privacy policy

last updated: 11 october 2026 · version 2026-10-11 · trade sharing between advisors added 24 september 2026 (see the desk) · how long we keep your data updated 27 september 2026 · server use of your trading 212 key described 27 september 2026 · who we share with, what the desktop app sends us, lawful bases and your privacy switches updated 27 september 2026 · the desk and ai judgements on your text became part of the service 2 october 2026 · the label on kept trading data and the deletion record described 5 october 2026 · the full record of the advisor's work, and the copy we keep of ai judgements, described 10 october 2026 · what the text sent for ai judgements can contain, including figures about your account, described 11 october 2026

this policy explains what personal information certified random collects when you use blank, our autonomous ai trading advisor, how we use it, and the rights you have over it.

who we are

certified random is the publisher of blank and the data controller for the personal information described below. you can contact us at privacy@useblank.ai.

for any question about your own data, or to make a request under the rights set out below, write to privacy@useblank.ai. registration details for the controlling entity are published here as soon as the company filing completes. we are based in the united kingdom, and the uk information commissioner's office (ico) is the authority that supervises how we handle your data.

information we collect

• account information: your name, email address, postal address, and a securely stored password.
• billing information: a payment-card reference held by our payment processor. we never receive or store your full card number.
• your trading 212 api key: when you connect your trading 212 account, your api key (and secret, if applicable) is stored on our servers in encrypted form so you can connect it once and blank can use it from the desktop app you sign into to place trades on your account. we never share it with anyone outside our service and you can disconnect or remove it from your dashboard at any time.
  
  our servers also use the key directly, to read (never to trade) your trading 212 account for these purposes only:
  • checking the key works and which permissions it has, when you save it and before you switch to live trading;
  • billing: working out the realised profit the monthly 5% commission is charged on. this reads your account's order history for the billing period, so it includes trades you placed yourself as well as those your advisor placed. we keep the resulting figure with the invoice as evidence of the charge;
  • showing your balance and positions in the iphone app and dashboard when your desktop app is not online;
  • support: an administrator can view your account's balance, cash, invested amount, open profit or loss and number of positions to help run the service and answer your questions.
  the lawful basis is performance of our contract with you. the key and these readings are deleted when you remove the key or close your account, except the billing figure kept with an invoice, which follows the retention of billing records described below.
• account activity: records of your plan purchases (£10 trading weeks and the £35 rolling-30-day subscription), commission charges, account credit, and events that affect your account (sign-ins, plan changes, payment failures).
• trade records: the fills your advisor places (ticker, side, quantity, price, and realised profit) are uploaded to your account. this is what powers the trade history in your dashboard and the calculation of the monthly 5% commission on realised profits.
• advisor chat: messages you exchange with the advisor sync through our servers so your conversation follows you between the desktop app, the iphone app, and the dashboard. a person at certified random reads them only where that is necessary to operate the service or to investigate a fault you report. they are also processed automatically: every message goes to our ai model provider so a reply can be generated, and, if your account has accepted the terms of 19 september 2026, the text of your message also goes to our ai judgement service so it can be routed and its tone assessed. see ai judgements on text you write below for exactly what that means.
• support requests and bug reports: when you open a support ticket or send a bug report, we keep what you typed together with the app version and operating system, so we can answer you and reproduce the fault.
• what the desktop app sends us while it runs: this is not anonymous. about once a minute the app you sign into sends a status report tied to your account: your cash, invested and total balance, profit and loss, each open position (stock, quantity, average cost, price and profit), recent orders and fills, and the advisor's short notes on what it is doing. it also sends a full record of the advisor's work (the instructions and context it was given, what it wrote, each tool it used with what it asked and the full answer, its reviews of its own trades, and which ai model produced each message), error and crash logs, the app version, a device identifier for the computer you signed in on, and, like every website and app, your ip address. we use this to run the service (your dashboard and iphone app show it), to bill commission, to support you, and to find and fix faults. it does not include files from your computer.
• research requests: when the advisor wants live news or posts about a market, it writes a short search request, which can name a stock you hold or are considering. that request is stored against your account and sent to our research provider (see who we share information with). it never contains your name, email, balances or keys.

