Ledger — Privacy Policy

DRAFT — NOT LEGAL ADVICE. This document was drafted by the Ledger engineering team from a technical reading of the codebase, not by a qualified lawyer. It must be reviewed by a UK-qualified solicitor before Ledger is offered to the public. Neither the author nor COTR Global Group Ltd guarantee its legal sufficiency in its current form.

Effective date: to be finalised at launch Last updated: 2026-07-28

1. Who we are

Ledger (the "Service") is operated by COTR Global Group Ltd, a company registered in the United Kingdom (the "Company", "we", "us", "our").

Contact for privacy matters: privacy@goldrush.capital

REVIEW POINT (launch-blocker): the privacy@goldrush.capital alias is not yet configured. It must be receiving mail before this Privacy Policy is published, otherwise data-subject requests will bounce and we will be in breach of UK GDPR Article 15(3) response-time obligations.

We are the data controller for personal data collected via the Service. Our sub-processors (see §4) are data processors acting on our behalf under written agreements.

2. What data we collect

We collect only what the Service actually needs to operate. Specifically:

2.1 Data you give us directly

• Email address — collected when you sign up. Used to send you a magic-link sign-in email, transactional emails about your reports, and (if we ever add them) service announcements.
• Research question — the free-text market question you submit when you order a report. Stored on the row that represents your paid run.

2.2 Data collected automatically

• Session cookies — set by our authentication provider (Supabase) to keep you signed in. No third-party tracking or analytics cookies are set by Ledger.
• Server logs — IP address, user agent, request path, and timestamps are captured by our hosting providers (Vercel, Railway) for security, abuse prevention, and debugging. Retained per those providers' own retention policies (typically 30 days).

2.3 Data generated on your behalf

When you submit a paid run, our pipeline generates and stores:

• The hypotheses derived from your question,
• The evidence collected from the public web via Tavily search (URLs, page snippets, source domains, fetch timestamps),
• Economics facts extracted from that evidence (numeric or textual values that a source stated verbatim),
• The verdict for each hypothesis (a deterministic classification — see the AI Disclosure), and
• The final report in Markdown.

All of the above are linked to your account via the run's user_id.

2.4 Payment data

Payments are processed by Stripe. Stripe collects your card details directly; Ledger never sees, stores, or logs cardholder data. We store the Stripe Checkout Session ID and payment status against your run so we can confirm you paid and reconcile refunds if issued.

2.5 What we do NOT collect

We do not collect:

• Your real name (unless you volunteer it in an email to us)
• Your address, phone number, date of birth
• Any special-category data (health, biometric, political opinions, etc.)
• Third-party contact lists
• Data about anyone other than you

You should not include personal data about identifiable third parties in your research questions. If you do, we may redact it or refuse to process the run.

3. Why we collect it (lawful basis)

Under UK GDPR Article 6, we rely on:

We do not process any special-category data (UK GDPR Article 9) and therefore do not rely on any Article 9 conditions.

4. Who we share it with (sub-processors)

We do not sell your data. Ever. We share it only with the sub-processors below, each strictly to deliver the Service:

REVIEW POINT: if additional third-party services are added (error tracking like Sentry, product analytics, uptime monitoring), this table MUST be updated before those services are enabled in production. The table is normative — a service not listed here is not authorised to process user data.

5. International transfers

Ledger operates from the United Kingdom. Most sub-processors above are US-based, which means personal data is transferred outside the UK.

For transfers to the United States, we rely on either:

• The UK-US Data Bridge (the UK extension to the EU-US Data Privacy Framework, adopted 2023), where the sub-processor is certified under it, or
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, incorporated into our contracts with sub-processors that are not Data Bridge certified.

REVIEW POINT: the specific transfer mechanism per sub-processor should be enumerated by a lawyer before launch, and a Transfer Impact Assessment (TIA) prepared for each. Not all of the sub-processors above are Data Bridge certified.

You can request a copy of the relevant transfer safeguards for any sub-processor by emailing privacy@goldrush.capital.

6. How long we keep it

• Account data (email, session) — kept until you delete your account.
• Run data (question, hypotheses, evidence, report) — kept indefinitely so you can re-read your old reports at any time. Removed on account deletion (see below).
• Payment records — retained for 6 years after the transaction under HMRC record-keeping rules, even if you delete your account.
• Server logs — retained by our hosting providers for approximately 30 days.

What "account deletion" currently means

When you request account deletion, we:

1. Remove your email and revoke your sessions in our authentication provider (Supabase).
2. Set the user_id on your paid runs to NULL — the runs, hypotheses, and evidence rows remain in our database in an anonymised form, no longer readable by any authenticated user (enforced at the database level by Row-Level Security).
3. Payment records with Stripe follow Stripe's own retention policy and our HMRC obligation above.

REVIEW POINT (potentially launch-blocker): UK GDPR Article 17 (right to erasure) obligates us to delete personal data on request unless a listed exemption applies. Our current mechanism anonymises rather than deletes. Whether pseudonymisation-by-orphaning satisfies Article 17 in the reports/evidence context is genuinely contested. A cautious reading requires implementing a hard-delete option (CASCADE from runs down through hypotheses, evidence_rows, economics_facts) and offering it on request. This decision needs lawyer input before we accept the first non-test paid run.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (Article 15)
• Rectify inaccurate personal data (Article 16)
• Erase your personal data, subject to the caveat in §6 (Article 17)
• Restrict how we process your data (Article 18)
• Data portability — receive your data in a machine-readable format (Article 20)
• Object to processing based on our legitimate interests (Article 21)
• Withdraw consent where processing is consent-based (Article 7(3))

To exercise any of these rights, email privacy@goldrush.capital. We will respond within one calendar month per UK GDPR Article 12(3).

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection authority: https://ico.org.uk/make-a-complaint/.

8. Cookies

Ledger uses only strictly-necessary cookies — specifically, the session cookies set by Supabase to keep you signed in. Under the UK Privacy and Electronic Communications Regulations (PECR), these do not require your consent because they are necessary to provide the Service you requested.

We do not use analytics, advertising, or tracking cookies. If we ever add analytics (e.g., Plausible, Fathom, Vercel Analytics), we will update this Policy and add a cookie banner offering meaningful choice.

9. Security

We follow standard hardening practices:

• All data in transit is encrypted (HTTPS/TLS).
• Data at rest is encrypted at the database layer by our hosting provider.
• Row-Level Security policies at the database prevent one user from reading another user's data even if application-layer checks were bypassed.
• Payment processing is fully delegated to Stripe (PCI DSS compliant).
• Access to production infrastructure is limited to authorised staff.

No system is ever perfectly secure. If we experience a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and (where required) notify you directly, per UK GDPR Articles 33 and 34.

10. Changes to this policy

Material changes will be announced by email to registered users at least 14 days before they take effect. Non-material changes (typos, clarifications, additions of sub-processors that don't change data flows) may be made without notice; the "Last updated" date at the top will reflect any change.

11. How to contact us

COTR Global Group Ltd Registered address to be added

• Privacy inquiries: privacy@goldrush.capital
• General legal inquiries: legal@goldrush.capital
• ICO complaints: https://ico.org.uk/make-a-complaint/

REVIEW POINT: the registered UK company address must be inserted above before publication. Companies House registered offices are matter of public record and required to appear in trading terms and privacy policies for UK companies.