Privacy policy

Last updated: 29 August 2026 · Applies to bullbenchmark.com and the BullBenchmark application

BullBenchmark exists to show you what your investments are doing. That requires handling data about your portfolio, and we hold ourselves to a simple standard: we collect the minimum, we sell nothing, and you can leave with everything or delete everything at any moment. This page explains the details in plain language, as the GDPR requires and as we would want it explained to us.

Who is responsible

Kiekens Consultancy, Chamber of Commerce 71997067, VAT NL001252374B10, Loopakker 1, 4824 SB Breda, Netherlands, trading as BullBenchmark ("we"), is the controller for the personal data described here. You can reach us at privacy@bullbenchmark.com for any question or request on this page.

What we collect, and why

Account data. Your email address, sign-in method (email link or Google), account dates and subscription status. We need these to operate your account and to bill you if you subscribe. Legal basis: performance of our contract with you.

Portfolio data. The transaction files you upload and the positions, dividends and results we compute from them. This is the product; without it there is nothing to show you. We process it only to render your own dashboard. Legal basis: performance of contract. We never sell, share or advertise against your portfolio data, and no other user can see it.

Technical data. Server logs with IP addresses (kept briefly, for security and abuse prevention) and, on the marketing site only, anonymized analytics. When you create an account we store a salted hash of your IP address for a short period to prevent bulk account creation. Legal basis: our legitimate interest in keeping the service safe. The hash cannot be reversed to your address.

Payment data. Payments run entirely through Stripe. We never see or store your card number. We receive only your subscription status and invoices reference.

Product analytics. To see whether the product actually helps people get started, we record six milestones per account: that you signed up, uploaded your first file, were shown the benchmark comparison, started a checkout, subscribed, and that the public demo was viewed. We store only which milestone was reached and when, linked to your account number, and never more than once per milestone. This is measured entirely on our own servers: there is no cookie, no tracking pixel and no third-party analytics service involved, and nothing about your device, browser, location or behaviour is recorded. Legal basis: our legitimate interest in improving the service. These records are erased together with the rest of your data when you delete your account.

Demo counter. We also keep a daily count of how many times the public demo page was opened. That count is an aggregate number per calendar day: a date and a number, nothing else. To avoid counting the same visit repeatedly we briefly store a salted, irreversible hash of the visitor’s IP address, which is deleted within a day and is never linked to an account. No IP address, user agent or cookie is stored for this. Legal basis: our legitimate interest in understanding whether the demo is being used.

Trial register. When a free trial starts we record a salted, irreversible hash (HMAC-SHA256) of the email address together with the date the trial began. Before hashing we normalize aliases of the same mailbox, such as dots and "+tag" suffixes at Gmail, Outlook and others, so that variants of one address resolve to one entry. The register contains no email addresses and no other personal data, and an entry cannot be traced back to a person. It exists for one purpose: to stop the free trial from being handed out over and over to the same mailbox. Legal basis: our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).

Disposable email addresses. Registration with a disposable or temporary email domain is refused. To do that we check the domain of the address you enter against a blocklist of such domains. Legitimate forwarding and alias services are explicitly allowed: Apple Hide My Email, Firefox Relay, DuckDuckGo, SimpleLogin and addy.io. Legal basis: our legitimate interest in preventing fraud.

AI assistant connection. Off by default, and nothing happens until you switch it on. If you create a token on the Account page, you can connect BullBenchmark to your own AI assistant, for example Claude, ChatGPT or Cursor. From that moment the assistant can read six things through that connection: your return against the index, your portfolio totals, your positions, your dividends, your performance over time, and the names and dates of the files you imported. It cannot change anything, upload anything or place an order. Those figures then sit with your own AI provider under their terms, not ours, so read those before you connect. We store a hash of the token and never the token itself, and you can revoke it on the Account page, after which the connection stops working immediately. Legal basis: performance of our contract with you, at your own request.

Where your data lives

Your data is stored in a managed PostgreSQL database hosted within the European Union, encrypted in transit (TLS). Uploaded files are parsed and discarded; what we keep is the structured transaction history, not the raw file. Our processors are Railway (hosting), Vercel (website), Cloudflare (network), Sentry (error monitoring, European region), Stripe (payments), Resend (email delivery) and Google (sign-in, if you choose it). Each processes data only on our instructions under a data processing agreement.

How long we keep things

Your portfolio data: for as long as you have an account. Server logs: up to 30 days. If you delete your account, everything is erased immediately and permanently, with one narrow exception: the trial register described above. That entry, which is the irreversible hash of your email address plus the date your trial started, is kept permanently, also after you delete your account. A register that expired would make the free trial unlimited for anyone willing to delete and sign up again, which is exactly what it is there to prevent. It contains no email addresses and no other personal data, and it cannot be traced back to you.

Your rights

You can exercise every GDPR right directly in the product: access and portability through the one-click export under Account settings, erasure through the Delete my account button, and objection to marketing through the email preferences toggle (transactional messages such as sign-in links continue, everything else stops). For rectification or anything else, email privacy@bullbenchmark.com and we respond within 30 days. You also have the right to complain to your supervisory authority; in the Netherlands that is the Autoriteit Persoonsgegevens. If you live in another EU or EEA country, you can lodge that complaint with the supervisory authority of your own country instead.

What we do not do

We do not sell personal data. We do not build advertising profiles. We do not use your portfolio for anything other than showing it to you. We do not ask for, receive or store broker passwords; the product is deliberately built so that we cannot access your brokerage account under any circumstances.

Changes

If we change this policy in any meaningful way, we announce it by email (if you have opted in) and on this page before it takes effect.