[DRAFT] This page is a carefully prepared draft and is not legal advice. It must be reviewed by a qualified solicitor before ValueBase launches, and anything else marked like this still needs a decision from us.
- Who we are
- What we collect
- How we use it
- Who we share it with
- Transfers outside the UK
- How long we keep it
- Your rights
- Cookies
- Security
- Children
- Changes to this policy
- Contacting us
1. Who we are
ValueBase is run by DATAREPORTIVE LTD., a private limited company registered in England and Wales with company number 10196769, whose registered office is [PLACEHOLDER] registered office address, which UK law requires this page to show. We are the controller of the personal data described in this policy, which means that we decide how and why it is used. We are registered with the Information Commissioner's Office under registration number [PLACEHOLDER] ICO registration number, once issued.
We are a small team and have not appointed a data protection officer, because the law does not require one for a business like ours. Every privacy question goes directly to the people who run ValueBase, and the quickest way to reach us is the contact form, choosing "Privacy or your personal data".
2. What we collect
We collect only what we need to provide ValueBase, and most of it you give us directly as you use the product.
Your account
Your email address, the date you joined, when you last signed in, and a few settings. These include whether you would like an email when a research report is ready, the screener filters you last used so that we can take you back to them, and when you last looked at superinvestor filings so that we can show you what is new. We do not ask for your name, postal address, telephone number or date of birth, and because ValueBase does not use passwords, there is no password to store.
Your subscription
If you subscribe to Pro, we hold the references Stripe gives your customer record and your subscription, your plan, its status, the dates of your billing periods, and the time at which you asked at checkout for Pro to start immediately. Your card details, and any other billing details Stripe asks for, are collected by Stripe directly and never reach our servers.
Your research
The notes, tags and research stages you record against companies, including the history of changes to your stages and the share price at the time of each change. We also hold the companies you follow, your saved screens and column layouts, your saved valuations of companies with any comments on them, and your requests for research reports, including any request for a larger allowance.
Your portfolios
The portfolios you create and the brokerage accounts within them, including the names you give them, the broker's name if you add it, and whether an account is taxable, an ISA or a pension. We hold every transaction you enter or import, including trades, dividends, deposits, withdrawals, fees, taxes and currency conversions, together with any note you add to a transaction and a history of the changes made to it. We also hold any securities you add by hand, the ISIN codes found in files you import, and a record of each import, which includes the file name, a fingerprint of the file and a summary of what it contained.
This is financial information, and we treat it with particular care. We never ask for the login details of your bank or broker, and we do not connect to them. When you import a file, we read it to create your transactions and do not keep the file itself.
How you use ValueBase
Which company pages you have opened, when you opened them, how often and which sections you looked at, so that the product can show you what you have been researching. This information stays within your own account.
Messages you send us
When you use the contact form or the support option in the app, we hold your name if you give it, your email address, your message and the topic you chose. From inside the app we also record the page you were on and the type of browser you were using, so that we can reproduce any problem you report.
Technical information
Like every website, our servers receive your IP address and details of your browser with each request, and our web server records these in its logs, which we use to keep ValueBase secure and to investigate faults. To stop the contact form being abused, we also keep a scrambled, one-way version of your IP address for one hour. We do not use any of this information to identify or profile you.
Information stored in your browser
ValueBase remembers some of your choices in your own browser, such as your colour theme, how you like tables sorted and filtered, the tab you last opened, the font size you chose for reports and where you stopped listening to a report. These stay on your device and are not sent to us. The cookies section explains what we store and why.
Information we do not want
Please do not put special category information, such as details of your health, religion or political views, into your notes or messages to us. ValueBase does not need it, and we would rather not hold it.
3. How we use it, and our lawful basis
Data protection law requires us to have a lawful basis for each use we make of personal data. The table below sets out what we use your data for and the basis on which we rely.
We do not send marketing emails. If we ever wish to, we will ask for your consent first, and you will be able to withdraw it at any time. We do not make decisions about you by automated means that have legal or similarly significant effects on you, and our star ratings describe companies rather than people.
4. Who we share it with
We use a small number of service providers to run ValueBase. The first four in the table below process personal data only on our instructions, under contracts that require them to keep it secure. The last two supply content that your browser loads from them directly, and they handle what they receive under their own privacy policies.