information we do not collect

• we do not collect your browsing activity outside blank.
• we do not track your location.
• we do not sell your data or share it with advertisers, and we do not use your trades or chat for anything beyond the purposes described in this policy.

how we use your information

• to operate your account and provide the service.
• to charge subscription and commission fees, and to prevent fraud.
• to send you essential service emails (sign-up confirmation, billing receipts, security alerts).
• to investigate bugs and improve the product.
• if your account has accepted the terms of 19 september 2026: to route your chat messages to the right model, to categorise and prioritise support requests and bug reports, to spot a stuck advisor, and to notice when a run of your chat messages reads as unhappy. see ai judgements on text you write.
• to let every blank advisor learn from the closed trades of the others, under a random label and without amounts. this is part of how blank works. see the desk.
• to improve the advisor: we study trading data and records of what the advisor did, across accounts, to make it trade better. when we take a copy of this data out of our database for that work, each account is replaced by a random label and no licence key, name or email goes with it.
• to comply with legal and regulatory obligations.

marketing email. if you are a customer, we may email you news about blank itself (new releases and similar updates). you can refuse this when you sign up, switch it off at any time under settings on your dashboard, or use the unsubscribe link in any such email, which works at once and is never reviewed or refused. receipts, security and account emails are not marketing and still arrive. the email that tells you blank has stopped watching your live positions is a service notice with its own switch on your dashboard.

the lawful basis for each use

• performance of our contract with you: your account, sign-in, the advisor and its research, syncing chat and trades to your devices, the dashboard, billing and commission, service emails, and support.
• legal obligation: keeping payment and commission records for six years (uk accounting law), and answering lawful requests from authorities.
• legitimate interests: preventing fraud and abuse (including checking that one card is not behind many accounts), keeping the service secure, finding and fixing faults from logs, noticing a customer who is having a bad time so we can help, improving the advisor from trading data, the desk, and news about blank sent to customers. we have weighed each of these against your interests, and you can object to any of them by emailing privacy@useblank.ai. marketing email you can switch off yourself on your dashboard.
• consent: website analytics cookies. you can withdraw it at any time.

who we share information with

we share the minimum information needed with the service providers who help us run the service. most of them are based in, or process data in, the united states, so your data may be processed outside the uk:

• stripe (payments, us and ireland): card payments, subscriptions and commission charges. stripe holds your card details, name, email and billing address; we hold only a reference to them.
• resend (email delivery, us): the emails we send you, including your email address and the content of each message.
• our ai model provider (a us company): the ai models that power the advisor, its chat and its research. see below for what is sent.
• our research provider (a us company): runs the live news and social search behind the advisor's research. it receives the search requests the advisor writes, which can name a stock you hold, but never your name, email, account, balances or keys.
• render (hosting, us servers) and cloudflare (network and security, global): every request to our website and servers passes through them.
• ideal postcodes (uk): checks the postal address you enter at signup.
• apple: if you pay through the iphone app, apple handles that purchase under its own terms.
• our ai judgement service: a third-party service, based in the united states, that our servers use to rate how newsworthy a public news headline or public market post is and, for accounts that have accepted the terms of 19 september 2026, to classify short pieces of text written by you or by your advisor, which can include figures about your account such as your cash or positions. see ai judgements on text you write below for exactly what is sent and what never is. we will tell you which company it is if you ask: privacy@useblank.ai.
• google: website analytics, and only if you accept the cookie banner. see cookies & tracking below.
• our hosting provider: running the service itself.

when you use the advisor, your messages to it and the market context it reasons over (such as prices, news and details of the positions it is considering) are sent to our ai model provider so that a response can be generated and returned to you. this happens whether you are chatting from the desktop app, the iphone app, or the dashboard.

blank reads a lot of public news, and most of it is not worth waking the advisor for. to decide which headlines are, our servers send each one to our ai judgement service, a third-party service that scores short pieces of text. what we send is the headline's title, where it was published, the ticker symbol it was tagged with, when it was published, and a short extract of up to about 300 characters. all of it is public text that anyone can read on the open web. with a headline we never send your name, email, account id, positions, balances, trades or api keys, and nothing you have said to the advisor travels with it. the same headline is sent once for everyone, so nothing we send tells that service who is watching which company.

