Privacy Policy

What this site collects about you, why, who else handles it, and how to have it changed or deleted. Last updated 5 November 2026.

The short version

• If you subscribe, I keep your email address and reading level so I can send you the newsletter. You can unsubscribe at any time from any email.
• If you use the contact form, I keep your message and the details you enter so I can reply.
• The site counts page views to see which articles are read. It doesn’t show ads and doesn’t use advertising or tracking cookies.
• I don’t sell your data or share it with anyone except the services that run the site, listed below.
• There are no comments or Likes on this site, so nothing is collected that way.

Who runs this site

The Analytical Investor (analytical-investor.blog) is written and run by Timothy Aine, who decides how your personal data is used. For any privacy question or request, use the contact page.

What I collect and why

Newsletter

When you subscribe, I collect your email address and the reading level you choose (Essentials, Analyst or Everything). You get a confirmation email first, and nothing else is sent until you click the link in it. After that you receive the articles for your level and a welcome email, which includes the download link for the Investment Growth Simulator workbook.

The newsletter software records whether emails are opened and which links are clicked, so I can see what’s useful. Your email program may block this, which is fine.

To stop bots signing up, the form briefly uses your IP address. A scrambled (hashed) version is kept for one hour to limit repeated attempts, then deleted. The form may also use Cloudflare Turnstile, a bot check that looks at basic information about your browser and connection.

Basis: your consent, which you can withdraw at any time by unsubscribing.

Contact form

When you send a message, I receive your name, email address, message, and technical details such as your IP address and browser. These are checked for spam and stored in the site’s dashboard, and a copy is emailed to me.

Basis: your consent, and my legitimate interest in replying to you and keeping out spam.

Visitor statistics and security

Jetpack Stats counts page views, the pages that send visitors here, and visitors’ approximate country. I see only totals, not individual visitors. The hosting service also keeps standard server and security logs, including IP addresses, to protect the site from attacks.

Basis: my legitimate interest in running a secure site and knowing which articles are read.

Cookies and storage in your browser

The site doesn’t use advertising or tracking cookies. It saves a few small settings in your browser’s local storage so the site works the way you left it:

• whether you chose the light or dark theme;
• the last course article you read, so the site can point you to the next one;
• whether you’ve already subscribed or closed the subscribe bar, so it stops appearing.

These settings stay on your device and aren’t sent to me. Clearing your browser’s site data removes them. The fonts are hosted on this site, so loading a page doesn’t contact Google Fonts.

Who else handles your data

These services process data on my behalf, only to provide what’s described above:

• WordPress.com and Jetpack (Automattic): hosting, visitor statistics, security and the contact form. Privacy policy.
• Akismet (Automattic): spam checks on contact form messages.
• MailPoet (Automattic): stores the subscriber list and sends the newsletter. Privacy notice.
• Elementor Site Mailer: delivers the site’s own emails, such as contact form notifications. Privacy policy.
• Cloudflare Turnstile, when switched on: bot checks on the sign-up form. Privacy policy.

Some of these companies store data outside Uganda, mainly in the United States and the European Union. They protect it under their own security measures and data protection terms. I don’t sell, rent or trade your personal data, and I’ll only disclose it if the law requires me to.

How long I keep it

• Subscribers: until you unsubscribe or ask me to delete your details. Sign-ups that are never confirmed are deleted periodically.
• Contact messages: as long as needed to deal with your message, and no more than two years.
• Hashed IP for sign-up limits: one hour.
• Statistics and security logs: as long as the hosting provider’s own retention periods.

Your rights

Under Uganda’s Data Protection and Privacy Act, 2019, and similar laws such as the EU and UK GDPR, you can:

• ask what personal data I hold about you and get a copy;
• have it corrected if it’s wrong;
• have it deleted;
• object to, or ask me to limit, how I use it;
• withdraw your consent at any time. For the newsletter, use the unsubscribe link in any email, or the “manage subscription” link to change your reading level.

To make a request, use the contact page. I’ll reply within 30 days. If you’re unhappy with how I’ve handled your data, you can complain to Uganda’s Personal Data Protection Office (pdpo.go.ug) or the data protection authority where you live.

Children

This site is written for adults. I don’t knowingly collect data from anyone under 18. If you think a child has subscribed or contacted me, tell me and I’ll delete their details.

Security

The site is served over HTTPS, admin access is limited and protected, and the services above are chosen for their security practices. No system is completely secure, but I’ll tell affected readers and the regulator promptly if a breach puts your data at risk.

Changes to this policy

If the site starts collecting something new, this page will be updated first and the date at the top changed. If the change is significant, subscribers will hear about it by email.