Privacy policy

Last reviewed: November 2026.

Who is responsible

The controller of your personal data is [legal name not set: Site Settings → Company details], [address not set: Site Settings → Company details] (company no. [registration number not set: Site Settings → Company details]). Contact for anything about your data: [email protected].

What we collect, and why

When you click an "Open account" link

Our /go/ redirect records: the link and broker, the page you clicked from, the referring page, your device type and browser (user agent), your country (derived from network data, not stored as an IP address), any UTM campaign tags in the URL, and a one-way hash of your IP address salted with a value that changes every day. We never store your raw IP address, and the daily salt means the hash cannot be linked across days. Why: to count clicks, filter out bots and fraud, see which pages are useful, and reconcile commission with brokers. Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in running and funding the site. The data is minimised so that it does not identify you.

When you subscribe to the newsletter

Your email address, the date you subscribed and confirmed, and basic delivery statistics. Why: to send the newsletter you asked for. We use double opt-in, and every email has an unsubscribe link. Legal basis: your consent (Article 6(1)(a)), which you can withdraw at any time by unsubscribing.

When you email us

Your email address, name and whatever you write. Why: to reply and to keep a record of corrections and requests. Legal basis: our legitimate interest in answering you, or the steps needed for a contract if you contact us about a partnership.

Server logs

Our web server keeps standard technical logs (IP address, time, page requested, browser) for security and to fix faults. Legal basis: legitimate interests in keeping the site secure. Logs are deleted after 14 days.

Editors

If you have an editor account, we store your name, email, role and a session cookie while you are logged in.

What we do not do

We do not sell personal data. We do not send brokers your name, email or any other personal data: they receive only the click and a page reference. We do not use advertising or cross-site tracking cookies. We do not make automated decisions about you.

Who processes data for us

• Hetzner Online GmbH (Germany): hosts our servers and database in the EU.
• [newsletter provider not set: Site Settings → Company details]: sends the newsletter.
• Resend (USA): sends password-reset emails to editors only, if enabled.

Where a processor is outside the EEA (for example in the USA), the transfer is protected by the EU–US Data Privacy Framework where the provider is certified, or by the European Commission's Standard Contractual Clauses.

How long we keep it

• Click records: 24 months, then deleted or fully anonymised (needed to reconcile commission with brokers).
• Newsletter: until you unsubscribe, then deleted within 30 days (we keep a suppression record of your email so you are not re-added).
• Emails: up to 3 years after the last message, longer only if needed for a legal claim.
• Server logs: 14 days.

Your rights

Under the GDPR you have the right to access your data, have it corrected or erased, restrict or object to processing (including processing based on legitimate interests), data portability, and to withdraw consent at any time. Email [email protected]; we reply within one month. Because click records are pseudonymised and contain no raw IP address, we may need more information from you to find them.

Complaints

You can complain to the supervisory authority: the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy), or the authority in the EU country where you live or work. We would appreciate the chance to resolve your concern first.

Cookies

See the Cookie policy.

Changes

We will update this page if anything changes. The date at the top shows the last review.