other blank advisors (the desk)

every blank advisor works like a trader at one firm, and each can see what the others are doing so they can learn from each other. so the trades your advisor makes are shared with every other blank user's advisor: the stock, whether it was a buy or a sell, the price and time it filled, whether blank or you placed it, the kind of setup it was, and on a sale the result as a percentage. your open positions are shared the same way: the stock, the average price paid, and how far up or down it is as a percentage.

this is shared under a random label such as "trader 3f9a", never with your name, email, account, broker details, the number of shares, any amount of money, or your balance, and fill times are shown to the hour, not the minute. that is pseudonymous rather than anonymous: someone who already knows exactly what you traded and when might recognise it. practice trades are shared too, marked as practice. what advisors are shown today is closed trades and their results only.

since 2 october 2026 the desk is part of how blank works and cannot be switched off. you can object by emailing privacy@useblank.ai, and we will tell you the outcome.

we describe some providers by what they do rather than by name. we will tell you which company any of them is, and which safeguard covers any transfer of your data outside the uk, if you ask at privacy@useblank.ai.

we never sell your personal information.

ai judgements on text you write

this section applies only to accounts that have accepted the terms of 19 september 2026 (version 2026-09-19). if your account has not accepted them, nothing described here happens to it and the four features below simply stay switched off. accepting is a deliberate act: your dashboard shows a notice summarising the change, with links to this policy and to the terms, and you press accept. to decline, do not press it. dismissing or ignoring the notice is not acceptance, and nothing about your dashboard, your downloads, your billing or your advisor is withheld if you never accept.

for accounts that have accepted, we send four kinds of text to the same ai judgement service described above, so it can return a short structured verdict our software acts on:

• a chat message you send the advisor. we send the text of the message, as you wrote it, so the service can tell a quick factual question from a decision that needs the slower, more careful model, and we route it accordingly.
• a support request or bug report you submit. we send the subject and body you typed, and which app it came from (for example the desktop app or the website), so it can be categorised and given a priority before a person reads it. the app version and operating system are not sent.
• the advisor's one-line status text. this is the short sentence your advisor writes about what it is currently doing. we send it so we can spot an advisor that has got stuck and needs attention. the software wrote it rather than you, and it often states figures about your account, such as how much cash is free, which shares you hold, or a profit or loss, so we treat it as your data.
• the tone of your recent chat messages. we send the text of up to your last twelve messages, judged together, so we can notice an unhappy customer and get in touch rather than wait for you to give up.

what we never send, in any of those four cases: your password, your trading 212 api key or its secret, your card details or any payment identifier, your name, your email address, your postal address, or your account id. we never send your positions, your balances or your trade records as records taken from your account, and the service is not told whose text it is reading.

what the text itself can contain. we send each piece of text as it was written and do not remove anything from it. since 11 october 2026 that is stated plainly: the advisor's status line often mentions your cash, balance, positions or a profit or loss, and a chat message or support request contains whatever you typed, including figures about your account or anything else you choose to write. if you would rather a detail did not leave our servers, leave it out of what you type.

the service is run by a us company, so this text is processed outside the uk. its published terms say it keeps what it is sent for as long as is necessary to provide the service; it publishes no fixed retention period for accounts like ours, so we cannot tell you one. that is a reason we keep what we send as short as the job allows. if the service is slow, unavailable, or not confident enough in its own answer, blank falls back to its ordinary rules and nothing about your experience changes.

we keep a copy of the text we send and the verdict returned, linked to your account, while your account is open; when you close it, the text is deleted.

since 2 october 2026 this is part of how blank works rather than an option, and our lawful basis is our legitimate interest in running the service well: routing your messages to the right place, triaging support, and keeping noise out of your advisor. only the text described above is sent, never your name, email, keys or account id, though that text can include figures about your account as described above. you can object at any time by emailing privacy@useblank.ai from the address on your account, and we will consider it against the needs of the service and tell you the outcome.

how long we keep your data

while your account is open we keep your data, so the service works and you can see your full history: your trades, performance, chat, support messages and account records all stay for as long as the account does. we do not delete or anonymise any of it while you are still a customer.

