PRIVACY POLICY
Effective from 13 June 2026

WorthMap is a financial-analysis application that helps you record and understand the value of your own investment portfolio. This Privacy Policy explains what personal data we collect, how we use it, and the rights you have over it. Protecting your data is fundamental to how WorthMap is built: we never sell your personal data, and we never share it with third parties for their own purposes.

WorthMap is operated by HK Managed Services Provider Limited, a company incorporated in Hong Kong ("WorthMap", "we", "us" or "our"). WorthMap is a trademark of HK Managed Services Provider Limited.

1. Scope

This policy applies to the personal data we process when you use the WorthMap application, website and related services (together, the "Service"). It does not cover any third-party website or service you may reach through links in the Service; those are governed by their own privacy policies.

The Service is not intended for, and may not be used by, anyone under the age of 18, and we do not knowingly collect data from children.

2. The Data We Collect

We collect only the data we need to provide the Service to you:

• Account and identity data — the name and email address you register with, your hashed password, and, where you enable two-factor authentication, the credentials needed to verify it. We never store your password in plain text.
• Portfolio and financial data you enter — the holdings, transactions, asset details, watchlists and preferences you add so that WorthMap can calculate and present the value and composition of your portfolio. This information is yours; we use it only to provide the analysis you have asked for.
• Payment data — when you subscribe to a paid plan, your payment is processed by Stripe, our payment provider. We do not collect or store your full card number; we receive only the limited information needed to confirm and manage your subscription.
• Technical and usage data — basic information generated when you use the Service, such as device and browser type, approximate location derived from your IP address, log data, and which features you use. We use this to keep the Service secure, reliable and working correctly.

3. How We Use Your Data

We use your personal data for a limited set of purposes:

• to create and maintain your account and to provide the portfolio analysis and other features of the Service;
• to process your subscription and payments;
• to keep the Service secure, prevent fraud and abuse, and diagnose technical problems;
• to respond to your requests and provide customer support;
• to send you essential service messages (such as security alerts, account notices and changes to our terms); and
• to comply with legal and regulatory obligations that apply to us.

We do not use your portfolio or financial data to build advertising profiles, and we do not carry out automated decision-making that produces legal effects about you.

4. We Do Not Sell or Share Your Data

We do not sell, rent or trade your personal data. We do not share it with advertisers, data brokers or any other third party for their own marketing or commercial purposes.

The only third party with whom we share limited data is Stripe, our payment provider, and only the information necessary to process and manage your subscription payments. Stripe processes that data as an independent controller under its own privacy policy and applicable card-network rules. We do not share your portfolio, financial holdings or analysis data with Stripe or with anyone else.

We may also disclose data where we are legally required to do so — for example, in response to a valid order from a competent authority or court, or where necessary to protect our rights, safety or property or those of our users. Where the law allows, we will tell you before doing so.

5. Data Retention

We keep your personal data for as long as you have an account with us and you continue to use the Service. If you close your account, we delete or anonymise your personal data within a reasonable period, except where we must retain certain information to comply with legal, tax or accounting obligations, or to resolve disputes.

6. Data Security

We use technical and organisational measures designed to protect your data against unauthorised access, loss or misuse, including encryption of data in transit, hashing of passwords, access controls, and the option of two-factor authentication on your account. No method of transmission or storage is completely secure, but we work continuously to safeguard your information.

7. Your Rights

Subject to applicable data protection law, you have the right to:

• access the personal data we hold about you;
• have inaccurate or incomplete data corrected;
• request deletion of your data;
• object to, or ask us to restrict, certain processing;
• receive a copy of the data you provided to us in a portable format; and
• withdraw any consent you have given, at any time, without affecting processing already carried out.

You can exercise most of these rights directly from within the Service, or by contacting us using the details below. You also have the right to lodge a complaint with the data protection authority in your country of residence.

8. International Transfers

We are based in Hong Kong, and the providers we use to operate the Service may process data in other countries. Wherever your data is processed, we require that it is protected by appropriate safeguards consistent with this policy and with applicable data protection law.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before they take effect. The "Effective from" date at the top of this policy shows when it was last updated.

10. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, or if you wish to exercise your rights, please contact us at [email protected].