Privacy policy

Last updated: 21 June 2026

This policy explains what data Gardio collects, why, how long it is kept, who it is shared with and what your rights are. We comply with the General Data Protection Regulation (GDPR).

Data controller

The data controller is the publisher of Gardio (see the legal notice). Contact: contact@gardiocoach.com.

Data we collect

• Account: email address, password (stored hashed, never in clear text), language, time zone, status and dates (account creation, last login).
• Investor profile (onboarding questionnaire): age range, country of residence, capital range, time horizon, risk tolerance and reactions to a market drop / rally, experience level, goals, asset classes, sectors and regions of interest, wealth situation, a free-text description of your existing investments, and your preferred contact frequency.
• AI coach conversations: the content of the messages you exchange with the coach.
• Portfolio (where applicable, if the feature is used): the holdings you enter.
• Technical data: strictly necessary cookies only (see the "Cookies" section).

We do not collect payment card data at this stage (the trial requires no card).

Why we use this data (purposes and legal bases)

• Providing the service — creating your account, personalising the coach, remembering your conversations: performance of the contract (our Terms) and pre-contractual steps for the trial.
• Security and abuse prevention — email verification, protection against fraudulent sign-ups: legitimate interest.
• Service emails — account verification and operational messages: performance of the contract. Any non-essential emails (reminders, news) would rely on your consent.

Who we share data with (processors)

We never sell your data. It is processed by a small number of providers essential to the service:

• Anthropic, PBC (United States) — the messages you send to the coach, together with a summary of your profile used as context, are sent to Anthropic to generate the AI's replies. This transfer outside the European Union is governed by the European Commission's Standard Contractual Clauses. Anthropic does not use these exchanges to train its models under the business access used by Gardio.
• Brevo (Sendinblue SAS, France) — European Union — sending of service emails (account verification, etc.).
• Infomaniak Network SA (Switzerland) — hosting of the site and database. Switzerland benefits from a European Commission adequacy decision.

Retention

Your data is kept for as long as your account is active. If you ask for your account to be deleted, or after a prolonged period of inactivity, your data is erased within a reasonable time, unless a legal retention obligation applies (for example, in the future, accounting records linked to a payment).

Your rights

Under the GDPR, you have the following rights:

• Access to your data and a copy of it;
• Rectification of inaccurate data;
• Erasure ("right to be forgotten");
• Restriction of and objection to processing;
• Portability of your data;
• Withdrawal of consent at any time, where processing is based on it.

To exercise these rights, email contact@gardiocoach.com. We respond within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Cookies

Gardio uses only strictly necessary cookies: a session cookie (to keep you logged in), a security token (CSRF protection) and remembering your language. We use no advertising cookies and no third-party analytics. These essential cookies do not require prior consent, which is why you are not shown a cookie banner.

Security

The site is served over HTTPS, passwords are hashed and access to data is restricted. No system is perfectly secure, but we take reasonable measures to protect your information.

Minimum age

Gardio is intended for adults (18 and over). The service is not directed at minors.

Changes

This policy may change. The last-updated date appears at the top of the page; significant changes will be highlighted.