Privacy policy
In short: we collect only what is needed to run your account. Your data is encrypted and hosted in the European Union. We do not sell it, we show no advertising inside Qubo and use no audience measurement tools. The only advertising tracker, the Meta Pixel, runs only if you accept it in the cookie settings. You can delete your account and all your data at any time from your profile.
1. Data controller
The controller of your data is:
ASSETO Ltd, company number 41397969, which operates the Qubo brandGrand Millennium Plaza, 7/F, 181 Queen's Road Central, Hong Kong Island, Hong Kong
support@asterio.app
This policy applies to the asterio.app website, the Qubo dashboard and the emails we send you. It is drawn up in accordance with the EU General Data Protection Regulation (GDPR), the UK GDPR and the Hong Kong Personal Data (Privacy) Ordinance.
2. Data we collect
| Category | Data | Source |
|---|---|---|
| Account | Email address, password (stored only in irreversibly hashed form, which we cannot read), name, country (optional), language, account creation and confirmation dates | You, at sign-up and in your profile |
| Plan and preferences | Selected plan, notification preferences (email alerts, push notifications, weekly summary) | You |
| Portfolio | Purchases and sales you record: asset, quantity, price, date | You |
| App preferences | Social media accounts followed or muted, public blockchain addresses you follow and their labels, votes on assets | You |
| Technical data | IP address, browser and device type, login timestamps, authentication and security logs | Collected automatically by our hosting providers |
| Payment (paid plans) | Plan subscribed, amounts, billing history, billing country. Card data is processed directly by our payment provider: we never see full card numbers. | You, through the payment provider |
| Support conversations | Your messages and our replies | You |
If you use Qubo without an account, your transactions and preferences stay only in your browser: they are not sent to us.
We never ask for private keys or wallet recovery phrases. Never send them to us.
If you choose to connect an exchange, we store the read-only API key you provide (for example Binance), encrypted with a master key kept in a separate vault, and use it only to read your balances and open positions for display in your portfolio. Keys that allow trading, transfers or withdrawals are rejected. You can delete a key at any time from your portfolio; it is also deleted with your account.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Create and manage your account, authenticate you, save and sync your portfolio and preferences across your devices | Performance of the contract |
| Send emails required for the service: address confirmation, password reset, subscription information, material changes | Performance of the contract |
| Send the alerts and weekly summary you have switched on | Consent, which you can withdraw at any time in your profile |
| Manage paid subscriptions, billing and accounting | Performance of the contract and legal obligations |
| Secure the service, prevent fraud and abuse, diagnose incidents | Legitimate interest in keeping the service secure and working properly |
| Answer your support requests and requests to exercise your rights | Performance of the contract and legal obligations |
| Comply with our legal obligations and respond to requests from authorities | Legal obligation |
| Measure and target our ads on Facebook and Instagram with the Meta Pixel (section 5) | Consent, given and withdrawn in the cookie settings |
4. What we do not do
- We do not sell or rent your data.
- We show no advertising inside Qubo. We use the Meta Pixel to measure our own ads on Facebook and Instagram, and only if you accept it in the cookie settings (see section 5).
- We do not use your portfolio to profile you for marketing purposes.
- The tone assigned to news is computed from the news itself, not from you. Qubo makes no automated decisions that produce legal effects concerning you.
5. Browser storage and cookies
Qubo uses no audience measurement cookies. The dashboard uses your browser's local storage to:
- remember your display language and currency;
- keep you signed in (session token);
- keep a copy of your portfolio and preferences for fast display and for use during network outages;
- if you have no account, keep your data on your device only.
The support chat (Tidio) stores a session identifier in your browser so that your conversation is kept between visits. It is needed for the chat you choose to use.
These items are strictly necessary for the service you request, so they do not require your consent. The copy linked to your account is erased from the device when you sign out. Our host Cloudflare may also set cookies that are strictly necessary for the security of the site.
Advertising (Meta Pixel). If, and only if, you switch on the « Advertising » category in the cookie settings, the site loads the Meta Pixel from Meta Platforms Ireland Ltd. It tells Meta which pages you visit on our site and whether you create an account, start a payment or subscribe (with the name of the plan), together with your IP address, browser information and the cookies Meta sets (such as _fbp). We use it to measure how well our ads on Facebook and Instagram work and to show them to relevant people. Meta may link this information to your Meta account; for that part, Meta and ASSETO Ltd are joint controllers, and Meta processes the data under its own privacy policy. The legal basis is your consent. It is off by default, and you can withdraw it at any time with the « Cookie settings » link at the bottom of the home page. No data from your portfolio, and neither your email address nor your name, is sent to Meta.
