1. Who operates RatesLab
RatesLab is a financial technology and educational analytics platform. The registered name and address of the legal operator (data controller, where applicable) responsible for the processing described here are being verified. These details, and a dedicated privacy email address, will be published once confirmed. In the meantime, please contact RatesLab through the original channel used for your account invitation or other official correspondence.
The applicable data protection framework depends on the identity and establishment of the operator, where the processing takes place and the individuals served. If a DIFC entity becomes the controller, its obligations under the DIFC Data Protection Law No. 5 of 2020, as amended, will need to be assessed and the applicable Commissioner notification completed. UK data protection requirements may also apply depending on the operator and service activities.
2. Personal information we process
- Account and identity: email address, Supabase-generated account ID, invitation/login details and account status. Supabase processes authentication credentials; RatesLab does not need to display passwords to website administrators.
- Simulation information: selected Core or Defensive profile, starting capital, selected modeled drawdown budget, chosen scenario, simulation dates, simulated valuations, returns, drawdowns and lifecycle/audit events.
- Client reporting: generated Simulation Lab report event metadata. Advisor Workspace investment briefs and optional client reference/notes are intended to stay in the current browser tab and are not submitted to a RatesLab account database by that workspace.
- Technical information: IP address, user agent, approximate network location, page requests, security events and diagnostics that may be processed by our hosting, authentication and delivery providers.
- Local preferences: investment amount, active simulation preference and persisted login session information stored by the browser.
We do not ask for brokerage passwords, payment-card details, bank-account credentials or special-category personal data for these educational tools. Please do not include sensitive personal information in free-text fields.
3. Purposes and lawful bases
We process the information needed to provision an invited account, authenticate access, store and display an educational simulation, supply requested reports, respond to enquiries, prevent misuse, protect the platform and meet applicable legal obligations.
Where a lawful basis is required, the proposed bases include performance of a service contract (account access and requested functions), legitimate interests (security, diagnostics and service integrity), legal obligations (where recordkeeping is required) and consent for optional processing where applicable. The operator must formally validate and document the bases for each purpose before publishing this draft as final.
Account credentials and a minimum of associated technical data may be necessary to access authenticated services. Public educational pages may be viewed without creating an account.
4. Technology providers and recipients
Platform delivery currently uses Cloudflare for website delivery and restricted administration access; Supabase for invited-user authentication, database records and server-side report generation; and GitHub for the platform source and deployment workflow. Some pages load JavaScript from the jsDelivr content-delivery network. Providers may process technical connection information while delivering these services.
Supabase production infrastructure is currently provisioned in the ap-northeast-1 region. Cloudflare and CDN traffic may be processed through internationally distributed infrastructure. This notice will be updated to reflect verified provider arrangements and any additional analytics services enabled outside the source repository.
We do not describe model-simulation results as connected to a user's live brokerage account. We do not sell account records or simulation data to advertisers.
5. International transfers
Personal information may be transmitted to or accessed in countries other than the country in which a user resides, because infrastructure and service providers operate internationally. If the relevant law requires an adequacy determination, contractual safeguards or an applicable transfer exception, the operator must verify and document it. This notice does not assert that any specific safeguard has been established for every transfer.
6. Retention and deletion
Invited accounts and associated simulation records are retained while the account and educational service are needed, subject to applicable legal and operational requirements. The platform maintains append-only or hash-chained valuation and audit records intended to preserve data integrity; this does not override applicable privacy rights.
Requests to close an account or delete personal information will be assessed against security, record-integrity and legal-retention obligations. Where appropriate, records may be deleted, anonymised or disassociated from an identified user. A written retention schedule with specific periods or justified criteria for each data category is being established; further detail will be published once verified.
7. Security controls
Current application design uses signed-in user checks, Supabase row-level security for user-owned simulation records, restricted administration controls, service-role operations for privileged ingestion and additional protections for private model inputs. Security measures lower risk but cannot guarantee that a system will never be compromised.
The operator should periodically review cloud-provider security settings, database privileges, breach response, backups and authentication configuration. No user should share login credentials with others.
8. Your rights and choices
Depending on the applicable law and processing circumstances, you may have rights to be informed; request access, correction, deletion or portability; restrict or object to certain processing; withdraw consent where consent is the basis; and complain to a relevant data protection regulator. Rights may be subject to lawful exceptions.
Right to object: where processing is based on legitimate interests, you may object as permitted by the applicable law. To exercise rights, use the established contact channel through which your RatesLab account invitation or operator communication was provided. A dedicated privacy email address will be added when it has been verified.
Where DIFC law applies, eligible individuals may contact the DIFC Commissioner of Data Protection; where UK GDPR applies, eligible individuals may contact the UK Information Commissioner's Office.
10. Automated analytics and decisions
RatesLab runs deterministic and scenario-based calculations in educational simulation tools. It does not use those hypothetical results to make legally binding automated decisions about a user's credit, employment or eligibility for financial products. Users should not infer investment suitability from a displayed risk/return comparison.
11. Changes and contact
This notice was first published on 9 October 2026. Material changes to processing may require additional notice or consent under applicable law. The verified operator details, privacy contact, retention schedule and applicable cross-border safeguards will be incorporated as they are confirmed.