Privacy Policy

1. Introduction

This Privacy Policy explains how Openbook Analytics Ltd. ("we", "us", or "our") collects, uses, and protects your personal data when you visit our website, use our services, or interact with us in any capacity. We are committed to protecting your privacy and ensuring your personal data is handled in a transparent, lawful, and secure manner, in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR) and other relevant legislation.

This Privacy Policy applies to Openbook Analytics Ltd. and all products, services, and platforms offered by us, including but not limited to our website, mobile applications, and any related tools or features.

Our services are intended for users who are at least 18 years old. By using this service, you represent and warrant that you are 18 years of age or older.

2. The Data We Collect About You

We collect and process the following types of personal data about you to provide, improve, and secure our services, as well as to comply with legal obligations:

• Contact Information: This includes, but is not limited to, your name, email address, phone number, and any other contact details you provide to us. This information is used to communicate with you, manage your account, and respond to your requests.
• Account Information: This includes, but is not limited to, your username, password, profile picture, and account settings. We also collect preferences related to your account to tailor your experience.
• Interaction Data: This includes, but is not limited to, your responses to surveys, feedback forms, customer support interactions, and any other communication with our team.
• Usage Data: This includes, but is not limited to, information about how you interact with our website or services, such as pages visited, time spent on the site, features used, and any actions taken.
• Device and Technical Information: This includes, but is not limited to, your IP address, browser type, operating system, device type, and other technical details.

We do not knowingly collect personal information from individuals under the age of 18.

2.1 How We Collect This Data

We collect your personal data when you interact with us through our website, mobile applications, or in person. This data may be collected:

• Directly from you: When you provide information voluntarily, such as through contact forms, account registration, surveys, or during customer support interactions.
• Automatically through our systems: When you visit our website or use our services, we may collect technical data through cookies, web beacons, or similar technologies.
• From third-party sources: In some cases, we may receive your data from trusted third parties, such as partners or service providers, provided we have a legal basis for doing so.
• In person: During events, meetings, or other face-to-face interactions.

2.2 Email Tracking

We may collect and use information regarding whether a user has opened an email sent by us, including the recipient's email address, the date and time of email opening, and the device or IP address associated with the action. This information is used solely to improve our communication effectiveness and analyze user engagement.

2.3 Cookies and Similar Technologies

Some cookies and similar technologies are strictly necessary: they keep you signed in, keep sign-up working and remember your cookie choices. We use them without asking. Everything else described below is used only if you allow it.

The first time you visit our website, including our advertising landing pages (addresses beginning /lp/) and sign-up, we ask for your choice with a cookie bar. One choice applies across all of them. You can allow or refuse two optional categories separately, and change your mind at any time with the "Cookie settings" link at the bottom of our pages. Our Cookie Policy lists each cookie.

• Essential (always on) – ob_consent, a first-party cookie that records the choice you made (analytics yes or no, advertising yes or no, and when you chose). It lasts 180 days, after which we ask again.
• Analytics – Google Analytics measures how visitors use our website (pages viewed, buttons clicked, whether an account was created) so we can improve it. It sets the _ga cookies. With analytics allowed, PostHog (section 4) may also store its identifier in a cookie and in your browser's local storage.
• Advertising – Google Ads measures which of our adverts led to a visit and to an account being created, and lets Google show our adverts to people who have visited. It sets Google's advertising cookies (such as _gcl_au and _gcl_aw). If you allow advertising, we also keep the Google click identifier and campaign details from the address you arrived on with your account, so that a later subscription can be credited to the advert (see "Google Ads" in section 4).

If you refuse, or make no choice, no Google tag is loaded and nothing about your visit is sent to Google Analytics or Google Ads. We signal your choice to Google using Google Consent Mode.

3. How We Process Your Personal Data

We process your personal data only for the specific purposes outlined below, and always in compliance with applicable data protection laws:

Purpose	Description	GDPR Basis
Service Provision	To provide and manage our services, including account creation, maintenance, and customer support.	Performance of a contract
Communication	To contact you about your account, updates, service-related information, and promotional content (where permitted).	Legitimate interests
Analytics	To analyze how you interact with our services to improve our offerings, user experience, and operational efficiency.	Legitimate interests
Legal Compliance	To comply with legal obligations, such as responding to court orders, law enforcement requests, or other legal requirements.	Legal obligation

We do not process any special categories of personal data (e.g., racial or ethnic origin, political opinions, religious beliefs, health data, or biometric data) unless explicitly required by law or with your explicit consent.

3.1 Third-Party Disclosures

We may share your personal data with third-party service providers who assist us in operating our services. We only share data with third parties that have agreed to protect your information in accordance with applicable data protection laws.

We do not endorse or guarantee the services, products, or practices of any third-party provider unless explicitly stated in writing. If you are directed to a third-party website via our platform, we are not responsible for the privacy practices of those third parties.

3.1.1 Third-Party Content Embedded in Our Services

Some parts of our services embed content that your browser loads directly from another company. This is different from the providers listed in section 4: we do not send your personal data to these companies, but because your browser contacts them directly, they can receive your IP address and device information and may set or read their own cookies. They act as independent data controllers for anything they collect this way, under their own privacy policies rather than ours.

• TradingView – The interactive price chart on the "Chart" tab of individual stock pages is provided by TradingView and is loaded by your browser from TradingView's servers. We do not send TradingView your name, email address or any account information; the chart is configured only with the ticker symbol of the company you are viewing. When the chart loads, TradingView may receive your IP address, browser and device details and may set its own cookies, as described in TradingView's privacy policy. If you would prefer not to load it, that tab has a provider switch: choosing "Highcharts" shows Openbook's own price history instead, and pages you open afterwards will not contact TradingView. We remember your choice, on your account if you are signed in and otherwise in your browser.