6. Recipients and providers
Your data is accessible only to the people at ASSETO Ltd who need it, and to the following providers, who act on our behalf and under our instructions:
| Provider | Role | Data concerned |
|---|---|---|
| Supabase, Inc. (United States), with data hosted in the European Union (Ireland) on Amazon Web Services | Database, authentication, sending account emails | Account data, portfolio, preferences, technical data |
| Cloudflare, Inc. (United States) | Hosting and delivery of the website, protection against attacks, domain management | IP address, technical data |
| Airwallex, payment provider | Collecting subscription payments, invoicing, fraud prevention | Payment and billing data |
| Meta Platforms Ireland Ltd (Ireland), with transfers to Meta Platforms, Inc. (United States) | Measuring and targeting our ads on Facebook and Instagram, only with your consent | Pages visited on our site, sign-up, payment and subscription events, IP address, technical data, Meta cookies |
| Tidio LLC (United States) | Customer support chat in Qubo | Messages you send, email address and name of your account, plan, IP address, technical data |
In addition, when you open the site, your browser connects directly to third-party services, which then receive your IP address and technical information about your browser:
- Google Fonts (Google LLC, United States), to display typefaces;
- jsDelivr, an open-source file delivery network, to load the software library used for accounts;
- Binance, to receive the public real-time feed of crypto-asset prices.
These services process that data under their own privacy policies. We send them no data from your account.
Finally, we may disclose data to authorities where required by law, or to a buyer if the service is transferred, in accordance with this policy.
7. Transfers outside the European Union
ASSETO Ltd is established in Hong Kong, which is not covered by an adequacy decision of the European Commission. Some of our providers are established in the United States. These transfers are covered by the standard contractual clauses adopted by the European Commission and, where applicable, by the EU–US Data Privacy Framework to which the provider has signed up. You can obtain a copy of these safeguards by writing to us.
Your account and portfolio data remain stored in the European Union.
8. Retention periods
| Data | Period |
|---|---|
| Account, portfolio and preferences | For as long as your account exists. When you delete your account, they are erased immediately from our database. Technical backup copies are overwritten within 30 days at the latest. |
| Inactive accounts | Deleted after 24 months without sign-in, after notifying you by email at least 30 days in advance |
| Technical and security logs | Up to 90 days |
| Invoices and accounting data | 7 years, in line with applicable accounting and tax obligations |
| Support conversations | 3 years after our last exchange |
9. Security
Your data is encrypted in transit (TLS) and at rest (AES-256). Passwords are stored only in irreversibly hashed form. Database-level security rules ensure that each account can access only its own data. Qubo's access to the database is limited to the people who need it and protected by strong authentication.
If a data breach poses a risk to your rights, we will notify the competent authority and, if the risk is high, inform you as soon as possible.
10. Your rights
You have the following rights over your data:
- access: obtain a copy of your data;
- rectification: directly from your profile, or by writing to us;
- erasure: deleting your account from your profile erases all your data;
- restriction and objection to processing based on our legitimate interest;
- portability: receive your data in a structured, machine-readable format;
- withdrawal of consent at any time, for example by switching off alerts in your profile;
- if you live in France, set instructions on what happens to your data after your death.
To exercise these rights, write to support@asterio.app from your account's email address. We reply within one month, which may be extended by two months for complex requests. We may ask you to confirm your identity.
You may also lodge a complaint with the data protection authority of your country of residence, for example the CNIL in France (cnil.fr), or with the Privacy Commissioner for Personal Data in Hong Kong (pcpd.org.hk).
11. Minors
Qubo is reserved for people aged 18 or over. We do not knowingly collect data about minors. If you believe a minor has created an account, contact us and we will delete it.
12. Changes
We may change this policy to reflect changes to the service or the law. The last update date is shown at the top of the page. For material changes, we will notify you by email or in the service before they take effect.
13. Contact
For any question about your data: support@asterio.app, or by post to ASSETO Ltd, Grand Millennium Plaza, 7/F, 181 Queen's Road Central, Hong Kong Island, Hong Kong.