Last updated: 25 June 2026 | Version 1.0te any [bracketed] items (for example your ICO registration number) before you publish it.

1. Introduction

This Privacy Policy explains how TheInvestmentAnalyst.com Ltd ("we", "us", "our") collects, uses, shares and protects your personal data when you interact with us. It also explains your privacy rights and how the law protects you.

We are an investment education and EdTech business. This policy applies to all of the ways you can engage with us, including:

Our website at theinvestmentanalyst.com (and related subdomains and pages, such as our blog, store and client portal).

The InsightOne app (our mobile and web learning platform), including the AI coaching features.

TickerOne, our market simulation and trading game, where you can practise placing trades and testing strategies in a simulated environment without risking real money.

Recommendations and insights we generate to personalise your learning, suggest content and surface relevant analysis.

Our in-person and corporate training, newsletters, events, and any other services, communications or social media pages we operate.

Together we refer to these as the "Services". Please read this policy alongside any other notices we provide on specific occasions when we collect or process personal data, so that you are fully aware of how and why we use your data.

Educational purpose only. Our Services are provided for education and illustration. They do not constitute investment, tax or legal advice or a personal recommendation, and neither TheInvestmentAnalyst.com nor InsightOne is authorised or regulated by the Financial Conduct Authority. Our content "recommendations" relate to learning materials and features, not to financial products. See our full disclaimer at theinvestmentanalyst.com/disclaimer.

2. Who we are and how to contact us

Data controller: TheInvestmentAnalyst.com Ltd

Registered address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Privacy contact / Data Protection point of contact: geoff@theinvestmentanalyst.com

Support enquiries: support@theinvestmentanalyst.com

Billing enquiries: billing@theinvestmentanalyst.com

ICO registration number: [insert your ICO registration number]

TheInvestmentAnalyst.com Ltd is the controller responsible for your personal data in connection with the Services. If you have any questions about this policy, including any requests to exercise your legal rights, please contact us using the details above.

If you access the Services through your employer or another organisation (for example under a team or corporate subscription), that organisation may also act as a controller of certain data about your use of the Services. In that case, please also refer to that organisation's own privacy notice.

3. The personal data we collect

Personal data means any information about an individual from which that person can be identified. We collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows.

• Identity & account data: Name, username, the password you set, your account ID, the avatar or profile photo you upload, and the subscription plan you hold.
• Contact data: Email address, telephone number, postal/billing address and country.
• Profile & demographic data: Optional information you provide when registering or updating your profile, such as date of birth, profession, company name and size, university, graduation year, website, and your interests and learning goals.
• Authentication data: Information from social or single sign-on providers you choose to use to log in (such as Google, Apple, Facebook, LinkedIn or X/Twitter), typically your name, email and a unique identifier.
• Subscription & transaction data: Details of the plans, trials, courses or products you buy, billing records, and information about payments to and from you. Card payments are processed by our payment provider; we do not store full card numbers.
• Learning & usage data: Your progress through pathways and playlists, courses and assets viewed, assessments and quiz answers and scores, certificates, bookmarks, notes, downloads, and the dates and times you use the Services.
• AI Coach interaction data: The questions, prompts, messages and (where you use voice features) the audio you provide to our AI coach, together with the transcripts and responses generated. See section 7.
• TickerOne game data: Your simulated trades, positions, strategies, scores, leaderboards, in-game choices and performance within the TickerOne trading game. These are practice activities using simulated funds, not real trades.
• Technical & device data: IP address, device type and identifiers, operating system and version, browser type and settings, app version, language, time zone, and crash and diagnostic logs.
• Usage & analytics data: How you navigate and interact with our website and app, including pages and screens viewed, links and buttons clicked, session recordings/heatmaps from analytics tools, and referral source.
• Cookie & tracking data: Information collected through cookies and similar technologies. See section 8.
• Marketing & communications data: Your preferences for receiving marketing from us, your communication preferences, and your responses to and engagement with our emails and campaigns.
• Support & correspondence data: The content of messages, reviews, survey responses and support tickets you send us, and our replies.
• Aggregated data. We also collect, use and share aggregated or de-identified data such as statistical or demographic data for any purpose. Aggregated data is not personal data in law as it does not directly or indirectly reveal your identity.

Special category data. We do not seek to collect any "special category" data about you (such as data about your health, race or ethnicity, political opinions, religion, sex life or sexual orientation), nor any information about criminal convictions and offences. Please do not provide such data to us through free-text fields or AI coach conversations.

