Privacy policy

Last updated: 5 October 2026

This Privacy Policy explains how TheInvestmentAnalyst.com Ltd ("we", "us", "our") collects, uses, shares, and protects your personal data when you use our website (www.theinvestmentanalyst.com and its sub-domains), the InsightOne application, our mobile apps, and our in-person and online training (together, the "Services").

We are the data controller for the personal data described in this Policy. We are committed to processing your data lawfully, fairly, and transparently in accordance with the UK GDPR and the Data Protection Act 2018 (and the EU GDPR where it applies to EU-based users).

1. Who we are and how to contact us
Controller: TheInvestmentAnalyst.com Ltd, a company registered in England and Wales under company number 14845454. Registered address: 71-75 Shelton St, London WC2H 9JQ Privacy contact: support@theinvestmentanalyst.com

2. The personal data we collect
Depending on how you use the Services, we may collect:

Account and profile data: name, username, email, password (stored hashed), job title or profession, and learning-profile details you choose to provide (goals, experience, focus areas).
Learning data: your progress, course activity, assessment results, and use of features within the InsightOne app and our learning platform.
Payment data: billing details and card information are collected and processed by our payment provider (or by Apple or Google if you subscribe inside one of our apps); we do not store full card numbers ourselves.
Communications: messages you send us (support, email, enquiries) and your marketing preferences.
Technical and usage data (collected automatically): IP address, device, browser type and version, operating system, referring and exit pages, on-site activity, and cookie data (see §5).
Mobile app data: if you use one of our mobile apps and switch on notifications, a device token so we can send them. Face ID or fingerprint sign-in is handled by your device; we never receive your biometric data.
Advertising and referral data: if you accept marketing cookies, which advert, campaign or link brought you to us (for example campaign tags and Google or LinkedIn click identifiers). If you join through a member's referral link, the referral code.
Demographic data you provide (for example country, interests).
We collect this data when you create an account or start a trial, use the Services, make a purchase, attend training, contact us, or browse the website. We also receive data from third parties: if you submit one of our lead forms on LinkedIn, LinkedIn passes us the details you enter in that form.

3. How we use your data and our lawful bases
What we do, and our lawful basis under UK GDPR Art. 6:

Provide your account, courses, the InsightOne app, and training: Contract, to deliver the Services you signed up for
Maintain, secure, and improve the Services; prevent fraud and abuse: Legitimate interests, in running a safe, reliable, improving product
Send service and transactional messages (for example account, billing): Contract / legitimate interests
Send marketing emails and show you relevant advertising using cookies: Consent (you can withdraw at any time, see §10)
Respond to enquiries you send us, including through LinkedIn lead forms: Legitimate interests, in answering your request
Measure whether our advertising works (see "Measuring our advertising" below): Legitimate interests
Run our referral programme: Contract
Non-essential cookies and analytics: Consent (via the cookie banner, see §5)
Keep financial and tax records and meet legal obligations: Legal obligation

Measuring our advertising. When you start a free trial or become a paying subscriber, we may share a scrambled (hashed) version of your email address with Google and LinkedIn. Hashing turns your email address into a code that cannot be reversed, so neither company can read it. They use it only to match the code against people who clicked or saw one of our ads, and to tell us how many trials and subscriptions our advertising produced. We do this under our legitimate interest in measuring whether our advertising works. You can object at any time by emailing support@theinvestmentanalyst.com, and we will stop including your details.

We will tell you if we need to use your data for a new purpose not covered here.

4. Automated tools and AI
Some features (for example AI-powered coaching and recommendations in InsightOne) use automated processing to personalise your learning experience. These tools support your learning; they do not make decisions that produce legal or similarly significant effects about you. Where we use third-party AI services, we send only the information needed and do not share your data for those providers to train their own models. Some content may be AI-generated or AI-assisted and is provided for educational purposes only.

5. Cookies and similar technologies
We use cookies and similar technologies, grouped as:

Strictly necessary: required for the site to function (for example login and session). Always on.
Functional: remember your preferences and choices, including accessibility settings (accessiBe).
Analytics: measure and improve performance (Google Analytics; Microsoft Clarity and Hotjar for heatmaps and session replay; Mixpanel for how the learning platform is used).
Marketing: deliver and measure relevant advertising (Google Ads, the LinkedIn Insight Tag and the Meta Pixel; for signed-in members, Moosend records which pages are visited so our emails are relevant). With your consent, we also keep a record on your device of which advert or campaign brought you to us, so we can credit it if you sign up.
You control non-essential cookies through our cookie banner and your browser settings. If you decline marketing cookies, Google's tags may still send basic signals that do not use cookies or identify you, so Google can estimate ad performance in aggregate. Separately, when a visit arrives from one of our adverts we count it (the campaign and the page only, with no cookie and no identifier) so we know our adverts are reaching the site.

