What we know about you

The data controller is AI Intelligence Limited (company number 81182710), Unit 1102, 11/F, 29 Austin Road, Tsim Sha Tsui, Kowloon, Hong Kong.

Contact: admin@allfacts.ai

When you subscribe. Your email address, the language and the page you subscribed from, and the time you did it. We also store which editions we sent you and whether they were delivered, opened or clicked — that is how we can tell our mail is arriving and stop sending to addresses that bounce.

When you create an account. Your email address, the membership tier on the account, and when it was created. Signing in creates a session record on our side, which we delete when you sign out and which otherwise expires after 30 days.

If you sign in with Google or Apple, that company tells us your email address and a stable identifier for your account with them, so we can recognise you next time. We ask for nothing else — not your name, not your picture, not your contacts. If you use Apple's option to hide your email, we receive the relay address Apple gives us and nothing more.

When you pay for a membership. Payment is taken by Paddle.com, which sells the membership to you as Merchant of Record. Paddle collects your payment details, billing address and tax information under its own privacy policy, as a controller in its own right. We never see or store your card number. Paddle tells us that you paid, which plan you chose, your country and the status of the subscription, so that we can switch your access on and off.

When you save something. If you save a watchlist or similar preference, we store it against your account.

When you simply read. Ordinary technical data — IP address, browser and device type, the page that referred you, the pages you viewed — and aggregate usage measurement. Your IP address reaches our hosting provider as part of serving you the page at all.

We do not ask for, and do not want, your brokerage credentials, your account numbers, your portfolio holdings or your identity documents. Please do not send them to us.

We do not sell your personal data, and we do not share it for anyone else's advertising.

These providers handle data on our instructions:

• Vercel — hosting, delivery and aggregate site analytics
• Upstash — the database holding subscriber records and saved preferences
• Resend — sending our email and reporting what happened to it
• Google Analytics 4 — measuring how the site is used

Paddle.com is the Merchant of Record for paid memberships. It is not our processor: it handles your payment data as an independent controller, under its own privacy policy, and we receive only what the section above describes.

Paddle.com — sells Insider to you as merchant of record: takes payment, handles tax and sends receipts. Paddle is the controller of your payment details; we never see your card.

Google LLC (Sign in with Google) and Apple Inc. (Sign in with Apple) are likewise not our processors. When you choose one of them, you deal with that company directly under its own policy; it decides what it shows you and keeps, and it passes us only the address and identifier described above.

Prices, fundamentals and filing references come from third-party market data providers. That data is about listed companies, not about you — we send those providers nothing about our readers.

If you take part in The Receipts Ledger, our loyalty programme for founding members, we keep a record of it with your subscription: your Receipts balance and the history of what earned them, your personal referral code, the rewards you have reached and when, and — once you reach 2,500 Receipts — the name you choose for the credits.

When you refer someone. We record that their subscription came through your link, so that your credit can be confirmed, or reversed if their address turns out to be fake. You see how many people joined through your link, never who they are. If you joined through someone else's link, we record whose it was, and they see only that count.

When you submit a share. We store the email address and the link you send us, and someone at AllFactsAI opens the link to check that it is real and public before crediting it.

When you link a YouTube channel. You do this by commenting your personal code on one of our videos. We then store your channel's ID with your subscription, and the ID and date of each comment you post on our videos from then on, the linking one included, so that each earns Receipts once. We read those comments through the YouTube API Services, and only comments on our own channel's videos. We do not keep the text of any comment, and we keep nothing at all about comments from channels that are not linked.

Your name in the credits. If you reach 2,500 Receipts and choose a name, we publish that name — not your email address — on our credits page and in The Weekly Brief for a year. You can change or clear it on your account page at any time; clearing it takes it off the credits page at once and out of later issues, though an issue already sent cannot be recalled.

Your Receipts record is part of your subscription record, and is kept and deleted with it.

YouTube is a Google service, and what Google does with data on YouTube is covered by the Google Privacy Policy.

Commenting on YouTube is governed by YouTube's Terms of Service.

We are based in Hong Kong and our providers operate in the United States, the European Union and elsewhere, so your data is transferred outside your own country. Where the GDPR applies, we rely on the European Commission's standard contractual clauses or another lawful transfer mechanism the provider offers.

We keep your account until you ask us to delete it. We keep your subscription record until you unsubscribe or ask us to delete it, and briefly after that so we do not mail you again by mistake. Usage measurement is kept in aggregate. Anything we are required to keep for accounting or legal reasons is kept for as long as that requires.

If you buy Insider, we keep a billing record linked to your account: Paddle's customer and subscription references, which plan you are on, its status and renewal date, and whether it was refunded. We use it only to give you the access you paid for, and keep it while you have an account.

You can unsubscribe from any email using the link at the bottom of it.

You can ask us for a copy of the personal data we hold about you, ask us to correct it, or ask us to delete it. Where the GDPR applies you can also object to or restrict processing, ask for portability, withdraw consent at any time, and complain to your local supervisory authority. In Hong Kong, the Personal Data (Privacy) Ordinance gives you rights of access and correction, and you may complain to the Office of the Privacy Commissioner for Personal Data.

Write to us and we will answer within one month.

Contact: admin@allfacts.ai

We use what is needed to serve the site, plus analytics identifiers that tell us which pages are read. Those analytics identifiers are the part that counts as personal data under the GDPR, and they are the part you can refuse without losing anything on the site.

Where you are decides where Google Analytics starts. In the European Economic Area, the United Kingdom and Switzerland, nothing is stored on your device for analytics until you agree to it: Google Analytics starts with storage denied, so it can count that a page was read but cannot recognise your browser again. Accepting turns that on; refusing leaves it off.

Everywhere else, Google Analytics is on from your first page view and stores a cookie that lets it recognise your browser on a later visit. You can turn it off with one click, from the bar at the foot of the page or from this page, and it stays off. We work out which of these applies from the country your connection comes from, and keep only that answer — one of two words, never your address — for a day.

We also use Vercel's own analytics, which counts page views without storing anything on your device and cannot recognise you from one visit to the next. Because it keeps nothing about you, it runs whichever choice you make above. Either way, the site works exactly the same.

If you sign in, we set one cookie that keeps you signed in for up to 30 days, and a second that records only the fact that you are signed in, so the site can show you the link to your account. Neither is used for analytics or advertising, and both are removed when you sign out.

While you sign in with Google or Apple, one short-lived cookie carries a random value between the moment you leave for that company's page and the moment you come back, so nobody else can complete your sign-in for you. It lives ten minutes and holds nothing about you.

You can change your mind here at any time, and changing it takes one click, the same as giving it did:

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

Any change is posted on this page, with the date at the top updated.