Privacy Policy
Before launch: replace the [square-bracket] details, register with the ICO if required (most businesses that handle personal data must pay the data protection fee), and have a UK solicitor review. Delete this box when done.
1. Who is responsible for your data
[BUSINESS NAME] (“we”), of [REGISTERED ADDRESS], runs Yieldwell and is the controller of your personal data under UK GDPR and the Data Protection Act 2018. ICO registration: [NUMBER]. Contact: [CONTACT EMAIL].
2. What we collect and why
| What | Why | Legal basis |
|---|---|---|
| Account: name (optional), email address, password (stored only as a one-way hash), time you accepted the Terms, plan, whether your email is confirmed | To create and secure your account, confirm your email, reset passwords | Contract (providing your account) |
| Portfolio holdings (ticker and quantity), saved profit ladders, streak | To sync between your devices and run alerts on your holdings | Contract |
| Price alerts (coin, price, label, your email) and dividend-alert setting | To email or push you when an alert triggers, or when a company in your portfolio cuts its dividend or goes ex-dividend | Contract |
| Weekly market email: email address and confirmation record | To send the Sunday email | Consent (you confirm by clicking the link; withdraw any time with the unsubscribe link) |
| Push notification address for each device you turn on | To send notifications to that device | Consent (you allow it in your browser) |
| Short-lived records tied to a hash of your IP address, and error logs | To stop abuse and brute-force attacks, and fix faults | Legitimate interests (keeping the service secure) |
| Standard web server logs at our host (IP address, time, page) | Security and running the site | Legitimate interests |
| Emails you send us | To reply and keep a record | Legitimate interests |
We don't collect payment details yet. If we add paid plans, card payments will be handled by a payment provider and we'll update this policy first. We don't ask for your bank or broker logins and we don't link to your investment accounts. We don't use your data for advertising and we don't sell it.
Your portfolio is only the tickers and quantities you choose to enter. We don't see your account values at brokers.
3. Who we share it with
- Hosting and email: our web host ([Fasthosts Internet Ltd, UK]) stores the data and sends our emails.
- Browser push services: if you turn notifications on, your browser's push service (Google, Mozilla, Apple or Microsoft, depending on your browser) is told that a notification is waiting. The message itself isn't sent through them.
- Google Fonts: your browser fetches fonts from Google when you open the site (see the Cookie Notice).
- Market data providers (Financial Modeling Prep, CoinGecko) get requests from our server about tickers and coins. They don't receive your personal data.
- Professional advisers, regulators or the police if the law requires or to protect our rights.
Some of these providers (for example Google) may process data outside the UK. Where they do, they rely on safeguards such as the UK's approved transfer mechanisms. [Solicitor to confirm for your actual hosting and mail set-up.]
4. How long we keep it
- Account, portfolio and settings: until you delete your account, then removed from our live systems straight away. Copies in our host's backups expire in the normal backup cycle.
- Alerts: until you delete them or the account; triggered alerts are cleared about 30 days later.
- Weekly email: until you unsubscribe.
- Waiting notifications: until delivered, and no more than the last five.
- Abuse-prevention records: a few days. Error logs: kept only as long as needed to fix faults.
- Emails to us: as long as needed to deal with your query and a reasonable time after.
5. Your rights
You can ask us to access, correct, delete, restrict or move your data, and object to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time (unsubscribe link, turn notifications off, or delete your account). Most things you can do yourself on the account page, including deleting your account. For anything else, email [CONTACT EMAIL] and we'll reply within one month.
If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113. We'd appreciate the chance to put it right first.
6. Security
Passwords are stored as one-way hashes. Login, password reset and other sensitive actions are rate-limited, reset and confirmation links are single-purpose, and the site uses HTTPS. No system is perfectly secure. If a breach puts your rights at risk we'll tell you and the ICO as the law requires.
7. Children
Yieldwell is for people aged 18 and over. We don't knowingly collect data from children. If you think a child has given us data, tell us and we'll delete it.
8. Changes
We'll post changes here and update the date above. For significant changes we'll also tell account holders by email.