Privacy Policy

1. Introduction

This privacy policy explains how Funds Benchmark ("we", "us", "our") collects, uses, stores, and protects your personal data when you use our website at fundsbenchmark.com and our Funds Benchmark iOS mobile application (together, the "Platform"). We are committed to protecting your privacy and handling your data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Data controller: LHDC, trading as Funds Benchmark, Parsons Green, London SW6 4HF
Contact email: luke@fundsbenchmark.com

2. What data we collect

We collect the following categories of personal data:

Account information. When you register for an account, we collect your name, email address, and password (stored as a salted hash; never in plain text). If you subscribe to a paid plan, we collect billing information including your payment card details, which are processed by our payment provider Stripe and are not stored on our servers.

Sign in with Apple, Google, Microsoft and LinkedIn. If you sign in using Apple (iOS app and website), Google (iOS app, Android app and website), or Microsoft or LinkedIn (website), we receive your name and email address from that identity provider, and your profile photo if you use Microsoft or LinkedIn. We never receive your password.

User-generated content. When you use the Platform, we store the funds you add to your watchlist, the comparison sets you save, and your app preferences (such as chart period and notification settings). This data is stored against your account so it can sync across your devices.

Usage data (website). When you use our website, we automatically collect information about your activity, including pages visited, funds searched and viewed, comparisons made, screener filters applied, and the dates and times of your visits. This data helps us improve the website.

Usage data (iOS and Android apps). When you are signed in, our apps send events to our servers recording how you use them. Examples are the funds, sectors, countries and holdings you view, the terms you type into fund search, funds you add to or remove from a watchlist, comparisons you start or save, and the screens and features you open. Each event is stored against your account together with the date and time and your IP address. We do not send these events when you are signed out. We do not use third-party analytics, advertising or attribution tools in the apps.

Other information the apps send. To work, the apps also send your sign-in details and the profile information you give us (name, email, job title, company and country), your notification settings, your watchlists, saved comparisons, in the iOS app any synthetic funds you build, and any feedback you write. If you use the iOS app and allow notifications, we store Apple's push notification token and the app version against your account. If you use the product scan feature, the photo you take or choose is sent to our server (see section 5). Google Play and the Apple App Store also collect their own crash and performance reports under their own policies.

Visit times and alerts. When you open your account page while signed in, we record the time of that visit and of your previous visit, so that we can show you what changed since then. We also create alerts about funds on your watchlist when you open your account page. Alerts are tied to your account and show which funds you follow. We do not record the pages you view, your device or your IP address for this feature, and we do not share these records or use them for marketing.

Following funds before you sign up. If you choose to track or follow a fund or manager before you have an account, the fund or manager is added to your watchlist only after you sign up or sign in, and you can remove it at any time.

Security log. We keep a log of account actions that matter for security and your data rights, such as consent choices, data exports and account deletion. Each entry holds your account number, the action, the date and time, and a one-way code made from your IP address rather than the address itself. We keep entries for 12 months from the event and then delete them. When you delete your account, any detail beyond the account number and the fact that the action happened is removed from your entries straight away.

Voice requests. Voice assistant features are not part of the usage events our apps record today. If we release voice assistant features, your speech would be handled by Apple or Google under their own policies and we would not receive your speech or any audio. The app would send only the fund, manager or sector name you asked about, so it can look up the answer as it would for a typed search, and we would not record what you said.

Device and technical data. On the website we collect your IP address, browser type and version, operating system, device type, and screen resolution. On the iOS app we collect only your IP address (inherent in any HTTP request) and a User-Agent string identifying the app; we do not transmit the advertising identifier (IDFA), the vendor identifier or any other device ID, apart from the push notification token described above if you allow notifications. The usage events described above are sent in addition. The Android app sends your IP address and a User-Agent string, which does not identify you or your device. If you sign in with Google or open an article link in the iOS or Android app, it opens in a browser view or browser app provided by the phone, which handles its own cookies.