when you close your account we anonymise it. we do the same if you have not used blank for 365 days, have no paid access running and owe nothing. it happens within a day. the identifying parts are deleted: your name, email address, postal address, ip addresses, device and browser details, card and payment references, broker keys, and anything you typed to us or to the advisor (chat messages, support requests, bug reports), along with crash logs. the trading data they were attached to (trades, performance figures, and what the advisor did) is kept under a random label, with exact times cut to the day and balances and money amounts rounded. that label can only be linked back to your account through our billing records, which we keep for tax and accounting, and only by us. it is never shared or published. we keep that trading data to improve the product.

payment and commission records are the exception. uk law requires us to keep them for six years, so they stay identifiable for six years from their date and are then anonymised. closing your account is never blocked by money owed: if a closing balance cannot be charged, your account is still erased and we keep only the billing record needed to collect it. when nothing is owed we also ask stripe to delete your customer record there; stripe keeps its own record of past payments as the law requires of it.

when you close your account we also keep a short deletion record, so we can account for what you paid and show whether closing commission was owed. it holds a coded form of your licence key (not the key itself) that only our server can work out, the random label your trading data was kept under, the day you signed up, your plan, whether and how much you paid, whether you opened the app and ran the advisor, the day we last saw you, how many live trades you made, that month's profit or loss as the app reported it, the closing commission outcome and amount (and your broker's own profit figure when we had one), how the account was closed, and your reason if you gave one. it never holds your name, email address, postal address, broker data, ip address or device details. our lawful bases are legal obligation (keeping tax and accounting records) and our legitimate interest in showing whether commission was owed. the deletion record is deleted six years after it was written.

information that is not part of an account (a waitlist sign-up, a signup you did not finish, a download of the app without an account) is deleted or anonymised 365 days after it was collected.

your rights

if you are in the uk or eu, you have rights under the uk gdpr and eu gdpr to access, correct, or delete the personal data we hold about you, to object to or restrict our processing, and to request a portable copy. similar rights apply in some other regions. you can do much of this yourself on your dashboard: download my data gives you a copy of everything our servers hold about your account, the privacy switches turn marketing email, position alerts, the desk and ai judgements on and off, and you can change your name and address or delete your account. for anything else, including correcting your email address or objecting to any use based on our legitimate interests, email us at privacy@useblank.ai from the address on your account and we will respond within one month. you also have the right to complain to the ico (ico.org.uk) or your local data-protection authority.

cookies & tracking

two strictly-necessary cookies run for everyone, with or without consent, because the site does not work without them: your sign-in session, and the stripe payment widget on the signup page. there is no advertising pixel and no advertising tracker anywhere on this site.

optional analytics. if you press accept on the cookie banner, we load google analytics 4 (measurement id G-3QEYL2NL2V) to see which pages people read and which sites and AI assistants they arrived from. if you press reject, or simply never answer, nothing is requested from google at all: the tag is not loaded, not deferred, not pinged cookielessly. our fonts are served from our own site, not from google. we do not enable google signals, we do not allow ad personalisation, and ip addresses are anonymised.

analytics data goes to google llc, which may process it outside the uk and eea under the uk addendum to the eu standard contractual clauses. google's own account is at policies.google.com/privacy. retention is set to google's shortest options: event-level data for 2 months, user-level data for 14 months.

your choice is recorded in your browser's local storage, not in a cookie, and it applies to every page on this site. we re-asked everyone on 8 august 2026, because a choice made when the banner said "we may add analytics in future" is not consent for analytics that actually exist. re-open the cookie banner to change your mind at any time. withdrawing takes effect immediately, without a reload, and removes the analytics cookies already set.

children

blank is not intended for anyone under 18. we do not knowingly collect personal data from children. if you believe a minor has provided us with personal data, contact us and we will delete it.

security

we protect your information with industry-standard security measures, including encryption in transit, encryption at rest for sensitive credentials such as your trading 212 api key, and access controls that limit who at certified random can see your data. no system is perfectly secure, so we encourage you to use a strong, unique password and to keep your devices safe.

changes to this policy

we may update this policy from time to time. the date at the top of this page always reflects the last revision. if we make material changes we will notify you in the app or by email before they take effect.

contact

questions about this policy? email us at privacy@useblank.ai.