Privacy Policy

1. Who we are

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, David Bryan is the controller of the personal data described in this policy. We are not required to appoint a Data Protection Officer and have not done so; questions about this policy go to the address above.

2. The personal data we collect

• Contact form - your name, email address and the message you send us.
• Newsletter and waitlists - the email address you enter, and which sign-up form you used (for example the subscribe page or the accounts waitlist).
• Emails to info@outsmartmoney.ai - your email address, name if given, and the content of your message.
• Server and request logs - our host, Netlify, records technical details of each request, such as your IP address, browser user agent, the page requested and the time.
• Google Analytics - on every public page except the contact form, the sign-up pages and the thank-you page, Google receives a measurement request for each page you open: the page address (without anything after a ? apart from campaign tags), the site you came from without its query, your browser type, screen size and language, the time and a random number for that page view, along with your IP address. If you press Accept on the cookie bar, the _ga and _ga_2X4453Q6DD cookies add a random identifier, so visits from the same browser can be linked. We see only reports and never try to identify the people behind them.
• Cookies and browser storage - 4 cookies and 15 storage keys, kept in your browser:
  • Google Analytics, only if you accept: _ga, _ga_2X4453Q6DD.
  • Across the site: om_analytics_declined, om_no_count, om-analytics-consent, om-analytics-bar-hidden, om-theme, om-lens.
  • Crypto Bargains: bargain-crypto-view, outsmartmoney-bargains-watchlist-v1, om-crypto-bargains-research-ack, om-crypto-bargains-plan-v2, bargain-crypto-plan-v1, bargain-crypto-coinstats-key, bargain-crypto-coinstats-token, bargain-crypto-coinstats-portfolio.
  • Momentum Scanner: pulseboard-journal-v1, pulseboard-no-trade-days-v1, pulseboard-prefs-v1.
  Apart from the Google Analytics cookies, none of them is used to identify you, and the storage keys never reach our servers. The cookie policy says what each one holds and when it is written.
• Details you enter in the tools - a CoinStats API key and portfolio share token, and for alerts a Discord webhook address or a Telegram bot token and chat ID. These are kept in your browser in plain text. The CoinStats and Telegram details pass through our server only when you sync a portfolio or an alert is sent, and are not stored or logged by our code. A synced portfolio's holdings and totals are cached in your browser, not by us.

3. Why we use it and our lawful basis

4. Who receives your data

• Netlify, Inc. (United States) - hosts the site, receives and stores form submissions, and keeps server logs, acting as our processor.
• Namecheap, Inc. (United States) - hosts the info@outsmartmoney.ai mailbox on its shared-hosting email service, so it receives and stores messages sent to that address.
• Google (Google Analytics) - receives the measurement requests described in section 2, and the cookie identifier if you accept cookies. Every data-sharing setting in our Google Analytics account is off, so Google does not get the data for its own products, benchmarking, technical support or business recommendations. Google signals and ad personalisation are off as well. How Google uses information from sites that use its services.
• News publishers' image servers - on the homepage some headline thumbnails load directly from the publisher (currently images.mktw.net, ichef.bbci.co.uk and cdn.sanity.io), which receive your IP address and browser details. We set a no-referrer policy on these images.
• CoinGecko (image servers) - on the Crypto Bargains and coin pages, your browser loads coin logos from coin-images.coingecko.com, and search thumbnails from assets.coingecko.com, so CoinGecko receives your IP address and browser details.
• Binance and Coinbase - on the Momentum Scanner, your browser opens live price connections to Binance (data-stream.binance.vision, falling back to stream.binance.com) and Coinbase (advanced-trade-ws.coinbase.com), and fetches price candles and order-book depth from data-api.binance.vision. Both receive your IP address and browser details. Nothing else about you is sent.
• CoinStats - only if you sync a portfolio. Our server forwards your API key and share token to CoinStats to fetch your holdings, and returns the answer to your browser without keeping it.
• Telegram - only if you set up Telegram alerts. Our server forwards your bot token, chat ID and the alert text to Telegram's API to send the message.
• Discord - only if you set up Discord alerts. Your browser posts the alert text straight to the webhook address you entered, so Discord receives it with your IP address and browser details, and our server is not involved.