Network and organisation lookup. To tell real visitors from automated traffic, to keep the site secure and to understand which types of organisation use it, we look up the network behind an IP address with specialist providers (MaxMind and IPinfo, both based in the United States). We send only the IP address, over an encrypted connection, and no name, email, page or cookie identifier. The providers return the network operator, internet provider, network type (for example business, hosting, residential or mobile), whether the address is a known VPN, proxy or hosting address, country and city. We keep the result for each IP address for up to 90 days so that we do not look it up twice. For people we can already identify as real visitors, meaning members and people who have sent us a form or email, we also keep these details on their contact record, with a “likely automated” flag where it applies, until they ask us to erase them or close their account. A likely organisation is kept as a low confidence hint and is never treated as fact. For a business network we may record the organisation against the visit, never against a named person unless that person has an account or has given us their details. We never delete a contact automatically because of this data. You can object to this, or ask us to erase the details we hold about you, by emailing support@fundsbenchmark.com.

Email choices. If you are a member, your email choices are stored as tags on your contact record: turning a type of email off adds an opt-out tag that stops it. These tags are erased when you close your account. Legal basis: your choices.

How you signed up. When you create an account we record how you signed up, meaning email, Apple, Google, Microsoft or LinkedIn, as a tag on your contact record. We also keep the IP address you signed up from on that record, whether or not you accepted analytics cookies, and use it with the network lookup above to tell real sign ups from automated ones. It is erased when you close your account. Legal basis: our legitimate interest in keeping the Platform secure.

Account activity. When you are signed in, we record key actions on your account against your contact record: the funds whose pages you open, funds you add to or remove from your watchlist, and when you complete your profile or onboarding. We record the action, the fund, the date and time and the IP address of the request, and we add tags and a score to your contact record. This happens on our servers, uses no cookie or device storage, and applies whether or not you accepted analytics cookies, because it is based on your signed in account and not on cookies. It covers the website and our apps, and does not apply to visitors who are not signed in. We use it to run your account, to understand how the Platform is used and to choose which service and product emails to send you; product and marketing emails go only to members who have opted in. Legal basis: our legitimate interest in running and improving our services and in sending relevant updates, and your consent for marketing emails. You can object at any time. To object, or to ask us to erase these records, email support@fundsbenchmark.com.

Authentication token (iOS app only). When you log in on the iOS app, we issue an authentication token that is stored securely in the iOS Keychain on your device. This token is used to keep you logged in and is never exposed to other apps on your device.

Communications. If you contact us by email or through the Platform, we retain the content of those communications along with your email address to respond to your enquiry and improve our support.

3. How we use your data

We use your personal data for the following purposes:

To provide the Platform. Showing you, on your account page, what changed since your last visit and alerts about funds you follow, adding funds you choose to follow to your watchlist, processing your registration, authenticating your login sessions, delivering fund data and AI-generated analysis, and managing your subscription and payments. Legal basis: performance of our contract with you.

To improve the Platform. Analysing usage patterns on the website and in our apps to understand which features are most valuable, identifying bugs and performance issues, understanding the types of organisation that use the Platform, and informing product development decisions. Legal basis: our legitimate interest in improving our services.

To communicate with you. Responding to support enquiries, sending service-related notifications (such as subscription confirmations or material changes to the Platform), and, where you have opted in, sending product updates or newsletters. We may use what you do in the Platform, for example the funds you research, to choose which of these emails to send you. You can turn product emails off at any time in your account email preferences or with the unsubscribe link in any email. Legal basis: performance of our contract (for service communications) and your consent (for marketing communications to registered users).

Business contacts and outreach. If you work in UK wealth management or fund research, we may contact you about Funds Benchmark at your work email address. For this we hold your name, work email address, employer and job title. We obtain these professional contact details from business contact services such as Hunter.io, which compile publicly available professional information. We contact you only in your professional capacity. You can object at any time by replying "unsubscribe" to any of our emails or by writing to luke@fundsbenchmark.com, and we will stop and keep a suppression record (your email address only) so that we do not contact you again. We keep these details only while they remain relevant to your professional role, or until you object. Legal basis: our legitimate interests in telling relevant professionals about a product relevant to their work.