If you fail to provide personal data. Where we need personal data to perform a contract with you (for example to provide a subscription) and you do not provide it, we may not be able to provide the Services. We will tell you if this is the case at the time.

4. How we collect your personal data

We use different methods to collect data from and about you, including:

• Directly from you. When you create an account, complete your profile, buy a subscription or product, use the AI coach or TickerOne, take part in a course or assessment, enter a competition, complete a survey, leave a review, request support, or correspond with us.
• Automatically. As you interact with our website and app, we automatically collect technical, usage and cookie data about your equipment and browsing actions and patterns, using cookies, server logs, software development kits (SDKs) and similar technologies.
• From third parties and public sources. We may receive data from authentication providers when you use social/single sign-on, from our payment and analytics providers, from app stores (Apple App Store and Google Play), from our hosting and learning-platform provider, and from advertising and social media platforms.

5. How we use your personal data and our lawful bases

We will only use your personal data when the law allows us to. Most commonly, we rely on the following legal bases under the UK GDPR and EU GDPR:

• Contract – where processing is necessary to perform a contract with you or to take steps at your request before entering into a contract.
• Legitimate interests – where processing is necessary for our (or a third party's) legitimate interests and your interests and rights do not override those interests.
• Consent – where you have given consent, for example for certain marketing and non-essential cookies. You can withdraw consent at any time.
• Legal obligation – where processing is necessary to comply with a legal or regulatory obligation.

The main purposes for which we use your data, and the lawful bases we rely on, are:

Create and manage your account and authenticate logins (identity, account, contact, authentication data) – Contract; Legitimate interests (account security).

Provide the Services, including courses, learning pathways, the AI coach and the TickerOne game (account, learning & usage, AI coach, TickerOne, technical data) – Contract.

Process subscriptions, trials, purchases, refunds and billing (subscription & transaction, identity, contact data) – Contract; Legal obligation (tax/accounting).

Personalise your experience and generate recommendations and insights (learning & usage, profile, AI coach, TickerOne data) – Legitimate interests (to make the Services relevant and useful); Consent where required.

Operate, maintain, secure and improve the Services and develop new features (technical, usage & analytics, learning & usage data) – Legitimate interests (to run and improve our business); Consent for non-essential analytics cookies.

Provide customer support and respond to your enquiries (support & correspondence, account data) – Contract; Legitimate interests.

Send service and administrative messages, e.g. trial reminders and security and policy updates (contact, account, subscription data) – Contract; Legal obligation; Legitimate interests.

Send marketing and recommend content and offers (contact, marketing, usage, profile data) – Consent; Legitimate interests (direct marketing to existing customers).

Measure marketing and advertising performance (usage & analytics, cookie, marketing data) – Consent (cookies); Legitimate interests.

Comply with legal obligations and protect against fraud and misuse (most categories as relevant) – Legal obligation; Legitimate interests.

Manage team/corporate subscriptions and report usage to your organisation (account, learning & usage data) – Contract; Legitimate interests.

Establish, exercise or defend legal claims, and handle corporate transactions (most categories as relevant) – Legitimate interests; Legal obligation.

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider we need to use it for another compatible reason. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis.

6. Recommendations, personalised insights and automated processing

A core part of the Services is helping you learn more effectively by tailoring what you see. To do this we analyse your activity and profile to provide recommendations and insights, such as:

Suggesting the next lesson, pathway, playlist or asset based on what you have studied, your progress, your stated goals and how learners with similar patterns progress.

Highlighting topics to revisit based on your assessment and quiz performance.

Tailoring AI coach responses to your level, knowledge gaps and learning history.

Personalising your TickerOne experience, feedback, scenarios and performance insights based on your in-game activity.

Recommending content, features, events and offers we think will be relevant to you.

Profiling. Some of this personalisation involves "profiling" – the automated analysis of your data to predict preferences or suitability of content. We carry this out on the basis of our legitimate interests in making the Services useful and engaging, and (where required) with your consent.

No decisions with legal or similarly significant effects. We do not use solely automated decision-making that produces legal effects concerning you or similarly significantly affects you. Our recommendations and insights are educational suggestions only; they do not determine your access to credit, employment, financial products or other significant outcomes, and you remain free to ignore them. If this ever changes, we will update this policy and provide the safeguards required by law, including the right to obtain human intervention, to express your point of view and to contest the decision.

Your control. You can influence your recommendations by updating your profile and learning goals, and you can object to profiling for direct marketing at any time by contacting us or using the unsubscribe link in our emails.

