension when needed, and explain a refusal or exception as required. We will not unlawfully discriminate or retaliate for exercising a privacy right.
Withdrawal of consent applies prospectively and does not undo lawful processing before withdrawal. Some information is necessary to provide an account or a connected feature; withdrawing that authorization may mean we cannot continue the feature. We may deny or limit requests where permitted, including to protect others, comply with law, preserve security, establish claims, or avoid disclosing information we cannot safely verify.
If an applicable law gives you a right to appeal a denied request, reply to our decision with “Privacy appeal” and the reasons you disagree. We will review the appeal and provide the outcome and further complaint options within the required period. You may contact a competent state attorney general, consumer-protection regulator, or data-protection authority without first giving up any other remedy.
16. Additional notice for California residents
Where the California Consumer Privacy Act applies, the categories described in this policy include identifiers; internet or electronic activity; financial or customer-record information; professional information submitted by issuer representatives; audiovisual material you upload; and inferences drawn from other information. Connected financial account information can be sensitive personal information. Sources, business purposes, recipient categories, and retention criteria are set out in the corresponding sections above and apply to the information collected through the current Service during the preceding 12 months, as relevant to the features used.
We collect and use these categories to provide requested services and for the disclosed operational, security, compliance, and development purposes. We do not sell personal information or share it for cross-context behavioral advertising. Sensitive financial information is processed to provide authorized portfolio functions and related necessary, lawful operations; any additional restricted purpose would require the notices, controls, or consent that law requires. We do not offer a program that pays you for personal information or conditions a financial incentive on selling it.
Eligible California residents may request access, correction, deletion, portability, and information about categories of collection and disclosure, and exercise any applicable sale, sharing, or sensitive-information rights without unlawful discrimination. An authorized agent may submit a request with sufficient proof of authorization; we may also verify the consumer where permitted. Use the contact and appeal procedures above. We do not disclose personal information to third parties for their own direct marketing without any consent required by California law. Statutory exemptions, including any applicable financial-information exemption, are assessed for the relevant information and do not automatically exempt the entire Service.
17. International users, legal bases, and transfers
The Service is operated from Puerto Rico and uses providers whose infrastructure and personnel may be in the mainland United States and other countries. Your information may be processed outside your state or country, where legal protections may differ. Merely accepting these Terms does not waive transfer safeguards required by law. Where a transfer is subject to such requirements, we use an applicable lawful mechanism and safeguards, as appropriate to the processing and provider.
Where the GDPR, UK GDPR, or a similar law applies, processing may rely on performing or preparing a contract for requested account and portfolio services; legitimate interests in operating, securing, supporting, and improving the Service where those interests are not overridden by your rights; compliance with legal obligations; and consent for optional or sensitive processing where required. We do not rely on a blanket acknowledgement of this policy as consent to every purpose. You may withdraw a consent and request information about an applicable legal basis or transfer safeguard through the contact below.
Where applicable, you may also have rights of access, rectification, erasure, portability, objection, restriction, and complaint to your local supervisory authority. We do not currently use portfolio analysis to make solely automated decisions producing legal or similarly significant effects about eligibility for credit, insurance, employment, or access to essential services. Informational rankings and summaries are not a creditworthiness or suitability decision. If we introduce materially different automated decision-making, we will provide any required notice and rights before it begins.
18. Children and age restrictions
The Service is intended for people at least 18 and is not directed to children. We do not knowingly collect personal information from children under 13, and do not knowingly provide accounts to minors under 18. If you believe a child has submitted information, contact us with the relevant details so we can investigate, restrict access, and delete information as required. Do not provide unnecessary information about the child in an initial message.
19. Changes to this policy
We may update this policy to reflect changes in the Service, providers, law, or processing. The page shows the version and date. We will give notice of material changes through the Service or another appropriate channel and obtain consent when required before applying a new purpose or disclosure. Updating a policy does not retroactively authorize a prohibited use of information already collected.
When the platform policy version changes, account features ask for renewed acknowledgement and Terms acceptance. Separate choices continue to govern newsletters, marketing, brokerage permissions, public sharing, and any processing that legally requires a distinct consent. Previous published text is retained in our version history, and you may request the version associated with an acceptance receipt.
20. Contact, requests, and complaints
For privacy questions, rights requests, consent receipts, account deletion, complaints, or security concerns, contact WOLF Financial Puerto Rico, LLC, Puerto Rico, United States, at charles@wolf.financial. Use an email address you control and include only information necessary to identify the request. We may ask for proportionate verification through a secure process. You may also complain to a regulator with jurisdiction over the issue; contacting us does not limit that right.