Scarb Privacy Notice

Scarb is a portfolio tracking and analysis service for US-listed shares and ETFs, operated by Desmoware Ltd, a private limited company registered in England and Wales, company number 12205425, whose registered office is at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE. Written correspondence about privacy can be sent to that address.

We are the controller of the personal data described in this notice. That means we decide what data is collected and why. We are registered with the Information Commissioner's Office under registration number ZC243070.

For anything to do with privacy, including requests about your data and complaints, contact privacy@scarb.cc. We monitor that address and reply to every message.

Scarb provides analytical tools, not investment advice. Nothing in this notice, and nothing in the service, is a personal recommendation to buy or sell anything.

This notice covers scarb.cc and the Scarb web application. It explains what we collect, why, what we do with it, how long we keep it, and what you can require of us.

This notice is information, not a contract term. You are not asked to consent to it. At registration we ask you to confirm you have read it, and we record which version was in force at the time, so that we can show you what you were told. Your rights under data protection law do not depend on that confirmation.

Required and optional. Everything on the registration form is required except the marketing opt-in. If registration does not complete, we will tell you and you can try again.

What we do not collect. We do not collect transaction histories, we do not connect to your brokerage or bank, and we do not take payment details. We do not collect special category data, and you should not send us any.

Derived figures. Portfolio valuations, profit and loss, charts and optimizer results are calculated when you ask for them and are not saved to our database. They can appear in server logs while a request is processed, and those logs are kept for the period set out in section 8.

We use a small number of service providers. They act on our instructions under written terms.

What market data providers receive. Price and news requests are made by our servers, not your browser. They carry a ticker symbol, request parameters and our API key. They do not carry your name, email address, account identifier, holding quantities or acquisition prices, and the request comes from our server's IP address, not yours. One consequence is worth being explicit about: to show news for your dashboard we request headlines for each ticker you hold, one symbol per request, so the provider receives the set of symbols in your portfolios, without the identifying details listed above. Those responses are cached for 24 hours per symbol.

Account emails. Verification, password reset and other service emails are sent through Amazon Cognito, which receives your email address for that purpose.

Content delivery. Static files are cached at CloudFront edge locations, which may be outside the United States. Authenticated pages are served privately and are not cached at the edge.

No advertising or analytics. We do not use analytics services, advertising networks, tracking pixels or social media plugins, and we do not sell or share your personal data for advertising. Web fonts are served from our own servers, not from a third party.

Scarb is operated from the United Kingdom, and the providers listed above process data in the United States. Where personal data leaves the UK we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, issued by the Information Commissioner, which is incorporated into our data processing agreements with Databricks (for Neon) and with Amazon Web Services. You can ask us for details of the safeguards in place by writing to privacy@scarb.cc.

We only send product and marketing emails if you have opted in. You can withdraw at any time, either from your profile page or by replying to any marketing email, and withdrawal is as easy as opting in. Withdrawing does not affect the lawfulness of anything sent beforehand.

Service messages are different: account verification, password resets, security notices and material changes to the service are part of running your account and are sent regardless of your marketing preference.

We store only what the service needs to work and what you have chosen.

We rely on the exemption for storage that is strictly necessary to provide a service you have requested: the session cookie is what keeps you signed in, and the theme entry stores only the display setting you chose yourself. Neither is used for tracking, profiling or advertising, so neither requires your consent. We set no third-party cookies and run no third-party scripts. If we ever add storage that falls outside that exemption, we will ask for your consent first.

Your session ends in three ways: signing out deletes the cookie immediately; the token expires by itself after about an hour; and we can revoke sessions server-side, after which an existing token stops working even if a copy of the cookie is kept.

You can delete your account yourself, at any time, from your profile page. There is no need to ask us and no waiting period. You will be asked to confirm, because the deletion cannot be undone.

When you confirm, we delete your holdings, your portfolios and your account record from our database, and then delete your sign-in credentials from Amazon Cognito. Your session cookie is cleared at the same time.

Some records survive that step, and section 8 sets out how long each is kept:

• your data can persist in database backup history for up to seven days;
• log entries that mention your account identifier are kept for 90 days; and
• if you have written to us, that correspondence is kept for the periods in section 8, because we may need it to show how a request or complaint was handled.