3.2 International Transfers

We may transfer your personal data to countries outside of your own. If we do so, we will ensure that appropriate safeguards are in place to protect your personal data, such as adequacy regulations or contractual clauses.

4. Security of Your Data

We take the security of your personal data seriously and implement appropriate technical and organizational measures to protect it from unauthorized access, disclosure, alteration, or destruction. These measures include encryption, secure access controls, regular system audits, and strict internal policies.

We use trusted third-party service providers, who process personal data on our behalf and on our instructions. Each receives only the data needed for the purpose described. Where a provider is located outside the UK or European Economic Area, the safeguards in section 3.2 apply. Third-party content that your browser loads directly, which we do not send your data to, is described separately in section 3.1.1.

• Google Cloud Platform, including Firebase – We use Google Cloud Platform to host our services, and the Firebase products built on it to sign you in and to store your data. This covers your account details, portfolios, watchlists, saved preferences and any content you post to our community features. Where you use our AI features, the text you submit is sent to Google's Vertex AI service to generate a response. Data is encrypted in transit and at rest.
• Stripe – We use Stripe to take payments and manage subscriptions. Card details are entered into payment fields hosted by Stripe and are sent directly from your browser to Stripe: we never receive or store your full card number. We store a Stripe customer identifier and your plan status. Stripe also acts as an independent controller of payment data for its own fraud-prevention and legal obligations.
• Loops – We use Loops to send email, including account messages such as address verification, password resets and billing notices, and — where you have consented — product updates and marketing. We share your email address, your name, and account attributes such as your plan and trial status. You can unsubscribe from marketing at any time without affecting the account messages we must send you.
• PostHog – We use PostHog for product analytics, to understand which pages and features are used and to find faults. It receives pages viewed, actions taken, device and browser information, and a pseudonymous identifier. Our PostHog instance is hosted in the European Union, so this data is not transferred outside the EEA by us.
• Google Analytics (Google) – Only if you allow analytics cookies (section 2.3). We use Google Analytics to understand how visitors use our website, our advertising landing pages and sign-up. It receives the pages you view, the buttons you click, device and browser information, an approximate location derived from your IP address and a pseudonymous identifier. Google may process this data outside the UK; the safeguards in section 3.2 apply.
• Google Ads (Google) – Only if you allow advertising cookies (section 2.3). We use Google Ads to measure whether our adverts lead to accounts and subscriptions, and to show our adverts to people who have visited our website. When an account is created after an advert, we send Google a notice that a sign-up happened, with a one-way scrambled (hashed) copy of the account's email address so Google can match it to the advert, and a scrambled account reference so it is not counted twice; we do not send your name or the email address itself. If that account later takes out a paid subscription, we send Google the click identifier from the advert, the time and the amount paid. Google acts as an independent controller for some of this data under its own terms and privacy policy (policies.google.com/privacy), and may process it outside the UK.
• Trading 212 – Only if you choose to connect a Trading 212 brokerage account. We send the API credentials you supply to Trading 212 in order to retrieve the holdings you ask us to import. Those credentials are encrypted before storage, are accessible only to our servers, and are deleted when you disconnect the account. If you never connect a brokerage account, no data is shared with Trading 212.

4.1 Data Retention

We will retain your personal data only for as long as is necessary to fulfill the purpose(s) for which it was collected, including legal, accounting, or reporting requirements. Where retention is not required, we will securely delete or anonymize your personal data.

4.2 Data Security

Our security measures include:

• Encryption: All personal data is encrypted both at rest and in transit using industry-standard protocols.
• Access Controls: We restrict access to personal data to authorized personnel only.
• Secure Hosting: Data is stored on secure servers or cloud platforms that comply with GDPR.
• Incident Response: In the event of a security breach, we will notify you and the relevant data protection authority within 72 hours.

4.3 Data Breach Notification

In the event of a data breach that affects your personal data, we will notify you without undue delay, typically within 72 hours of becoming aware of the breach. We will also report the breach to the relevant data protection authority as required by GDPR.

5. Your Legal Rights

Under GDPR, you have the following rights regarding your personal data:

Right	Description
Right to be informed	You have the right to be informed about the collection and use of your personal data.
Right to access	You can request a copy of your personal data held by the controller.
Right to rectification	You can correct inaccurate or incomplete personal data.
Right to erasure	You can request deletion of your personal data under certain conditions.
Right to restrict processing	You can limit how your data is used.
Right to data portability	You can request your data in a structured format to transfer to another controller.
Right to object	You can object to processing your data for direct marketing or other purposes.
Rights relating to automated decision-making	You can object to decisions made solely by automated means.

For the exercise of your rights, you can contact us using the details provided below. For the full text of the GDPR, visit the official ICO website: https://ico.org.uk

6. Governing Law and Dispute Resolution

This Privacy Policy and any disputes arising from its interpretation or enforcement shall be governed by and construed in accordance with the laws of Scotland. Any legal action or proceeding related to this Privacy Policy shall be exclusively brought in the Courts of Scotland.

7. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

• Email: contact@openbookanalytics.com
• Postal Address: Graham Hills Building (Level 6), 50 Richmond Street, Glasgow, United Kingdom, G1 1XP

You may also submit a data subject request by contacting us directly. We will respond to your request within 30 business days. If you believe your data is being processed unlawfully, you may contact the Information Commissioner's Office (ICO).

8. Changes to Our Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices or legal requirements. Any updates will be posted on our website or communicated to you via email. Continued use of our services after such changes constitutes your acceptance of the updated terms.