To ensure security. Detecting and preventing fraud, unauthorised access, and other security threats, and telling real visitors from automated traffic. Legal basis: our legitimate interest in protecting our Platform and users.

To comply with legal obligations. Where required by law, regulation, or legal process. Legal basis: compliance with a legal obligation.

4. Cookies and tracking (website only)

We always use the essential cookies and storage listed below, because the site needs them to work. Analytics cookies are used only if you accept them. When you first visit, a banner asks you to choose: Accept all or Reject non-essential. Your choice is remembered for 6 months. You can change or withdraw it at any time with Cookie settings in the footer. Until you choose, and if you reject, we set only essential cookies, and Google Analytics receives cookieless page-view signals: the page address, the page you came from, your browser and device type and your approximate location worked out from your IP address. These signals set no cookies and store no identifier on your device. Google receives your IP address as part of any web request, and may process it outside the UK, including in the United States. If you accept, Google Analytics also sets measurement cookies (names beginning _ga).

Cookies needed to run the site. These keep you signed in, count the funds you have viewed today if you are not signed in (this counter expires at midnight), remember your choice about cookies for 6 months, and store your light or dark theme in your browser. Our payment provider Stripe sets cookies on the payment pages, and our security service (Sucuri) may set a security cookie. If you choose to track or follow a fund or manager before you have an account, we keep your choice in your browser's storage for up to 30 minutes so that we can add it to your watchlist after you sign up or sign in. It is cleared afterwards, and it is not used if you open the sign-in form on its own. These cookies and storage items keep you logged in, remember your choices, and count how many funds you have viewed today if you are not signed in (this counter expires at midnight). We also store your light or dark theme choice in your browser. If you open the sign-up or payment screens, our payment provider Stripe loads its own scripts and may set cookies to process payments and prevent fraud. Our security provider may set a cookie if it needs to check that a visit is from a real person.

Analytics cookies (Google Analytics), only after you accept. We use Google Analytics 4 to measure traffic, see which pages and features are popular, and improve the website. It sets cookies in your browser (names beginning _ga). If you are signed in, we also pass your account number, not your name or email, so that your visits can be linked to your account. Without your consent Google Analytics runs in this limited, cookieless mode, which sends page views to Google without setting a cookie. Google receives your IP address with these requests and may process it outside the UK, including in the United States.

Our own tracking cookies (Mautic), only after you accept. We use our own customer relationship system, Mautic, which runs on our own servers. It sets cookies in your browser (mtc_id, mautic_device_id and similar) that record the pages you visit. If you sign up or sign in, these visits are linked to your account so that we can understand how you use the Platform and choose relevant emails to send you.

Visit source cookie, only after you accept. A cookie called fb_entry, set by us and lasting 30 minutes, records how your visit started, meaning the traffic source and the type of page you landed on, for example search and a fund page. We use it to understand where sign-ups come from. It holds no personal data.

Fonts. Our pages load fonts from Google Fonts, which sees your IP address when it does.

We do not serve third-party advertisements on any part of the Platform.

Cookie list.

Controlling cookies. Change or withdraw your choice at any time with Cookie settings in the footer. You can also block or delete cookies in your browser settings. Google provides a browser add-on to opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Blocking the cookies needed to run the site may stop parts of it working, for example staying logged in. To ask us to erase the records we hold about you, including those in Mautic, email support@fundsbenchmark.com.

5. How we share your data

We do not sell your personal data to third parties. We share data only in the following limited circumstances:

Payment processing. Billing and payment card information is shared with Stripe, our payment processor, solely for the purpose of processing your subscription payments. Stripe's privacy policy is available at stripe.com/privacy.

