Who is responsible for your information
Fusial LLC, a Texas limited liability company, trading as Ledington, is responsible for the personal information described here. You can reach our privacy team at privacy@ledington.com.
There are two different relationships in this policy, and it matters which one you are in.
- For your account, our website, our billing and our own analytics, we decide how information is used. In European terms, we are the controller.
- For the work your team does inside the terminal, such as research notes, portfolios, saved screens and messages in your organization's channels, your organization decides. We hold that content on its behalf and act on its instructions. In European terms, your organization is the controller and we are the processor.
If you use Ledington through an employer or a client, ask them for their own privacy notice as well. Their administrators can reach your content, and they decide how long your organization keeps it.
What we collect
Account and profile. Your name, email address, whether that address is verified, an optional profile image, a hash of your password, your role on the platform, and the organizations you belong to. If a colleague invites you, we hold the invitation, the address it was sent to and who sent it, until you accept it or it expires.
Sign-in and device security. Records of your sessions, including the IP address and browser user agent they were created from, and when they expire. For the phone you enroll to approve sign-ins, we hold an installation identifier, the device name you give it, its platform, its public key, and the attestation your phone's operating system produces. We also hold hashes of your recovery codes, any two-factor secret and backup codes, and the metadata of any passkey you register.
Your fingerprint or face never reaches us. Biometric checks happen on your own phone, inside its secure hardware, and all we receive is a cryptographic assertion that the phone verified you. We do not collect your phone's model or operating system version.
What you create in the terminal. Watchlists and the notes and price targets on them, research notes, portfolios with their accounts, holdings and transactions, saved layouts, saved screens, chart drawings, alert definitions and the alerts they produce, your daily brief settings including your time zone, notification preferences, and the messages, channel memberships and direct messages in your organization's chat.
When you import a portfolio from a CSV file, we read the file in the request and keep only the resulting holdings and transactions, along with a hash of the file and a fingerprint of each row so that we can spot a repeated import. We do not store the file itself. Chat attachments are references to objects that already exist in the terminal, such as a chart or a note, rather than uploaded files.
Billing. Your organization's subscription, plan, term, purchased and assigned seats, the name and email address of its billing contacts, invoices, charges and recorded payments, and who made each billing change.
Audit records. The terminal records administrative and security-relevant actions: who acted, on whose behalf, in which session, against which resource, and what the affected record looked like before and after the change. This is how an organization can answer questions about its own data later, and how we investigate a security incident.
Product analytics. We record six events, and only six: an account being created, someone joining an organization, a terminal becoming active, a panel being used, a workflow being completed, and an export being delivered. Each carries your user identifier, name and email address, your organization identifier and your role in it.
We deliberately keep everything else out of analytics. No ticker lists, search terms, command arguments, resource names, portfolio amounts, notes, chat or export contents are collected. We switch off autocapture, page view tracking, session replay, heatmaps and console capture, and we ask our analytics provider to discard IP addresses. The public demo and our development environments send nothing.
Error reports. When something breaks, we record the class of error, the operation that failed and a safe error code, with stack locations stripped of query strings and local usernames. We never attach request bodies, headers, cookies, database parameters, credentials or the contents of your documents.
The waitlist on this website. Your name and email address, and then, if you answer them, your role, the size of your team, the tools you use today, what each category of market and research data would be worth to you, and anything you write in the free-text box. We use a hidden field to catch bots.
Your market data queries stay yours
When you look up a company, run a screen or open a curve, our servers request that data from the relevant provider using our own credentials. Your identity is not passed upstream, and the tickers you search, the screens you build and the panels you open are not sent to any analytics provider.
Some data vendors and exchanges require us to know and report whether a user is a professional or non-professional subscriber, and to identify how many people hold licensed seats. Where a data license requires it, we will report that status and those counts. We do not report what you looked at.
Why we use it, and our legal basis
If you are in the United Kingdom or the European Economic Area, data protection law asks us to name a legal basis for each use. These are ours.
| What we use information for | Legal basis |
|---|---|
| Running your account and the terminal, and doing what your organization asks | Performance of a contract |
| Verifying your email address, approving sign-ins, attesting your enrolled phone and enforcing session limits | Contract, and our legitimate interest in keeping accounts and licensed data secure |
| Keeping audit records of administrative and security-relevant actions | Our legitimate interest in accountability and in investigating incidents, and legal obligation |
| Invoicing, collecting payment and keeping financial records | Contract, and legal obligation |
| Sending transactional email such as verification, invitations and billing notices | Performance of a contract |
| Sending alert emails and the daily brief | Consent, which you give by switching them on and can withdraw at any time |
| Product analytics and error reporting, to see which panels get used and to fix what breaks | Our legitimate interest in understanding and improving the terminal |
| Meeting data vendor and exchange licensing conditions | Legal obligation, and our legitimate interest in keeping our data licenses |
| The waitlist, and replying to what you tell us there | Consent |
| Handling support requests and security reports | Contract, and our legitimate interest in running a secure service |
We do not sell your personal information, we do not share it for cross-context behavioral advertising, and we do not use it to build advertising profiles. We do not use your content to train machine learning models, and the terminal contains no AI assistant that your content is fed to.
We do not make decisions about you by automated means that produce legal or similarly significant effects.
