Privacy Policy — Investment Bastion

1. Who is responsible for your data

The data controller for your personal data is:

INBASTION LTD, trading as Investment Bastion

Registered office address: 1a Clonmel Road, Teddington, England, TW11 0SR

Email: [email protected]

We determine how and why your personal data is processed when you use the Service.

2. What data we collect

We collect and process the following categories of personal data:

2.1. Account and contact information

• Name or display name
• Email address
• Password (stored in hashed form)
• Country or region (if provided)

2.2. Subscription and billing data

• Subscription plan and status
• Billing history (amounts, currency, timestamps)
• Partial payment details via our payment provider (e.g. last 4 digits, card brand, expiry), but we do not store full card numbers
• Tax-relevant information (where required by law)

This information is processed primarily through our payment provider (for example, Stripe).

2.3. Usage data

• Log-in dates and times
• Pages and features you interact with (e.g. Strategy Builder, Radar, portfolios)
• Device and browser information (type, version, operating system)
• IP address and approximate location (city/country level)

We use this information to understand how the Service is used, improve performance, and protect against abuse.

2.4. Communication data

• Emails you send to us (support requests, feedback)
• Our replies to you
• Internal notes related to support and compliance

2.5. Cookies and similar technologies

We use cookies and similar technologies to:

• keep you logged in,
• remember your preferences,
• analyse how the Service is used,
• support basic security and fraud prevention.

For more details, please see our Cookie Policy.

We do not sell your personal data to third parties.

3. How we use your data and legal bases

Under UK and EU data protection law, we must have a legal basis for processing your data. We use your data for the following purposes:

3.1. To provide and maintain the Service

Legal basis: Performance of a contract

• Creating and managing your account
• Providing access to Investment Bastion features
• Enabling subscription, trial, and billing
• Responding to support requests

Without this data, we cannot provide the Service.

3.2. To improve and develop Investment Bastion

Legal basis: Legitimate interests

• Analysing usage patterns
• Fixing bugs and improving stability
• Prioritising new features
• Measuring performance and capacity

We use aggregated and anonymised data wherever possible.

3.3. To send service-related communications

Legal basis: Performance of a contract / legitimate interests

• Important updates about the Service
• Security or privacy notices
• Billing and subscription notifications
• Changes to Terms of Service or Privacy Policy

You cannot opt out of these communications as they are an essential part of how the Service operates.

3.4. To send optional product updates and marketing

Legal basis: Consent or legitimate interests (depending on your country)

• News about new features
• Educational content related to using Investment Bastion
• Occasional product updates and offers

You can unsubscribe at any time by using the "unsubscribe" link in our emails or by contacting us at [email protected].

3.5. To comply with legal obligations

Legal basis: Legal obligation

• Tax and accounting requirements
• Responding to lawful requests from authorities (where applicable)
• Maintaining necessary records for compliance and audit

4. How we share your data

We share your personal data only when necessary, and only with trusted third parties who process data on our behalf.

4.1. Service providers (processors)

We may use third-party providers for:

• Payment processing (e.g. Stripe)
• Cloud hosting and storage
• Email delivery and customer support
• Analytics and error monitoring

These providers may process your data only according to our instructions and solely for the purposes outlined in this Policy.

4.2. Legal and compliance

We may disclose your data if required to:

• comply with applicable laws or regulations,
• respond to a lawful request, court order, or legal process,
• protect our rights, property, or safety, or that of our users.

4.3. Business transfers

If Investment Bastion or INBASTION LTD is involved in a merger, acquisition, or asset sale, your personal data may be transferred as part of that transaction. We will take steps to ensure your rights continue to be protected.

We do not sell your personal information to data brokers or advertisers.

5. International transfers

Our service providers may be located outside the UK or the European Economic Area (EEA).

Where your data is transferred internationally, we take appropriate safeguards, such as:

• using countries recognised as providing an adequate level of protection, or
• using standard contractual clauses approved by the European Commission or UK authorities.

6. Data retention

We keep your personal data only for as long as necessary for the purposes described in this Policy or as required by law.

Indicative retention periods:

• Account data: for as long as your account is active. If you close your account, we may retain limited information for a reasonable period for legal, accounting, or security purposes.
• Billing data: retained in line with tax and accounting requirements (often 6 years or more under UK law).
• Support communications: retained as long as reasonably necessary to maintain a history of interactions and improve support quality.
• Analytics data: may be stored in aggregated or anonymised form for a longer period.

When data is no longer required, we will securely delete or anonymise it.

7. Your rights

Depending on your location and applicable law (for example, under UK GDPR / EU GDPR), you may have the following rights:

• Right of access – to obtain a copy of your personal data we hold about you.
• Right to rectification – to have inaccurate or incomplete data corrected.
• Right to erasure – to request deletion of your personal data where we no longer need it or where you withdraw consent (subject to legal exceptions).
• Right to restriction – to limit how we process your data in certain circumstances.
• Right to data portability – to receive your data in a structured, commonly used, machine-readable format and transmit it to another controller where technically feasible.
• Right to object – to object to processing based on legitimate interests or to direct marketing.
• Right to withdraw consent – where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at:

[email protected]

We may need to verify your identity before fulfilling your request.

You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

8. Cookies and tracking technologies

Investment Bastion uses cookies and similar technologies to:

• keep you logged in,
• remember your settings,
• analyse usage of the Service,
• improve performance and security.

You can manage cookie preferences through your browser settings and, where available, through our cookie banner or settings page.

A separate Cookie Policy may provide more detail on the types of cookies we use.

9. Data security

We take reasonable technical and organisational measures to protect your data, including:

• encrypted connections (HTTPS)
• secure password hashing
• limited access to personal data on a need-to-know basis
• monitoring for unusual or suspicious activity

However, no system is completely secure. You are responsible for keeping your password confidential and using a strong, unique password for your account.

10. Third-party links

The Service may contain links to third-party websites or tools.

We are not responsible for the privacy practices of those sites.

We encourage you to review their privacy policies separately.

11. Children's privacy

Investment Bastion is not intended for children under 18 years of age.

We do not knowingly collect personal data from children under 18.

If you believe a child has provided us with personal data, please contact us at [email protected], and we will take appropriate action.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we will notify you via email or through the Service.

The "Last updated" date at the top of this page indicates when the Policy was last revised.

Your continued use of Investment Bastion after changes become effective means you accept the updated Policy.

13. Contact us

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

INBASTION LTD

trading as Investment Bastion

Email: [email protected]