Hosting and infrastructure. The Platform is hosted on third-party servers. Our hosting providers process data on our behalf under data processing agreements that require them to protect your data in accordance with applicable law.

IP lookup providers. MaxMind and IPinfo receive only the IP address needed for each lookup and process it on our behalf. They do not receive your name, email or what you view.

Website security. Our website sits behind a security service (Sucuri) that filters traffic and blocks automated abuse. It sees the requests made to our site, including visitors' IP addresses, and may set a security cookie.

AI analysis (Anthropic). When you request an AI-generated forecast or comparison summary, our server calls the Anthropic Claude API to generate the analysis. We send only fund data (performance, allocations, holdings) and generic market context. Your personal data — name, email, account ID, watchlist, or any other identifier — is never sent to Anthropic. Under Anthropic's commercial API terms, this data is not used to train its models.

Product scan. If you use the product scan feature in our apps, the photo you take is sent through our server to the Anthropic Claude API so it can identify the product and the company behind it. We do not send your name, email or account ID with the photo, and our server does not save the photo. Anthropic handles it under its own API terms.

Legal requirements. We may disclose personal data where required by law, regulation, court order, or governmental authority.

6. Data retention

We retain your personal data for as long as your account is active or as needed to provide you with the Platform. If you close your account, we delete your account and profile data, except where we are required to retain it for legal, tax, or regulatory purposes, such as payment and tax records (in which case it will be retained for up to 7 years and then deleted).

Usage events linked to your account, including those from our apps, your visit times and alerts, and our marketing records about you, including your account activity records, are kept while your account is open and are erased when you close it. Network details, the sign up IP address, sign up method and email choice tags held on your contact record are erased with it, and results held for an IP address expire after 90 days. Alerts are shown for up to 14 days and kept for 30 days after they expire or you dismiss them, then deleted. If you had unsubscribed from our emails, we keep a minimal record (your email address and the fact that you unsubscribed) so that we do not email you again. If you do not have an account, you can ask us to erase the records we hold about you by emailing support@fundsbenchmark.com, and we will do so within 30 days. Closing your account does not cancel a paid subscription, so please cancel it first under My Account. We may keep statistics that cannot identify you for longer.

7. Your rights

Under UK GDPR, you have the following rights:

• Access. You can request a copy of the personal data we hold about you.
• Rectification. You can ask us to correct inaccurate or incomplete data.
• Erasure. You can ask us to delete your personal data, subject to any legal retention obligations.
• Restriction. You can ask us to restrict the processing of your data in certain circumstances.
• Portability. You can request your data in a structured, commonly used, machine-readable format.
• Objection. You can object to processing based on our legitimate interests, including receiving business outreach from us.
• Withdraw consent. Where processing is based on your consent (e.g. marketing emails), you can withdraw consent at any time.

To exercise any of these rights, contact us at support@fundsbenchmark.com. We will respond within 30 days.

Closing your account erases the usage events and marketing records we hold about you, and you can ask us at any time to erase records we hold if you do not have an account, as described in section 6. To delete your whole account, see how to delete your account.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data, including encryption of data in transit (TLS/SSL), encrypted storage of passwords, access controls limiting data access to authorised personnel, and regular security reviews.

No system is completely secure. If you become aware of any security vulnerability or suspect unauthorised access to your account, please contact us immediately at support@fundsbenchmark.com.

9. International transfers

Your data is primarily processed within the United Kingdom and the European Economic Area. Some of the providers we use, including Google (for Analytics and Fonts), MaxMind and IPinfo, are based in the United States and may process data there. We are confirming the transfer safeguards that apply to each of them and will update this page when we have. For other transfers outside the UK or EEA, for example to infrastructure providers, we take steps to put appropriate safeguards in place.

10. Children

The Platform is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes in our practices or applicable law. We will notify you of material changes by posting a notice on the Platform or by email. The "last updated" date at the top of this page indicates when the policy was most recently revised.

12. Contact us

If you have questions about this privacy policy or our data practices, or if you wish to make a complaint, please contact us: