Privacy Policy

1. Who we are

Vest.ie (“Vest”, “we”, “us”) provides an online tool that helps Irish-resident shareholders track Restricted Stock Units (RSUs), shares, ETFs, vesting events, trades and sale events, and the related Capital Gains Tax and ETF exit tax. For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Irish Data Protection Act 2018, we are the data controller for the personal data described in this policy.

Vest is intended for adults: it is not directed at, or intended for use by, anyone under the age of 18, and we do not knowingly collect personal data from children.

If you have any questions about this policy or how we handle your data, contact us at hello@vest.ie.

2. Data we collect

We collect only what we need to run the service:

• Account data — your email address (used to sign you in via magic link or Google). If you sign in with Google, we receive a Google account identifier and, optionally, your name.
• Billing data — if you subscribe to a paid plan, our payment processor (Stripe) assigns us a customer reference. We never see or store your full card details.
• Product data you enter — RSU grants (company, ticker, grant date, vesting schedule), share and ETF holdings, vesting events (fair market value, tax figures), trades, sell orders and dividends (price, date, quantity).
• Security data — limited technical information (such as your IP address) is processed transiently to verify sign-in requests, prevent abuse, and keep your account secure.

Your email address and name are encrypted at rest. We do not collect special-category data, and we do not buy or enrich your data from third parties.

3. How we use your data and our legal bases

• To provide the service (creating your account, storing your grants, calculating your tax) — legal basis: performance of a contract with you.
• To take payment for paid plans — legal basis: performance of a contract.
• To keep Vest secure and reliable — authenticating you, preventing fraud and abuse, monitoring security, improving reliability, and enforcing our Terms — legal basis: legitimate interests.
• To meet legal obligations such as accounting and tax record-keeping — legal basis: legal obligation.

We do not use your data for advertising, and we do not sell or share it for marketing purposes.

4. Service providers (processors)

We share data only with the providers we need to operate Vest. Each acts as a processor on our behalf under a data processing agreement:

• Stripe — payment processing and fraud prevention for paid subscriptions.
• Resend — sending transactional emails such as your magic sign-in link.
• Cloudflare — content delivery, the secure tunnel that routes traffic to our origin server, static hosting for our marketing site, and the “Turnstile” challenge that protects our sign-in form from spam and automated abuse.
• Our cloud hosting provider (EU region) — the infrastructure on which the application and database run, located within the European Union.

5. International transfers

Your data is stored within the EU. Some of our processors (such as Stripe and Cloudflare) are organisations with operations outside the EU; where data is transferred outside the EEA, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses and, where applicable, certification under the EU–US Data Privacy Framework. We self-host our website fonts, so visiting Vest.ie does not transfer your data to any third-party font provider.

6. Security

We protect your data with industry-standard measures, including encryption in transit (TLS/HTTPS), encryption at rest for sensitive identifiers such as your email and name, restricted access on a need-to-know basis, and activity logging. No system is perfectly secure, but if a personal-data breach occurs that is likely to affect your rights, we will notify the Irish Data Protection Commission and, where required, affected users in line with our obligations under the GDPR.

7. How long we keep your data and deletion

We keep your personal data for as long as your account is active. When you delete your account, we delete your personal data — your profile, grants, vesting events, trades, and tax allocations — without undue delay, except where we are required to retain limited information by law.

In particular, where required by Irish accounting and tax law we (and our payment processor, Stripe) retain limited financial records, such as invoices, for the period required by law. Residual copies of deleted data may also persist in secure backups for a limited period before being overwritten. After deletion we keep only a minimal audit entry containing an internal account identifier and the deletion timestamp; this contains no personal data and is retained solely for security, audit, and accounting purposes.

8. Automated decision-making

Vest’s tax figures are calculated deterministically from the information you enter and are presented for you to review. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects on you.

9. Your rights

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. We make the two most common rights self-service:

• Access / portability — use Download my data in your Account settings to export everything we hold about you as a JSON file.
• Erasure — use Delete my account in your Account settings to permanently delete your account and data.

For any other request, email hello@vest.ie. If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Irish Data Protection Commission (dataprotection.ie), 21 Fitzwilliam Square South, Dublin 2, D02 RD28.

10. Cookies

Vest uses only strictly necessary cookies and browser storage required to sign you in and remember your preferences. We do not use advertising, analytics, or tracking cookies. See our Cookie Policy for the full list.

11. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify registered users by email. The “last updated” date above always reflects the current version.

12. Contact

Questions about this policy or your data? Email us at hello@vest.ie.