Privacy policy

Browsing without an account

Prices, comparisons, provider pages and guides need no account and no sign-up. Nothing on the site sets a cookie for statistics or advertising, and you never have to accept anything to read a price.

Page statistics

We use Cloudflare Web Analytics to count page views and to measure how fast pages load. A small script sends Cloudflare the page address (without anything after a ?), the page you came from, page-load timings and your browser and device type; Cloudflare works out your country from your IP address. It sets no cookie, stores nothing on your device, does not give you an ID and does not follow you to other sites. We see totals (views per page, country, browser), never a single visit. Cloudflare processes this for us only, keeps the detailed records for 7 days and then only summaries, which we can see for 6 months.

Because Cloudflare delivers every page, it also gives us hourly totals of all requests to the site (by country, browser family and response), which come from serving the pages, not from your device. They contain no address and help us tell people from bots.

Clicks to providers

When you press a button that opens a provider's site, the click goes through stackrates.ai/go/ first, and we record: which provider, which of our pages the click came from, the time, a scrambled form of your IP address (a salted hash: the address itself is not kept, but we still treat the hash as personal data), the number of the network it came from (for example your broadband or mobile provider, which covers many people), and whether the click looks like a person, a bot or one of our own checks, with the reason. To decide, we also read the browser name your browser sends with the click, then discard it. We use this to know which pages help people and to keep bot traffic out of our numbers. Nothing about you is passed on to the provider: they see a visit from stackrates.ai, with no code, no page and no address from us.

To tell people from bots, the page adds a random one-time code to the button's link when you press it. The code comes from stackrates.ai, says nothing about you, lives in the open page's memory only and expires after 30 minutes. It is part of Statistics: while Statistics are off (switched off, or not yet switched on in the EU or EEA) the page does not fetch it, and your clicks are only tallied as “not measured”, with no scrambled address and no network number.

We delete the scrambled address after 30 days and the network number after 90 days (we keep it longer only when it is the reason a click was filed as coming from a cloud or data-centre network). The rest of each click record is deleted after 13 months, so we can compare the same month a year apart; after that we keep only daily totals per provider and page.

Price emails

If you sign up for the weekly digest or deal emails, we store your email address, the topics you chose, the page you signed up on and the dates you signed up and confirmed. Nothing is sent until you press the link in the confirmation email; an address never confirmed is deleted after 30 days. Every email has a one-click unsubscribe link. After you unsubscribe we keep the address marked as unsubscribed, only so we never email it again; ask us and we delete it entirely. Emails are sent through Resend, which processes them for us. The links in our emails carry no tracking. To stop repeated sign-up attempts we hold a scrambled form of your IP address in memory for a few minutes; it is never stored with your email address.

Security and bot protection

Cloudflare serves and protects the site. To do that it handles your IP address, network number, country and browser details with every request. Our rules there block known attack patterns, briefly hold back very fast repeated requests, and may show a short automatic check when a provider link is opened from a cloud or data-centre network; passing a check sets the cf_clearance cookie listed above. For requests it blocks or checks, Cloudflare keeps a record (address, network, country, browser and page) that we can see for up to 31 days.

If your browser stops something our security policy does not allow, it may send us a short report: the page path, the rule and the site that was blocked. We read these reports as they arrive and do not store them; we never keep your address or browser details from them. Our own servers keep short technical logs for security and fixing faults; they never hold payment details.

Account and adviser

• Account identity. When you sign in to use the adviser we receive an account identifier and email address from our sign-in provider, Supabase. We use it to identify your account and to contact you about billing.
• Adviser usage. We store a record of each adviser run linked to your account: the requirement text you submitted, the plan IDs recommended, the outcome, and the billing month. This is what enforces the 3-per-month free allowance, so it cannot be switched off while you use the adviser. Avoid pasting secrets or personal data into the requirement box.
• Subscription state. For Pro accounts we store your subscription status and the Stripe customer and session identifiers needed to reconcile it.

Payment data

Card payments are processed by Stripe on Stripe's own systems. We never receive or store your card number, and we confirm a payment only by asking Stripe about the checkout session. Stripe processes your payment data as its own controller under its privacy policy.

AI processing

Questions you type into Ask StackRates may be read by a language model running on Cloudflare Workers AI to work out which plans you mean; the answer and every price in it come from our own dataset. Adviser requirement text is sent to a third-party AI model provider together with our hosting dataset. Do not include confidential information in either.

Outbound provider links

Clicking through to a hosting provider takes you to that provider's own site, where their privacy policy applies. Where an affiliate program is used, the provider may set a referral cookie on their domain to attribute the signup. See our terms for the commercial disclosure.

Who processes data for us

Cloudflare (hosting, security, page statistics, Ask StackRates), Railway (our API servers), Neon (our database), Resend (email), Supabase (sign-in) and Stripe (payments, as its own controller). Each works under data protection terms with us. First State Growth LLC is a United States company and several of these providers process data in the United States; transfers from the UK and EEA rely on the safeguards in those terms (the EU-US Data Privacy Framework and its UK extension, or standard contractual clauses).

Why we may use it

• Price emails: your consent, given by confirming your address; withdraw it with any unsubscribe link.
• Account, adviser and billing: to provide the service you signed up for.
• Page statistics and the click log: our legitimate interest in knowing how the site is used and keeping its numbers honest. You can object at any time with the statistics switch, as described above.
• Security and bot protection: our legitimate interest in keeping the site and its numbers safe from attacks and fraud. This keeps running if you switch statistics off, because the site cannot stay up without it.
• We do not sell or share personal information, and we do not use it for targeted advertising.

Retention and your rights

Click records, page statistics, security records and price emails are kept for the times given in their sections above. Account, adviser-usage and subscription records are kept while your account is active and for as long as needed for tax and accounting obligations. You can ask us to access, correct, export or delete your personal data, or object to how we use it, by writing to [email protected]; we answer within one month. Deleting your account removes your adviser history; billing records we are legally required to retain are kept. If you are in the UK or EEA you also have the right to complain to your data protection authority.

Security and contact

The site is served over HTTPS and payment credentials never touch our servers. No system is perfectly secure, so please report any suspected vulnerability to [email protected].