7. Artificial intelligence (AI) features

The Services include AI-powered features, including the InsightOne AI coach (for example our coach known as "Ava"), which provides conversational answers and, where you choose to use voice, can respond using a synthesised voice and produce written transcripts of your conversations.

What we process. When you use the AI coach we process the text or audio you submit, the transcripts generated, and related usage data, in order to generate responses and to maintain a record you can refer back to.

Third-party AI providers. We use specialist third-party providers to power these features (for example conversational-AI and voice providers such as ElevenLabs). Your prompts and related content may be processed by these providers on our behalf as processors, under contracts that restrict their use of your data.

Please be careful what you share. Do not enter sensitive personal data, confidential information or anything you would not want recorded into AI coach conversations or other free-text fields.

Accuracy. AI-generated and AI-assisted outputs can be inaccurate or incomplete and are provided for education only. You should independently verify anything you rely on.

8. Cookies and similar technologies

We and our partners use cookies, SDKs, pixels, tags and similar technologies to make the Services work, to remember your settings, to understand how the Services are used, and to support our marketing. These include:

Strictly necessary cookies that are essential for the website and app to function, including for logging in and security.

Functional cookies that remember your preferences and choices.

Analytics and performance technologies that help us measure and improve the Services. We use tools such as Google Analytics / Google Tag Manager and Microsoft Clarity (which can capture page interactions, heatmaps and session recordings).

Advertising and social media technologies, such as the LinkedIn Insight Tag and similar pixels, that help us measure and deliver relevant advertising.

Where required by law, we set non-essential cookies only with your consent, which you can manage or withdraw at any time through our cookie banner or settings, or through your browser. For full details, please see our Cookie Policy [insert link], which lists the specific cookies we use and their durations.

9. Marketing communications

We may send you marketing about our Services, content, events and offers where you have opted in, or where you are an existing customer and we are permitted to do so, in each case in line with applicable law. You can opt out of marketing at any time by using the "unsubscribe" link in our emails or by contacting us. Opting out of marketing will not stop service or administrative messages that we need to send you about your account or purchases.

10. Who we share your personal data with

We do not sell your personal data. We share it only as described below, and we require all third parties to respect the security of your data and to treat it in accordance with the law. We share data with:

Service providers and processors who help us run the Services, including: our learning-platform and hosting provider (the platform on which InsightOne and our website run); payment and billing providers; AI and voice providers (see section 7); analytics providers (such as Google and Microsoft); email, communications and customer-support tools; cloud storage and infrastructure providers; and security and fraud-prevention services.

Authentication and app-store providers, such as Google, Apple, Facebook, LinkedIn and X/Twitter where you use them to sign in, and Apple and Google in connection with app distribution and in-app purchases.

Advertising and social media platforms, in connection with our marketing, where you have consented to relevant cookies.

Your organisation, where you access the Services under a team or corporate subscription – for example, your administrator may see licence and usage information.

Professional advisers, such as lawyers, auditors, accountants and insurers, where necessary.

Authorities and regulators, where we are required to disclose data by law, regulation or legal process, or to protect our rights, users or the public.

Buyers or successors in the event of a sale, merger, reorganisation or other business transaction, in which case data may be transferred subject to this policy.

A current list of our key sub-processors is available on request. The specific providers we use may change over time; we will keep our processors under contract and limit their use of your data to the services they provide to us.

11. International data transfers

We are based in the United Kingdom and our users are worldwide. Some of our service providers are located outside the UK and the European Economic Area (EEA), including in the United States. Whenever we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection by relying on an appropriate safeguard, such as:

Transfers to countries that have been deemed to provide an adequate level of protection (an "adequacy" decision).

Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Agreement or the UK Addendum, where required, plus any additional safeguards needed.

You can ask us for more information about the safeguards we use for international transfers by contacting us at geoff@theinvestmentanalyst.com.

12. How long we keep your personal data

We keep your personal data only for as long as necessary to fulfil the purposes we collected it for, including to satisfy any legal, accounting, tax or reporting requirements. In general:

Account and learning data are kept while your account is active and for a reasonable period afterwards, so you can reactivate and to handle queries.

Transaction and billing records are kept for the period required by tax and accounting law (typically at least six years in the UK).

AI coach transcripts and TickerOne activity are kept while your account is active and for a limited period afterwards, unless you ask us to delete them earlier.

Marketing data are kept until you opt out, after which we keep a suppression record so we can honour your choice.

