The Shortlist

Privacy Policy

Last updated: July 2026 (version 2026-07-01)

Your privacy matters to us. This Privacy Policy describes what personal data The Shortlist collects, why we collect it, how we use and share it, and the choices and rights you have. It applies to your use of the platform and our related services.

We do not sell your personal data. We collect only what we need to run the platform, and we give you control over your communications and your data. This Policy works alongside our Terms & Conditions.

1. Who We Are

This Privacy Policy explains how The Shortlist ("we", "us", or "the platform") collects, uses, shares, and protects personal data when you access or use our quantitative financial data screening platform at shortliststocks.com and any associated services. This Policy should be read together with our Terms & Conditions. By using the platform, you acknowledge the practices described here.

2. Information We Collect

We collect the following categories of personal data: • Account data — your email address, which is used as your primary identifier and to authenticate you. If you sign in through a third-party authentication provider (such as Google), we receive basic profile information from that provider, typically your email address and name, in accordance with the permissions you grant. • Usage and activity data — how you interact with the platform, including screening requests, stocks added to or removed from your shortlist/watchlist, pages viewed, features used, session frequency, and similar product-analytics events. • Preferences — your saved filters, watchlist/shortlist contents, and email/notification preferences. • Billing data — where you purchase a subscription, payment is processed by a third-party payment processor. We do not store your full card number or payment credentials; we retain only a record of the transaction, your plan, and your remaining plan allowances. • Research assistant inputs — questions you submit to "Shorty", our AI research assistant, are processed to generate a response. • Technical data — device and browser information, IP address, and cookie identifiers collected automatically when you use the platform, for security, analytics, and to keep you signed in. • Support and communications — information you provide when you contact us or submit feedback.

3. How We Use Your Information

We use personal data to: (a) provide, operate, authenticate, and secure the platform; (b) deliver screening results and maintain your shortlist, watchlist, plan allowances, and preferences; (c) send transactional and service emails (such as account, security, and preference-related messages) and — where you have not opted out — product updates, onboarding content, and notifications about stocks on your shortlist; (d) process payments and manage subscriptions and plan allowances; (e) generate aggregated, non-identifying analytics to understand and improve the platform; (f) generate AI-assisted explanations of the underlying financial data; (g) detect, prevent, and address fraud, abuse, security incidents, and violations of our Terms; and (h) comply with legal obligations.

4. Legal Bases for Processing

Where applicable law (including the EU/UK GDPR) requires a legal basis, we rely on: performance of our contract with you (to provide the platform and the services you request); our legitimate interests (to secure, analyse, and improve the platform, and to communicate with you about it), balanced against your rights; your consent (for example, for certain marketing communications or non-essential cookies, where required); and compliance with legal obligations. Where we rely on consent, you may withdraw it at any time.

5. Cookies and Analytics

We use cookies and similar technologies for essential purposes (such as keeping you signed in and maintaining security) and for analytics. We use a third-party product-analytics provider (PostHog) to understand aggregate usage — for example, visitor counts and device types — so we can improve the platform. Analytics data is used in aggregate and is not used to build advertising profiles about you, and we do not sell your data to advertisers. You can control non-essential cookies through your browser settings; disabling essential cookies may prevent parts of the platform from functioning.

6. Third-Party Service Providers (Sub-Processors)

We share personal data with a limited set of trusted service providers who process it on our behalf and under contract, only as needed to operate the platform. These include: our application hosting and backend platform (Base44); our product-analytics provider (PostHog); our email delivery provider (Resend); a third-party authentication provider where you choose to sign in with it (such as Google); a third-party payment processor for purchases; and large-language-model providers that generate AI explanations and power our research assistant. Financial market data displayed on the platform is sourced from third-party data providers; that data is not personal to you. We require these providers to protect your data and to use it only for the services they provide to us.

7. AI-Assisted Features

Certain features — including our "Shorty" research assistant and the cached company, rationale, risk, and "Worth Knowing" summaries shown on stock cards — are generated using large-language-model technology applied to financial data. Questions you submit to the research assistant are sent to a large-language-model provider to produce a response. AI-generated content is provided for information only, may contain errors or omissions, and is not investment advice. Please also see the data-accuracy disclaimers in our Terms & Conditions.

8. Email Communications and Your Choices

We send transactional and service emails necessary to operate your account. Where permitted, we also send product, onboarding, and notification emails. Every non-essential email includes an unsubscribe link, and you can manage your email preferences at any time through the preference options provided in our emails. Unsubscribing from marketing or notification emails does not stop essential transactional messages (for example, security or account-critical notices).

9. How We Share Information

We do not sell your personal data, and we do not share it with third parties for their own independent marketing. We disclose personal data only: to the service providers described in Section 6; to comply with applicable law, legal process, or a lawful government request; to enforce our Terms or protect the rights, property, or safety of the platform, our users, or others; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this Policy or notify you as required by law.

10. Data Retention

We retain personal data for as long as your account is active and for as long as necessary to provide the platform, comply with our legal obligations, resolve disputes, and enforce our agreements. Certain analytics and log records may be retained in aggregated or de-identified form. When personal data is no longer needed, we delete or anonymise it. If you close your account or request deletion, we will delete or de-identify your personal data within a reasonable period, subject to any retention required by law.

11. Data Security

We implement reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, or alteration. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential; please notify us promptly if you believe your account has been compromised.

12. Your Rights

Depending on your location, you may have rights over your personal data, including the right to: access the data we hold about you; correct inaccurate data; request deletion of your data; object to or restrict certain processing; withdraw consent where processing is based on consent; and request a copy of your data in a portable format. Residents of the EEA/UK (under the GDPR) and of certain U.S. states (such as California under the CCPA/CPRA) may have additional rights, including the right not to receive discriminatory treatment for exercising them. To exercise any of these rights, contact us using the details in Section 16. We will respond within the timeframes required by applicable law and may need to verify your identity first.

13. International Data Transfers

We operate from Israel and use service providers that may process data in other countries, including the United States and the European Union. Where personal data is transferred across borders, we take steps intended to ensure it receives an adequate level of protection in accordance with applicable law, such as relying on recognised transfer mechanisms where required.

14. Children’s Privacy

The platform is intended solely for individuals aged 18 years or older. We do not knowingly collect personal data from anyone under 18. If we become aware that we have collected personal data from a person under 18, we will delete it. If you believe a minor has provided us with personal data, please contact us.

15. Third-Party Links

The platform may contain links to third-party websites or services (for example, external data sources, feedback forms, or authentication providers). We are not responsible for the privacy practices or content of those third parties. We encourage you to review the privacy policies of any third-party services you access.

16. Contact Us

If you have questions about this Privacy Policy, wish to exercise your rights, or want to request deletion of your account and associated data, contact us at support@shortliststocks.com.

17. Governing Law

This Privacy Policy is governed by the laws of the State of Israel, without regard to its conflict of law provisions, consistent with the Governing Law and Jurisdiction section of our Terms & Conditions. This does not deprive you of any protection you are entitled to under the mandatory law of your country of residence.

18. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the revised Policy on this page with an updated effective date. Material changes will be communicated where required by law. Your continued use of the platform after an updated Policy is posted constitutes your acceptance of the changes.

This Privacy Policy is provided for transparency about our data practices and does not create any rights beyond those granted by applicable law. If any conflict arises between this Policy and applicable mandatory law, that law governs.