Privacy Policy

This policy explains what we collect, why, and what you can ask us to do about it.

Last updated: 1 September 2026

1) Who We Are

Giago Software Ltd ("we," "us," "our"), a company registered in England and Wales, operates r40.io and is the data controller for the personal information described here. Contact us about anything in this policy at hello@r40.io.

2) What We Collect

R40 is a public research site. You can read all of it without giving us any personal information — there is no public sign-up, no account, and no paywall.

We collect:

• Server and delivery logs — IP address, request URL, referrer, user agent, and timestamp, recorded when a page or feed is served, including by our hosting and CDN providers.
• Messages you send us — the contents of any email or support message, and the address you sent it from.
• Administrative accounts — for our own staff only: a username, a password hash, and a session cookie.

We do not collect brokerage credentials, portfolio holdings, trade history, bank or card details, or any other financial account information, and we will never ask you for them. We do not run advertising or third-party marketing trackers, and we do not build profiles of readers or infer investment interests from your browsing.

3) Why We Use It, and on What Legal Basis

Under UK GDPR and GDPR we rely on:

• Legitimate interests — serving and securing the site, diagnosing faults, measuring aggregate traffic and page performance, and preventing abuse such as scraping and denial-of-service. We keep this to what is necessary to run a public site.
• Contract or steps before a contract — answering enquiries you send us.
• Legal obligation — meeting record-keeping, tax, and lawful-disclosure requirements.

We do not use your information to make automated decisions with legal or similarly significant effects, and we do not profile you.

4) Cookies

We set only essential cookies. The single cookie we use is an administrative session cookie, and it is set only when a member of our staff signs in to the admin area. We do not set analytics, advertising, or cross-site tracking cookies for readers, which is why the site shows no cookie banner.

Page-performance measurements collected in the browser are aggregate and are not tied to an identifier for you.

5) Sharing and Disclosure

We share personal information only with:

• Service providers who host, deliver, and protect the site, and who email on our behalf, acting on our instructions;
• Legal authorities, where we are required to disclose by law or to establish or defend legal claims;
• A successor, if the business or its assets are transferred, subject to this policy.

We do not sell personal information, and we do not share it with data brokers, advertisers, or market-data vendors.

6) Retention

We keep server and delivery logs for up to 90 days, then delete or aggregate them. We keep correspondence for as long as needed to deal with the matter and any follow-up, normally up to 24 months. Administrative account records are kept while the account is active. Where law requires a longer period — for example for tax or accounting records — we keep the record for that period and no longer.

7) Security

We use reasonable technical and organisational measures to protect information, including transport encryption, hashed credentials, and restricted access to the admin area. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

8) Your Rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our use of your personal information, to portability, and to withdraw consent where we rely on it. Ask us at hello@r40.io — we will respond within one month, and we may need to verify who you are before we act.

If you are in the UK, you can complain to the Information Commissioner's Office (ico.org.uk); if you are in the EEA, to your local supervisory authority. We would rather you came to us first.

California residents: we do not sell or share personal information as those terms are used in the CCPA/CPRA, and you will not be discriminated against for exercising your rights.

9) International Transfers

Our providers may process information outside your country, including in the United States. Where information leaves the UK or EEA, we rely on adequacy decisions or on standard contractual clauses with appropriate safeguards.

10) Children's Privacy

The Service is not directed at children and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe we have, tell us and we will delete it.

11) Changes to This Policy

We may update this policy from time to time. Material changes will be reflected in the "last updated" date above, and continued use of the Service after that date means you accept the updated policy.

12) Contact

Questions, requests, or complaints: hello@r40.io