Last updated: 16 September 2026
Tangent is a personal wealth aggregator. This policy describes which personal data we process, for what purposes, on what legal basis, and with whom it is shared. It applies to the service available at https://riskybusinesses.uk and to the "Tangent" iPhone app, which uses the same account and the same server.
The data controller is:
Clément Gardair, a natural person, as a personal, non-commercial project.
76 rue de Rochechouart, 75009 Paris, France.
Contact:
[email protected]
sub) and the email
address it passes on to us (Apple may offer you a relay address), together with an
encrypted token (Fernet) that we use for no purpose other than verifying your identity.
The content of your portfolio, your financial profile and any configuration you freely enter in the interface. You are its sole author and sole owner.
Twice a day, Tangent records a snapshot of what it knows about your wealth (accounts, positions, spending, results of the method) so that it can later show you how it has evolved. These records are encrypted at rest (Fernet) with a key that is not stored in the database; they are included in the export of your data and deleted with your account.
Three strictly necessary cookies are used. No advertising or analytics cookies.
| Name | Purpose | Duration |
|---|---|---|
tangent_auth |
Keeps you signed in (HTTP-only, signed JWT), renewed as long as you use Tangent. | 7 days |
fastapiusersoauthcsrf |
Protection against CSRF attacks during the Google OAuth flow. | 1 hour |
tangent_apple_csrf |
Protection against CSRF attacks during the Sign in with Apple flow. | 10 minutes |
For diagnostic purposes, we keep technical logs (IP address, timestamp, HTTP route, status code) for 30 rolling days.
| Purpose | Data concerned | Legal basis |
|---|---|---|
| Account creation and management | Email, hashed password | Performance of the contract (Terms of Service) |
| Sign-in with Google or Apple | Email and identifier passed on by the provider | Explicit consent ("Continue with Google" / "Continue with Apple" button) |
| PSD2 bank aggregation | Accounts, transactions, investments, loans | Explicit consent (bank connection through Powens or Enable Banking) |
| Portfolio analyses | Bank data + manual entries | Performance of the requested service |
| Password reset | Performance of the contract | |
| Security (logs, audit) | IP address, authentication events | Legitimate interest (protection of the service) |
Tangent relies on the following processors to provide the service:
| Third party | Role | Data transmitted | Location |
|---|---|---|---|
| Powens (Linxo Group) | Authorised PSD2 bank aggregator | Bank credentials (entered at Powens, never seen by Tangent); returned: account data | France |
| Enable Banking | Authorised PSD2 bank aggregator, for banks Powens does not cover | Bank credentials (entered at the bank, never seen by Tangent); returned: account data | Finland (European Union) |
| Google LLC | OAuth (only if you choose "Continue with Google") | Email, basic profile (name, photo) — as per your Google consent | United States (Privacy Shield invalidated; transfer under Standard Contractual Clauses) |
| Apple Inc. | Sign in with Apple (only if you choose "Continue with Apple") and distribution of the iPhone app through the App Store | Email (or relay address), stable Apple identifier | United States (Standard Contractual Clauses) |
| Cloudflare | CDN, WAF, HTTPS tunnel | HTTP requests, source IP address | Global edge network (Europe as a priority for French users) |
| Resend | Sending transactional emails (password reset) | Recipient email address, email content | United States (Standard Contractual Clauses) |
No other third party has access to your data. No data is used for advertising, commercial profiling or training third-party AI models.
| Data | Duration |
|---|---|
| User account and portfolio | As long as the account exists; immediate deletion on request |
| Encrypted Powens / Enable Banking / Google / Apple tokens | Erased when the bank or provider is disconnected, or when the account is deleted |
| Archive (two snapshots per day, encrypted) | As long as the account exists; deleted with it |
| Technical logs | 30 rolling days |
| Database backups | 7 rolling days |
| Authentication audit log | 12 months |
Under the GDPR (« RGPD » in French; articles 15 to 22) and the Loi Informatique et Libertés (the French Data Protection Act), you have the following rights:
To exercise these rights, write to [email protected] from your account's email address. We reply within 30 days at most.
You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés, the French data protection authority).
Some processors (Google, Apple, Resend) are based in the United States. Data transfers to these recipients are governed by the European Commission's Standard Contractual Clauses (Decision 2021/914), which guarantee an equivalent level of protection.
This policy may be updated to reflect changes to the service or to the legal framework. The date at the top of this page shows the latest revision. Material changes are notified by email.
For any question about this policy: [email protected]