Browser notifications from My Plan are shown by your browser's own notification feature and nothing about them leaves your device. To build the tools' data, our server also fetches market figures from CoinGecko, alternative.me, OKX, Kraken, Binance, Coinbase, mempool.space, GitHub, Nasdaq, Yahoo Finance, Google News and the SEC. Those requests come from our server and carry no information about you.

Anthropic and OpenAI, whose AI models write the market summaries, receive market prices, economic figures and public news headlines only. No personal data is sent to them. We do not sell, rent or trade personal data, and if we start sending the newsletter through a dedicated email service we will name it here before any address is shared with it.

5. International transfers

Netlify, Google and Namecheap are all US companies, so personal data they handle for us can end up outside the UK. Here is what each one relies on.

• Netlify, Inc. relies on its certification under the EU-U.S. Data Privacy Framework and the UK Extension to it. Should that route close, it falls back on the EU Standard Contractual Clauses plus the UK International Data Transfer Addendum. Both are in clauses 14.2 and 14.3 of Netlify's data processing agreement, June 2026 version.
• Google LLC relies on its certification under the UK Extension to the EU-U.S. Data Privacy Framework, and on standard contractual clauses. That covers Google Analytics data whether or not you accept cookies, and Google lists the frameworks on its data transfer frameworks page.
• Namecheap, Inc. stores messages sent to info@outsmartmoney.ai. Those transfers are protected by the safeguards UK GDPR requires for transfers outside the UK.
• CoinStats, Telegram, Discord, CoinGecko, Binance and Coinbase are also based outside the UK, and only receive anything if you use the tool features described above.

6. How long we keep it

• Contact form submissions and enquiry emails are deleted within 24 months of our last exchange with you, or sooner if you ask.
• Newsletter and waitlist email addresses are kept until you unsubscribe or ask us to delete them.
• Server and request logs are kept by Netlify under its own retention schedule.
• Google Analytics keeps event data for 2 months, its shortest setting, and user data for 14 months. Because "Reset on new user activity" is on, those 14 months start again whenever the same browser comes back. Totals in reports, which name nobody, stay. If you accept, the _ga cookies can last 2 years, and each visit resets that clock too.
• Six months after you answer the cookie question we ask it again. A refusal cookie lasts as long; the om_no_count opt-out cookie lasts a year.
• Other browser storage keys stay in your browser until you remove them with the tool's own control (Disconnect for CoinStats, "Clear and rebuild" for a plan) or clear your site data. We hold no copy.
• CoinStats and Telegram details sent through our server are not kept once the request has been answered.

7. Your rights

Under UK GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to our use of it, to receive it in a portable format, and to withdraw consent at any time where we rely on consent.

• Cookie settings, in the footer of every page, is where you withdraw consent to the Google Analytics cookies: press Decline.
• You can object to the counting that happens without cookies by turning on Don't count my visits on the cookie policy, which takes effect from the next page you open, and a browser that sends Global Privacy Control is treated the same way.
• If you'd like Google to delete the visits it already holds, send us your _ga cookie value before you decline. The cookie policy shows where to find it.

Email info@outsmartmoney.ai to use any of these rights. We will respond within one month, and we may ask you to confirm you own the email address concerned.

8. Complaints

If you are unhappy with how we have handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on its helpline, 0303 123 1113.

9. Other points

• We make no decisions about individuals by automated means, including profiling.
• The site is not aimed at anyone under 18, and we do not knowingly collect data from children.
• We never sell personal data.
• We may update this policy when the site changes. The date at the top shows the latest version, and significant changes will be noted on this page.