When we no longer need your personal data, we will delete or anonymise it. Where deletion is not immediately possible (for example, where data is held in backups), we will securely store and isolate it until deletion is possible.

13. How we protect your personal data

We have put in place appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage. These include access controls, encryption in transit, and limiting access to those who need it. We also require our service providers to maintain appropriate safeguards. You can read more in our Trust & Security statement at theinvestmentanalyst.com/trust-and-security.

No method of transmission or storage is completely secure. You are responsible for keeping your login credentials confidential. Where we are legally required to do so, we will notify you and the relevant regulator of a personal data breach.

14. Your privacy rights (UK and EEA)

If you are in the UK or the EEA, under data protection law you have the following rights, which you can exercise free of charge in most cases:

Access – to request a copy of the personal data we hold about you.

Rectification – to ask us to correct incomplete or inaccurate data.

Erasure – to ask us to delete your data where there is no good reason for us to continue processing it.

Restriction – to ask us to suspend processing in certain circumstances.

Portability – to receive certain data in a structured, commonly used, machine-readable format, or to have it transferred to another controller.

Objection – to object to processing based on legitimate interests, and to object to direct marketing at any time.

Withdraw consent – where we rely on consent, to withdraw it at any time (this does not affect processing carried out before withdrawal).

Rights relating to automated decision-making – as described in section 6.

To exercise any of these rights, contact us at geoff@theinvestmentanalyst.com. We may need to verify your identity. We will respond within the time limits set by law (usually one month). You also have the right to complain to a supervisory authority. In the UK this is the Information Commissioner's Office (ICO), www.ico.org.uk, helpline 0303 123 1113. In the EEA, you can complain to your local data protection authority. We would, however, appreciate the chance to address your concerns first.

15. Your privacy rights (United States)

This section applies if you are a resident of California or another US state with a comprehensive privacy law (such as Virginia, Colorado, Connecticut, Utah and others). It supplements the rest of this policy.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising in exchange for money. To the extent that the use of advertising or analytics cookies is treated as "sharing" or a "sale" under certain state laws, you can opt out by managing your cookie preferences (see section 8) or by contacting us.

Over the past 12 months we have collected the categories of personal information described in section 3, which map to the following statutory categories: identifiers; customer records; commercial information; internet/network activity; geolocation (approximate, from IP); audio/electronic information (AI coach voice and transcripts); professional or employment information; education information; and inferences drawn to create a profile reflecting preferences. We collect this from the sources in section 4 and use and disclose it for the purposes in section 5.

Subject to the limits and exceptions in applicable law, you have the right to:

Know and access the specific pieces and categories of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.

Delete personal information we have collected from you.

Correct inaccurate personal information.

Opt out of any "sale" or "sharing" of personal information and of certain targeted advertising.

Limit the use of sensitive personal information (we do not use sensitive personal information for purposes that require an opt-out).

Not be discriminated against for exercising your rights.

To exercise these rights, contact us at geoff@theinvestmentanalyst.com. You may use an authorised agent to submit a request; we will ask for proof of authorisation and may need to verify your identity. If we deny a request, you may appeal by replying to our decision. We do not knowingly sell or share the personal information of consumers under 16 years of age.

16. Children's privacy

The Services are intended for users aged 16 and over and are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you are under 16, please do not use the Services or provide us with any personal data.

If you are a parent or guardian and believe your child under 16 has provided us with personal data, please contact us at geoff@theinvestmentanalyst.com and we will take steps to delete it. Where required by local law (including for certain US residents under 13 and EEA users in countries that set a higher age of digital consent), we will apply the higher age threshold and obtain parental consent where necessary.

17. Third-party links and services

The Services may include links to third-party websites, plug-ins, apps and content (for example app stores, social media, payment pages and our store). Clicking those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy practices. We encourage you to read the privacy policy of every site or service you visit.

18. Changes to this Privacy Policy

We may update this policy from time to time to reflect changes to our practices or for legal, regulatory or operational reasons. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you by email or through the Services. Please check back periodically. Your continued use of the Services after an update means you accept the revised policy.

19. How to contact us

If you have any questions, concerns or requests about this policy or your personal data, please contact us:

TheInvestmentAnalyst.com Ltd

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

Email: geoff@theinvestmentanalyst.com

Support: support@theinvestmentanalyst.com

Billing: billing@theinvestmentanalyst.com

You can also lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk, or with your local data protection or privacy authority.

© 2026 TheInvestmentAnalyst.com Ltd. This document is provided for information and should be reviewed by a qualified legal adviser before publication.