Privacy Policy
How we collect, use, and protect your personal information.
1. Data Controller
Kayur Dipakkumar, trading as OreScore as a sole trader, is the data controller responsible for your personal data on OreScore under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Our business office is Suite RA01, 195-197 Wood Street, London, E17 3NU; for privacy inquiries email orescoresupport@gmail.com. ICO registration: [ICO registration number to be added — NEEDS REVIEW].
2. Data we collect
Account data: email address, name if you provide it, and sign-in security data, handled by Clerk.
Billing data: Stripe customer and subscription identifiers, plan, renewal dates, and the checkout consent you give (wording version and time). We never store full card details.
Saved work: valuation inputs and saved companies, in your browser and, when signed in, with your account.
Email: receipts, trial reminders and account messages sent through Resend, and support emails you send us.
Technical data: IP address, browser type and request logs collected by our hosting (Replit) and bot checks (Cloudflare Turnstile); optional analytics (Google Analytics 4) and advertising data (Google AdSense) as described in the Cookie Policy.
3. Processors, purposes and lawful bases
| Processor | Purpose | Lawful basis | Where data may go |
|---|---|---|---|
| Apify | Server-side public metal-price retrieval via Apify, which uses Yahoo Finance data. Requests contain public futures symbols and request parameters, not account details, personal data or saved valuation inputs. | Legitimate interests (providing market references) | Provider infrastructure; retention and international-transfer settings need owner verification |
| Stripe | Payments, subscriptions, invoices and fraud checks | Contract; legal obligation (tax records); legitimate interests (fraud prevention) | United States and other countries |
| Clerk | Sign-in, account security and session management | Contract; legitimate interests (account security) | United States |
| Resend | Transactional emails such as receipts, trial reminders and password messages | Contract | United States |
| Google Analytics 4 | Optional usage measurement | Consent | United States and other countries |
| Google AdSense | One banner on selected public pages for signed-out visitors | Consent managed through Google’s consent message (UK/EEA); legitimate interests elsewhere where permitted | United States and other countries |
| Cloudflare Turnstile | Bot and abuse protection on forms | Legitimate interests (security) | United States and other countries |
| Replit | Application hosting, database and server logs; platform visitor analytics if enabled on the deployment (you can block it with browser privacy or tracker-blocking settings) | Contract; legitimate interests (security and reliability) | United States |
Where we rely on legitimate interests, we have balanced them against your rights; you can object at any time. Where we rely on consent, you can withdraw it at any time.
4. International transfers
Some processors above store or access data outside the UK. Where a transfer is restricted under UK GDPR, it relies on one of the following, depending on the provider and destination: UK adequacy regulations for the destination country; for US recipients certified under the EU-US Data Privacy Framework with the UK Extension, the UK-US data bridge; or the ICO International Data Transfer Agreement (IDTA) or the International Data Transfer Addendum to the EU Standard Contractual Clauses, as offered in the provider's data processing terms. We are confirming which safeguard applies to each provider; contact us to request the current details for a specific provider.
5. Cookies and Local Storage
Essential storage supports sign-in, billing flow and saved work. OreScore's cookie preferences control optional analytics (Google Analytics 4). On the public calculator, gold/silver/copper valuation pages, stocks workspace, guides and blog notes with enough original text, Google advertising cookies and similar technologies may be used to serve or measure one banner advertisement. Legal, policy, about, accessibility and credits pages never show ads. Google's consent message handles advertising choices, including for UK/EEA visitors. Signed-in visitors see no ads. See the Cookie & Storage Policy and change analytics choices via .
Stock charts, symbol information and stock reference quotes are official TradingView embed widgets. They load from TradingView only after you allow the TradingView charts category in cookie preferences. When loaded, your browser connects directly to TradingView, which receives your IP address and browser information and may set its own cookies under TradingView's privacy policy. Withdrawing consent removes the embeds from the page.
Metal-price updates are fetched server-side via Apify, which uses Yahoo Finance data. Only public futures symbols and request parameters are sent, not personal data, account details or valuation inputs. OreScore refreshes the references every 30 minutes and may retain dated last-known data for up to 7 days. Apify run inputs, logs and datasets follow its provider settings; the provider deletion schedule needs owner verification. These views do not load Yahoo or Apify scripts, frames or cookies in your browser. Following a Yahoo Finance source link takes you to Yahoo's website.
6. Security and retention
We use reasonable technical and organisational measures intended to protect personal data, but no online service can guarantee absolute security. Proposed retention periods are below. They are targets under legal review; the provider settings and deletion processes needed to apply them are still being verified and may not yet be in place.
| Data | Proposed retention |
|---|---|
| Metals market data (Apify) | OreScore refreshes public market references every 30 minutes and may show dated last-known data for up to 7 days. Apify run inputs, logs and datasets follow its provider retention settings; their deletion schedule needs owner verification. No account details or valuation inputs are sent. |
| Account profile (Clerk) | While the account is open, then deleted within 30 days of closure (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Billing and invoice records (Stripe references) | 6 years after the end of the tax year of the transaction, for HMRC record-keeping (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Saved valuations stored with your account | While the account is open; deleted within 30 days of account closure (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Support and refund emails | 2 years after the last message, or longer if a dispute is open (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Transactional email logs (Resend) | 90 days (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Server and security logs (Replit hosting) | 30 days unless needed to investigate an incident (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Bot-protection signals (Cloudflare Turnstile) | Processed at the time of the check; not stored by OreScore (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Analytics (Google Analytics 4, with consent) | 2 months, the shortest GA4 data-retention setting (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
| Consent record in your browser | 12 months, then you are asked again (proposed — needs review; owner to verify the provider setting or deletion process is in place) |
7. Your UK Rights
Under UK GDPR, you have the right to access, correct, delete, or restrict the processing of your personal data, the right to data portability, the right to object, and the right to withdraw consent. To exercise these rights, email us; we normally reply within one month.
8. Complaints
Please contact us first at orescoresupport@gmail.com so we can try to resolve your concern. If you are not satisfied, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.
9. Children
OreScore is intended for adults aged 18 or over. We do not knowingly collect personal data from children. Contact us if you believe a child has provided personal data so that we can investigate and delete it where appropriate.
10. Updates to this Policy
We may update this policy occasionally. Significant changes will be communicated via the website. This policy is effective as of 26 October 2026.
11. Contact
For privacy inquiries, please contact orescoresupport@gmail.com.
Last updated: 26 October 2026
OreScore office: Suite RA01, 195-197 Wood Street, London, E17 3NU · orescoresupport@gmail.com