Privacy policy

1. The short version

We only ask for what the site needs to work. To read a full report you need an account, and an account needs a name, an email address and a password. We use those to sign you in and to remember what you have saved. We do not sell your information and we do not run advertising. You can ask us to delete your account and everything attached to it at any time.

The rest of this page sets out the detail. It is worth reading if you care about how this works.

2. Who is responsible

Leoside Equity is the data controller for the information described here, which means we decide what is collected and why. You can reach us at the address in section 17 for anything relating to this policy.

3. What we collect

Information you give us

• Account details. Your name, your email address and a password when you register. The password is stored in a hashed form, which means we cannot read it and cannot tell you what it is.
• Preferences. Which market interests you most, and your light or dark theme choice.
• Correspondence. Anything you write to us, including corrections, questions and company suggestions, along with your email address so we can reply.

Information collected automatically

• Usage data. Which pages you open, which reports you read and save, when you visited and how long you stayed. We use this to work out what is worth writing more of.
• Device and connection data. Browser type and version, operating system, screen size, language, referring page and an IP address. An IP address is treated as personal information in several jurisdictions and we treat it that way here.

What we deliberately do not collect

We do not ask for payment details, because the site is free and there is nothing to pay for. We do not ask for your date of birth, your address, your income, your portfolio, your holdings or your identity documents. If you send any of that to us unprompted, we will delete it.

4. Why we collect it

• To create and maintain your account and to sign you in.
• To show you the full text of a research note, which is the whole reason the account exists.
• To remember your saved reports, your reading history and your settings.
• To send necessary messages about your account, security or changes to our terms.
• To understand which reports are read so we can decide what to write next.
• To keep the service working, to diagnose faults, and to detect and prevent abuse, fraud, scraping and unauthorised access.
• To comply with the law and to establish, exercise or defend legal claims.

We do not use your information to build advertising profiles, and we do not use it to make automated decisions that produce legal or similarly significant effects for you.

5. Our legal grounds

Where data protection law requires us to identify a legal basis, we rely on the following.

What we do	Ground we rely on
Running your account and giving you access to the research	Performance of our agreement with you
Account, security and legal notices sent by email	Performance of our agreement with you, and our legal obligations
Security, abuse prevention and service analytics	Our legitimate interest in running a functioning and secure service
Keeping records and responding to legal process	Compliance with a legal obligation

If you are in India, we process personal data in line with the Digital Personal Data Protection Act, 2023. If you are in the European Economic Area or the United Kingdom, we process it in line with the General Data Protection Regulation. If you are in California, see section 12 for the rights available to you.

6. Cookies and local storage

We use a small number of cookies and browser storage entries. They fall into two groups.

• Strictly necessary. These keep you signed in, remember your theme, and hold your saved list. The site cannot work without them and they are not used for tracking. No consent is required for these under most privacy laws.
• Analytics. If and when we add analytics, it will be a privacy respecting provider configured without cross site tracking, and this section will say which one. We will ask for consent first where the law requires it.

We do not use advertising cookies, retargeting pixels, social media trackers or third party data brokers. You can clear cookies and local storage at any time through your browser settings, though doing so will sign you out and clear your saved list.

7. Email from us

We use your address for the messages your account needs: confirming it when you register, resetting your password when you ask, and telling you about security matters or changes to our terms.

We do not send marketing, and we will never sell, rent or trade your email address.

8. Who we share it with

We do not sell personal information and we do not share it for anyone else's marketing. We share it only in these situations.

• Service providers. Companies that host the site, deliver account and security email, or help us understand usage, acting on our instructions and bound by contract to protect the data.
• Legal requirements. Where we are required to disclose by law, a court order or a valid request from a public authority, and where we reasonably believe disclosure is necessary to protect our rights, your safety or the safety of others.
• Business transfer. If the site is ever sold, merged or reorganised, account data may transfer as part of that. We will tell account holders before it happens and any acquirer will be bound by this policy or something at least as protective.
• With your permission. Anything else, only when you have asked us to.

9. Services we rely on

Running a site of this kind means using outside providers. As of the date at the top of this page, the categories are hosting and content delivery, authentication and database hosting, transactional email for account and security messages, and web fonts. Each processes only what it needs and none of them is permitted to use your data for its own purposes. When we add or change a provider in a way that affects your data, we will update this section.

10. How long we keep it

• Account data. For as long as your account is open. If you close it, we delete or anonymise the account record within 30 days, except where we must keep something to meet a legal obligation.
• Saved reports and reading history. Deleted with the account.
• Email delivery records. Logs of account and security messages, kept only as long as needed to diagnose delivery problems.
• Server logs. Ordinarily kept no longer than 90 days, unless a log is relevant to a security investigation.
• Correspondence. Kept for as long as it is useful for the matter it relates to, and normally no more than two years.

11. How we protect it

We use encryption in transit, hashed password storage, access controls on the systems that hold personal data, and the principle of collecting as little as possible in the first place. That said, no method of transmission or storage on the internet is completely secure, and we cannot guarantee absolute security. If a breach occurs that is likely to put your rights at risk, we will notify you and the relevant authority within the time limits the law sets.

You have a part in this too. Use a password you do not use anywhere else, and do not share your account.

12. Your rights

Depending on where you live, you may have some or all of the following rights.

• Access. Ask what personal data we hold about you and get a copy.
• Correction. Ask us to fix anything inaccurate or incomplete.
• Deletion. Ask us to delete your data, subject to anything we must keep by law.
• Portability. Ask for your data in a structured, commonly used, machine readable format.
• Objection and restriction. Object to processing based on legitimate interests, or ask us to restrict processing while a dispute is resolved.
• Withdraw consent. Withdraw consent at any time, which does not affect processing that already happened.
• Complain. Lodge a complaint with your data protection authority. In India that is the Data Protection Board of India. We would rather you came to us first so we can put it right.

If you are a California resident, you also have the right to know what personal information is collected, used and disclosed, the right to delete it, the right to correct it, and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the California Consumer Privacy Act.

To exercise any of these, write to us at the address in section 17. We will verify who you are before acting, and we will respond within 30 days, or sooner where the law requires it. There is no charge unless a request is clearly excessive or repetitive.

13. International transfers

We are based in India and our providers may store or process data in other countries, including the United States and the European Union. Where personal data moves out of your region, we rely on appropriate safeguards such as standard contractual clauses or an adequacy decision, and we require our providers to protect the data to a standard consistent with this policy.

14. Children

The service is not directed at children under 13 and we do not knowingly collect their personal information. If you believe a child has given us personal data, write to us and we will delete it. Where local law sets a higher age for consent, that higher age applies.

15. Do not track

Browsers can send a Do Not Track signal, but there is still no agreed standard for how sites should respond. We do not track you across other websites in the first place, so the signal makes no practical difference here. We will update this section if that ever changes.

16. Changes to this policy

We may update this policy as the site develops or as the law changes. The date at the top always shows the current version. If a change materially affects how we handle your personal data, we will tell account holders by email or with a clear notice on the site before it takes effect.

17. Contacting us

For anything about privacy, including a request to access or delete your data, write to our email address with the word Privacy in the subject line.