Draft

Privacy policy

Last updated 12 October 2026

Who we are

Passify Ltd is the controller of your personal data. We are registered in England and Wales, company number 15259706. Registered office: 64 Crane House, Pelican Estate, London SE15 5NG. You can reach us about anything in this policy at info@passifyalgo.com.

ICO registration number: [CONFIRM, registering now].

What we collect

• Your application form answers: your name, phone number, email address, and what you tell us about your strategy, the markets you trade, your platform and your risk rules.
• Call booking details: the time you pick and anything you add when you book.
• Emails and messages you send us, and our replies.
• The strategy information you give us so we can write your brief and build your EA.
• Contract and invoice details: your name, address and the services you buy.
• Payment details. The build is paid by bank transfer, so we see the transfer on our bank statement. The monthly plan is paid by card through [CONFIRM payment processor]; your card details go to them, not to us.
• If you accept cookies: how you use this site and which of our ads brought you here (see our Cookie policy).

We never ask for your trading account login, password, investor password or API keys, and you should never send them to us.

Why we use it, and our lawful basis

The law requires a lawful basis for each thing we do with your data. Here they are, one by one.

Assessing your application and steps before a contract

Reviewing your application, calling you, and writing your free brief. Lawful basis: contract (steps you ask us to take before entering into one).

Delivering your build

Building, testing and handing over your EA, the weekly updates, and the Always-Up-to-Date Plan if you have it. Lawful basis: contract.

Keeping accounting records

Invoices, payments and the records tax law requires us to keep. Lawful basis: legal obligation.

Improving the site and measuring our ads

Google Analytics 4, Google Ads, the Meta Pixel and the Reddit Pixel, only if you accept them in the cookie banner. Lawful basis: consent. Google, Meta and Reddit are named as recipients below. You can withdraw your consent at any time from Cookie settings at the bottom of every page. [CONFIRM: legal review]

Replying to enquiries

Answering emails and messages that aren't part of an application or a contract. Lawful basis: legitimate interests (we need to reply to people who contact us, and you would expect us to).

We only send marketing emails to people who have agreed to receive them, and every one has an unsubscribe link.

Who we share it with

We use these providers (processors) to run the business. They only use your data to provide their service to us.

• GoHighLevel: our CRM, forms, call booking calendar and email. [CONFIRM if email or calendar is a different tool]
• Our card payment processor for the monthly plan: [CONFIRM].

Google, Meta and Reddit are covered in the next subsection, because they only receive data if you consent.

Advertising and measurement partners

If you accept the analytics or marketing choice in the cookie banner, these companies receive data from your visit. Each only after you accept, and each for the purposes described:

• Google (Google Ads and Google Analytics 4): measures visits and which of our ads brought you here, and lets us show our ads to people who visited the site.
• Meta Platforms Ireland Limited and Meta Platforms, Inc. (Meta Pixel and Conversions): measures which of our ads on Facebook and Instagram led to a visit or an application.
• Reddit, Inc. (Reddit Pixel): measures which of our ads on Reddit led to a visit or an application.

Depending on the product, each of them acts for its own purposes as an independent controller, or as our processor. [CONFIRM: legal review] The data they receive is: the pages you view, which ad brought you here, device and browser data, your IP address, cookie IDs, and an event that says "application submitted". They do not receive your form answers, your name, your email address or your phone number.

Freelance developers who help with builds receive a strategy brief only: the rules of the strategy, with no name, contact details or account details. Only Passify staff see clients' personal data.

We don't sell your data. We may share it if the law requires us to, for example with HMRC.

Advertising, remarketing and Google

We advertise on Google, Meta and Reddit. This section explains how that works and how to opt out. [CONFIRM: legal review]

Google remarketing

• Third-party vendors, including Google, show our ads on sites across the internet.
• We and third-party vendors, including Google, use first-party cookies (such as the Google Analytics cookies) and third-party cookies (such as the DoubleClick cookie) together to inform, optimise and serve ads based on someone's past visits to our website.
• You can opt out of Google's use of cookies for ad personalisation at adssettings.google.com.
• You can opt out of third-party vendors' use of cookies for personalised advertising at aboutads.info or optout.networkadvertising.org.
• You can read how Google uses data from sites that use its services at business.safety.google/privacy.

Consent Mode and your choice

We use Google Consent Mode v2. Ad storage, ad user data, ad personalisation and analytics storage are all denied by default. Nothing from Google, Meta or Reddit loads until you choose Accept all in the cookie banner, and nothing loads if you choose Reject all.

Meta and Reddit settings

• Meta: facebook.com/adpreferences.
• Reddit: reddit.com/settings/privacy.

Transfers and changing your mind

Data sent to Google, Meta and Reddit may be transferred to the United States and other countries, with the safeguards described in the next section. You can change your choice at any time with Cookie settings in the footer of every page. See also our Cookie policy.

Data that leaves the UK

Some of our staff work from South Africa and access client data from there, and some of our providers are based in the United States. When data goes outside the UK, we make sure it stays protected to UK standards:

• For staff and providers in countries without a UK adequacy decision, such as South Africa, we use the UK's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. These are contracts approved by the ICO that bind the recipient to protect your data.
• For US providers certified under the UK-US Data Bridge, the transfer is covered by that framework. For US providers that aren't certified, we use the agreement or addendum above.

[CONFIRM which safeguard applies to each provider.] You can ask us for a copy of the safeguards at info@passifyalgo.com.

How long we keep it

• Applicants who don't become clients: 12 months after your last contact with us. [CONFIRM]
• Clients: 6 years after the contract ends, because of tax rules and the time limit for contract claims.
• Analytics and advertising data: as set by each provider (see our Cookie policy).

Your rights

Under UK GDPR you can:

• Access: ask for a copy of the personal data we hold about you.
• Correction: ask us to fix anything that's wrong or incomplete.
• Deletion: ask us to delete your data, where we don't need to keep it by law.
• Restriction: ask us to pause using your data while a concern is sorted out.
• Objection: object to us using your data on the basis of legitimate interests.
• Portability: get the data you gave us in a common format, or have it sent to someone else.
• Withdraw consent: switch off analytics or marketing cookies at any time from Cookie settings, and unsubscribe from marketing emails from any email.

To use any of these rights, email info@passifyalgo.com. We'll reply within one month. It's free.

If you're unhappy with how we handle your data, please tell us first. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

Other things you should know

• We don't make decisions about you by automated means alone that have legal or similarly significant effects.
• This site and our services aren't for anyone under 18, and we don't knowingly collect their data.
• If we change this policy, we'll update the date at the top of this page.