Who we share it with
We use a small number of providers to run the service. They process personal information on our instructions, under contract, and for no purpose of their own.
| Provider | What it does for us | What it handles |
|---|---|---|
| Resend | Delivers transactional and notification email | Your name, email address and the contents of the message |
| PostHog | Product analytics and error reporting | Your user identifier, name, email address, organization identifier and role, and the six product events |
| Expo | Delivers push notifications to the Ledington mobile app | Your device's push token and the notification payload |
| Apple | Attests iOS devices at enrollment and approval | Attestation data produced by your device |
| Attests Android devices at enrollment and approval | Attestation data produced by your device, and its revocation status | |
| Microsoft Azure | Hosts the website, the application, its database and its background workers | Everything described in this policy, at rest and in transit |
| Microsoft Dynamics 365 | Receives waitlist sign-ups from this website into our customer records | Your name, email address and the answers you give on the waitlist form |
We also share information with your own organization's administrators, who can reach the content created in their organization; with professional advisers such as our lawyers and accountants where they need it; and with authorities, regulators or data vendors where the law or a data license requires it. If we are ever part of a merger, acquisition or sale of assets, information may transfer with the business, and we will tell you before it becomes subject to a different policy.
We keep this list current. If you would like to be told when it changes, email privacy@ledington.com and we will add you to the notice list.
Where your information is held
We are based in the United States and our providers are primarily in the United States, so information about you is stored and processed there.
If you are in the United Kingdom or the European Economic Area, that is a transfer outside your home region. We rely on the European Commission's standard contractual clauses, and the UK addendum to them, together with the technical measures described below. You can ask us for a copy of the clauses we use with any provider at privacy@ledington.com.
How long we keep it
| Information | How long |
|---|---|
| Account and profile | While your account is open, then deleted within 30 days of closure |
| What you create in the terminal | Until you or your organization deletes it. When a subscription ends we keep it briefly so it can be exported, then delete it |
| Sessions, enrolled devices and push tokens | Until the session expires or you remove the device, and expired records are cleared automatically |
| Billing records | Seven years, because tax and accounting law requires it |
| Audit records | Kept as immutable evidence, without an age-based purge. See below |
| Product analytics and error reports | As long as our analytics provider's retention setting allows, and no longer than we need them |
| Waitlist entries | Until we open sign-up and for a reasonable period after, or until you ask us to remove yours |
| Backups | Until they expire on their normal rotation, after which deleted information is gone from them too |
Audit records need a plain explanation, because they behave differently from everything else. They are designed so that they cannot be edited or deleted, including by us, and they deliberately outlive the users, organizations and rows they describe. That is what makes them useful as evidence when an organization or a regulator asks who changed something.
They hold identifiers, the action taken and the state of the affected record before and after. If you ask us to erase your personal information, we will erase it everywhere else and tell you what remains in the audit record and why we are keeping it. Audit records are not used for analytics, marketing or any product purpose, and access to them is restricted and itself recorded.
Cookies and similar technologies
The terminal sets a session cookie so that you stay signed in, and the security cookies needed to protect that session. These are strictly necessary, and the service cannot work without them.
Our analytics provider sets an identifier so that repeat events from the same browser can be grouped. We do not use advertising cookies, cross-site trackers or third-party marketing pixels, on the website or in the terminal, which is why you are not being asked to dismiss a banner.
If you would rather your usage was not counted in our product analytics, email privacy@ledington.com and we will exclude your account.
Your rights
Wherever you live, you can ask us to give you a copy of the personal information we hold about you, correct it if it is wrong, delete it, or send it to you in a portable format. You can also object to a use we base on our legitimate interests, ask us to restrict a use while a dispute is resolved, and withdraw any consent you have given, which does not affect what we did before you withdrew it.
Email privacy@ledington.com and we will answer within 30 days, or tell you why we need longer. We will not charge you, and we will not treat you differently for asking. We may need to verify who you are first, which for an account holder usually means answering from the address on the account.
If your organization controls the content you are asking about, we will point you to it, or pass your request on and support it. We cannot delete an organization's records at the request of one of its members.
If you are in the United Kingdom or the European Economic Area, you can complain to your data protection authority, which in the UK is the Information Commissioner's Office. We would rather you came to us first.
If you are in California, you have the right to know what we collect, use, disclose and retain, to correct it, to delete it and to be free from retaliation for exercising those rights. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing for you to opt out of, and we honor Global Privacy Control signals as a matter of course. We do not use sensitive personal information to infer characteristics about you. You may use an authorized agent, and we will ask for proof of their authority.
For organization customers
Where your organization is the customer, we process its content only on its documented instructions, keep our staff's access to it limited and recorded, hold our providers to the same terms we accept, help it respond to the requests its own people make, and delete or return its content when the relationship ends.
We will sign a data processing agreement, including the standard contractual clauses where they are needed. Ask for one at privacy@ledington.com.
How we protect it
Traffic is encrypted in transit. Passwords are stored as hashes, and so are recovery codes and two-factor backup codes. Sign-in needs a password and an approval from hardware you hold, which makes a stolen password insufficient on its own. Sessions live in the database rather than in a cached cookie, so revoking one takes effect immediately, and each account is limited to one terminal session and one enrolled phone.
Access to production data is limited to the people who need it, and administrative access is recorded in the audit log. Market data credentials stay on our servers and are never exposed to the browser.
No service can promise perfect security. If a breach affects your personal information we will tell you and the relevant authority as quickly as the law requires. Report a vulnerability to security@ledington.com.
Children
Ledington is for professional and personal financial research by adults. It is not for children, we do not knowingly collect information from anyone under 18, and we will delete it if we find we have. Tell us at privacy@ledington.com if you believe a child has given us information.
Changes to this policy
We will update this page as the service changes, and the date at the top will tell you when we last did. If a change materially affects how we use your information, we will tell you by email or in the terminal before it takes effect.
Contact
For anything in this policy, or to exercise a right, email privacy@ledington.com. For the terms that govern your use of Ledington, email legal@ledington.com. For security reports, email security@ledington.com.
Fusial LLC is the entity responsible for the information described here.