Who we are
Investfora (investfora.com) is the platform of LIFT INVESTMENT MANAGEMENT SGEIC SA, authorised and supervised by the CNMV (Comisión Nacional del Mercado de Valores) in Spain under register no. 244, for retail and professional clients. LIFT INVESTMENT MANAGEMENT SGEIC SA is the controller of the personal data described here. Its registered address is shown on the CNMV register.
What we store
- Account: your name, email address, a hashed password (we never see the password itself), whether your email is confirmed, and when the account was created. If you sign in with Google or Apple we store the identifier and email they share with us.
- Sessions: for each device you sign in from, the browser description, IP address and sign-in time — so you can see and sign out other devices from your Account page.
- Your money with us: every euro in and out — the transfers you send, the reference you use, the bank details you give us for a withdrawal, and the resulting balance. We keep the whole ledger; a balance is never stored on its own.
- What you invest in: the deposits you open, the business loans you fund and for how much, the coins you swap into and out of, the money you move onto a trading account, and what each of those is worth.
- Holdings you track yourself: the assets, quantities, valuations and dates you enter, and the income and repayments you log. Practice account: virtual balances, positions, orders and auto-buy rules. Watchlists.
- Proving who you are: the outcome of your identity check — whether it was approved, when, the legal name read from your document, and the reference of the check itself. Where the check is run by our verification provider rather than by our own staff, you photograph your identity document and your face on their service and they hold those images; we receive and store their decision. Where a member of our staff verifies you instead, we record who did so.
- Invitations: if you joined on a friend's invitation, that you did, who invited you, and the reward paid to each of you.
- Activity: a plain-language record of everything that happened on your account — money in, money out, every buy and sell, and every change you or we made.
Why, and on what basis
To run your account, hold and move your money and carry out your instructions (performance of our agreement with you); to keep the account secure (our legitimate interest in security); to meet the record-keeping, anti-money-laundering and reporting duties that apply to a regulated firm (legal obligation); and to send you a notification you asked for (your request). Verifying your identity — including, where you use our verification provider, comparing a photograph of your face against your identity document — is done to meet the anti-money-laundering obligations that apply to us as a regulated firm, and where that comparison counts as biometric data we rely on that legal obligation and on the substantial public interest in preventing money laundering. The cookie that remembers a friend's invitation is stored only with your consent, which you can withdraw at any time from our cookie notice. We do not profile you, sell data, or use it for advertising.
Who else sees it
Our hosting provider, Hostinger, on whose servers this site and its database run; our email delivery provider (Resend, for account emails); our bank, which sees the transfers you send and receive; our identity-verification provider, Didit, which receives the photographs of your identity document and your face when you verify through it and returns its decision to us; and the broker that carries your trading account, which is given the name and email needed to open it and sees the trades on it. For prices we read public market data from CoinGecko, Yahoo Finance and Binance — they receive only the symbols we look up, never anything about you. Google sees your sign-in only if you choose to use it. If you allow market charts, TradingView draws them in your browser and sees that request. We do not sell your data or share it for anyone else's marketing.
Where it is kept
Our servers are in the United Kingdom. The United Kingdom is covered by a European Commission adequacy decision, which means personal data may be transferred there under the same protection it has in the EEA. Our other providers may process data outside the EEA under the safeguards their own agreements with us require. You can ask us for the details of any of these by emailing privacy@investfora.com.
How long
For as long as your account exists, and afterwards for as long as the law requires a regulated firm to keep records of money and instructions — normally five years, and up to ten where a supervisor asks. Sessions expire after seven days of inactivity and can be revoked at any time. Database backups are kept for 14 days on the same server, readable only by the account that runs the service. If you ask us to delete your account we remove your personal details and everything we are not required to keep; records we must keep by law — the money that moved, the instructions you gave, and the identity check behind them — stay for the period above, and we tell you what was kept.
Your rights
You can access and correct your details on the Account page, and you can request a copy or deletion of your data, or object to processing, by emailing privacy@investfora.com. You also have the right to complain to your national data-protection authority.