If the credential deletion does not complete — for example Cognito is unavailable at that moment — your data has already been removed from our database, but the sign-in record may persist until the deletion is completed. Tell us at privacy@scarb.cc if you think this has happened and we will finish it.

If you cannot sign in — for example you have lost access to your email address — write to privacy@scarb.cc and we will delete the account for you once we are satisfied who you are.

We do not copy live account data into test or development environments, so deletion does not leave a copy behind.

You have the right to:

• be told how we use your data, which is what this notice is for;
• get a copy of the personal data we hold about you;
• have inaccurate data corrected;
• have data erased, in the circumstances the law allows;
• restrict what we do with your data, for example while you are contesting its accuracy or while we consider an objection;
• object to processing we carry out on the basis of legitimate interests;
• receive the data you gave us in a portable, machine-readable form; and
• withdraw consent to marketing at any time.

Write to privacy@scarb.cc. We respond within one month, and will tell you if we need longer because a request is complex.

Verifying who you are. We need to be confident we are dealing with you before we act on a request, particularly a deletion. Writing from your registered email address is the simplest route, but it is not the only one — if you have lost access to it, tell us, and we will agree a proportionate alternative rather than turn you away. We ask only for what is necessary to establish identity, and we delete verification material once the request is closed.

Complaints. If you are unhappy with how we have handled your personal data, tell us at privacy@scarb.cc and say that you are making a data protection complaint. We will acknowledge it within 30 days, investigate without undue delay, keep you informed of progress, and tell you the outcome and what we intend to do about it.

You can also complain to the Information Commissioner's Office at any time, before, during or after raising it with us: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

• Traffic between your browser and Scarb is encrypted in transit.
• Passwords are set, stored and checked by Amazon Cognito. We never receive or store them.
• Data access in the application is scoped to the signed-in account: portfolio queries are constrained to your user identifier on the server, not filtered in the browser.
• Sign-in tokens are held in an HttpOnly cookie that JavaScript cannot read, and can be revoked server-side.
• We operate internal administrative tooling. A small number of authorised people can look up accounts, correct account details such as name, country and display currency, and enable or disable an account. Access is role-based and limited to what is needed to run and support the service. It is not open to everyone at Scarb, and it is logged.

No service can promise perfect security. If a breach affects your rights, we will tell the ICO within 72 hours where the law requires it, and tell you directly where the risk to you is high.

Some calculations run automatically when you open a page: your portfolio valuation, profit and loss, charts, and the news headlines shown on your dashboard.

The portfolio optimizer runs only when you explicitly ask it to, on the holdings in the portfolio you are viewing and the risk-free rate you enter. It uses a fixed three-year window of historical prices. When you run it, our servers send the optimizer function — which runs in our own AWS account, not a third party's — the ticker symbols in that portfolio, their current weights as a proportion of the portfolio, the risk-free rate you entered, and the start date of the three-year window. It does not receive your name, email address or account identifier. It does not run on its own, we do not analyse instruments you have not chosen, and we do not send notifications suggesting portfolio changes.

Results are mathematical analysis of historical data and are informational only. Nothing Scarb calculates is executed on your behalf, and we do not place trades or hold assets. We do not make automated decisions that produce legal effects concerning you or similarly significantly affect you.

If we change this notice, we will publish the new version at scarb.cc/privacy with a new effective date. If a change materially affects how we use your data, we will email registered users before it takes effect. Because we record the version you acknowledged at registration, you can always ask us which version applied to your account and when.

We publish this notice conspicuously and link to it from every page of the service.

Categories of personal information collected: identifiers (name, email address), commercial information (the portfolio holdings you record), internet or network activity (authentication and security event records), and geographic information at country level (the country you select).

Categories of third parties with whom personal information is shared: the service providers listed in section 4 — hosting and authentication, database hosting, and market data providers — acting on our instructions. We do not sell personal information, and we do not share it for cross-context behavioural advertising.

Do Not Track: we do not track users across third-party websites or services, so there is nothing for a Do Not Track signal to switch off. We do not respond differently to browsers that send one.

Changes: section 13 describes how we notify changes. The effective date appears at the top of this notice.

Californians may request to know what personal information we have collected about them and to have it deleted, using the contact details in section 1.

Scarb is for adults. You must confirm you are 18 or over to register, and we do not knowingly collect data from anyone under 18. If you believe a child has registered, email privacy@scarb.cc and we will delete the account.