Stripe also uses payment information for purposes of its own, such as preventing fraud and meeting its legal obligations, and for those purposes it acts under its own privacy policy. Google processes note text under its terms for paid services, which do not permit it to use that text to improve its products, although it may keep it for a limited time to detect misuse and to meet legal requirements.
Research reports are written by AI models from Anthropic using only information about companies, such as their filings and results. Nothing about you, your portfolios or your notes is sent to write them, and a report never records who asked for it. When you search for a security to add to a portfolio, the text you type is sent to a market data provider to find matching securities, and we fetch prices for the securities you hold, but neither request identifies you.
We may also share personal data with professional advisers such as lawyers and accountants, with the police, regulators or courts where the law requires it, and with a buyer of the business if ValueBase is ever sold, in which case this policy would continue to protect your data. We do not sell personal data, and we do not share it with advertisers.
5. Transfers outside the UK
Your account and everything in it are stored in the United Kingdom. Some of the providers above, including Stripe, Mailgun and Google, are based in the United States or process data there. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for providers certified under it, or on standard contractual clauses approved for use in the UK, so that your data keeps an equivalent level of protection. You can ask us for more information about these safeguards at any time.
6. How long we keep it
We keep personal data only for as long as we need it, and a job runs every night to erase whatever has passed the periods below.
When you ask us to close your account, we delete it within one month of your request, together with everything in it, including your portfolios, notes, research requests and messages to us. We keep only a brief note that we carried out your request, so that we can show we did what you asked.
7. Your rights
You have the following rights over your personal data. You can exercise most of them through the contact form, and some you can use yourself within the product.
- Access. You can ask for a copy of the personal data we hold about you. We will send it as a file in a common, machine-readable format, which also meets your right to data portability.
- Correction. You can ask us to correct information that is wrong or incomplete, and you can edit most of your data yourself at any time.
- Erasure. You can delete portfolios, transactions, notes and other items yourself, and you can ask us to close your account and delete everything in it.
- Restriction and objection. You can ask us to limit how we use your data, or object to a use that relies on our legitimate interests, and we will stop unless we have a compelling reason to continue.
- Emails. You can turn off emails about research reports in Settings, or with the link in any of those emails. Emails that are part of running your account, such as sign-in links, are always sent.
To exercise any of these rights, please write to us through the contact form, choosing "Privacy or your personal data". We will reply within one month and will not charge you. To protect your account, we may confirm the request by writing to the email address on your account before we act on it.
If you are unhappy with how we have handled your data, please tell us so that we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or by telephone on 0303 123 1113.
8. Cookies
Cookies are small files that a website stores in your browser. Every cookie ValueBase itself sets is strictly necessary for the service you ask for, such as keeping you signed in, so the law does not require us to ask for your consent to them. We do not set analytics, advertising or tracking cookies of our own.
We also keep some preferences in your browser's local storage, such as your theme and your table settings, as described in section 2. They never leave your device, and you can clear them at any time in your browser's settings.
Our pages load a typeface from Google Fonts and some software from jsDelivr. Your browser contacts those services directly, so they receive your IP address and browser details, but they do not set cookies.
The price and financials charts on each company's home page are provided by TradingView. When they load, TradingView learns the address of the page you are on and sets its own analytics cookies, named _sp_id and _sp_ses, which are governed by TradingView's privacy policy rather than ours.
[TO DO] TradingView's cookies are not strictly necessary, so UK law requires consent before the charts load. Until the charts ask first or are replaced, this is a known gap.
9. Security
We protect your data with encrypted connections, secure cookies and sign-in links that work only once and expire after 5 minutes. Your portfolios, notes and other data are shown only to your own account. A small number of people who run ValueBase can access the systems that hold your data, and they do so only when it is needed to support you, keep the service running or meet a legal obligation. No system is completely secure, but if a breach ever puts your data at risk, we will tell the Information Commissioner's Office within 72 hours and, where the law requires it, tell you without undue delay.
10. Children
ValueBase is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has created an account, please tell us and we will delete it.
11. Changes to this policy
We will update this policy when the product or the law changes. The date at the top of the page shows when it last changed, and if a change affects how we use your data in a significant way, we will tell you by email before it takes effect.
12. Contacting us
For any question about this policy or about your data, please write to us through the contact form, choosing "Privacy or your personal data", and we will reply by email.