For how these providers process data, see the Google Privacy Policy, the LinkedIn Privacy Policy, and the Microsoft Privacy Statement.

6. Who we share your data with
We do not sell your personal data. We share it only with:

Service providers (processors) who help us run the Services under contract and only on our instructions:
LearnWorlds (our learning-platform host, which also sends account emails such as password resets and receipts, and currently runs our mobile app);
Railway (cloud hosting and database);
Stripe (payments);
Moosend (email, and page visits of signed-in members for email relevance);
Anthropic, OpenAI and Qdrant (AI features and search);
ElevenLabs (voice features);
Google (Analytics, Ads, and Firebase Cloud Messaging for app notifications);
LinkedIn (advertising and lead forms);
Microsoft (Clarity);
Meta (advertising measurement on Facebook and Instagram);
Hotjar and Mixpanel (analytics);
accessiBe (accessibility tools);
Sentry (error monitoring);
Apple and Google (app stores, app notifications, and payments if you subscribe inside one of our apps).
Professional advisers, regulators, or authorities where required by law.
A buyer or successor if we sell or restructure the business (you will be informed, see §12).

7. International data transfers
Some of our providers are located outside the UK/EEA (including the United States). Where your data is transferred internationally, we ensure an appropriate safeguard is in place, such as a UK International Data Transfer Agreement or Addendum, the EU Standard Contractual Clauses, or a finding of adequacy (for example the UK Extension to the EU-US Data Privacy Framework), so your data receives equivalent protection.

8. How long we keep your data
We keep personal data only as long as necessary:

Account and learning data: for as long as your account is active, then deleted or anonymised within 30 days of account closure, unless we must keep it longer.
Advertising data (which advert or campaign brought you to us, including click identifiers): 13 months, after which we keep only the channel and campaign.
Financial and tax records: 6 years, to meet legal obligations.
Marketing data: until you withdraw consent or object.
Analytics and cookie data: per each provider's retention period.
Our full retention schedule is available on request.

9. How we protect your data
We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, audit logging, and secure, vetted infrastructure providers. See our Security Statement for more detail. No method of transmission or storage is 100% secure, but we work to protect your data and to notify you and the regulator of any breach where required.

10. Your rights
Under UK GDPR you have the right to:

Be informed about how we use your data (this Policy);
Access a copy of your data, free of charge, normally within one month;
Rectify inaccurate or incomplete data;
Erase your data ("right to be forgotten") in certain circumstances;
Restrict or object to our processing, including an absolute right to object to direct marketing, and the right to object to the advertising measurement described in §3;
Data portability: receive your data in a portable format;
Withdraw consent at any time where we rely on consent;
Not be subject to solely automated decisions with legal or similarly significant effects.
To exercise any right, contact us at support@theinvestmentanalyst.com. You can also delete your account yourself at any time using "Delete account" at the foot of your dashboard. We support data access and deletion requests through a documented process. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or 0303 123 1113, though we'd ask you to contact us first so we can help.

11. Marketing
We send marketing only where you have consented. Every marketing email includes an unsubscribe link, and you can change your preferences or opt out at any time via your account or by contacting us.

12. Changes of business ownership
If we sell or transfer part of our business, relevant data may transfer to the new owner under the terms of this Policy. We will inform you in advance and give you the choice to have your data withheld or deleted before any transfer.

13. Children and younger learners
Our Services are designed for adults and students, and we welcome learners under 18. If you are under 13, you need permission from a parent or guardian to use the Services, and they should contact us at support@theinvestmentanalyst.com with any questions about your data. If we learn that a child under 13 has an account without that permission, we will delete it.

14. Changes to this Policy
We may update this Policy from time to time. We will post any changes here and update the "Last updated" date; for material changes, we will take reasonable steps to notify you.

15. Contact us
Questions about this Policy or your data: support@theinvestmentanalyst.com Postal: 71-75 Shelton St, London WC2H 9JQ