Privacy Policy

FirmScopes ("we", "us", "our") operates the website firmscopes.com. We are committed to protecting your privacy and handling your personal data transparently and lawfully in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

If you have any questions about this policy or your data, contact us at: contact@firmscopes.com

We collect the following categories of personal data:

We process your data under the following legal bases:

• ConsentWhen you create an account, submit a review, fill in a form, or accept analytics cookies, you consent to that processing for the stated purpose. You can withdraw consent at any time — for analytics, via 'Cookie settings' in the footer.
• Legitimate interestWe log anonymised, aggregated technical data (hashed, no cookies) to keep the site secure, prevent abuse, and monitor performance. Cookie-based analytics run only with your consent (above).
• ContractIf you create an account, processing your data is necessary to provide you with the service (personalised recommendations, saved preferences, review history).

We use your data to:

• Provide and maintain your account
• Personalise firm recommendations based on your trading preferences
• Display your reviews on firm pages (email is never shown)
• Send you firm recommendations if you opted in via the lead capture form
• Improve our site and services through anonymised analytics
• Prevent fraud and abuse

We do NOT:

• Sell your personal data to third parties
• Share your email address with prop firms or brokers
• Send you marketing emails without your explicit consent
• Use your data for automated decision-making that affects you

Your data is stored on Supabase (our database provider), which uses Amazon Web Services (AWS) infrastructure. Data may be stored in the EU (Frankfurt) or US depending on Supabase's infrastructure. Supabase complies with SOC 2 Type II standards and encrypts data at rest and in transit.

Where data is transferred outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

• Account dataUntil you delete your account
• Trading preferencesUntil you delete your account or update them
• ReviewsIndefinitely while published; deleted if you request removal
• Lead capture submissions12 months, then deleted
• Analytics/technical data90 days (anonymised)
• CookiesSee Section 8

Under UK GDPR, you have the following rights:

• AccessRequest a copy of all personal data we hold about you.
• RectificationAsk us to correct inaccurate data. You can also update your profile directly.
• ErasureAsk us to delete your account and all associated data ('right to be forgotten').
• PortabilityRequest your data in a machine-readable format.
• Withdraw consentWithdraw consent for any processing based on consent, at any time.
• ObjectObject to processing based on legitimate interests.
• ComplaintLodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your rights have been violated.

To exercise any of these rights, email us at contact@firmscopes.com. We will respond within 30 days.

We use the following cookies:

Google Analytics cookies are set only if you accept analytics cookies in our cookie banner. If you decline, or ignore the banner, no analytics cookies are set and no analytics data is collected. You can change or withdraw your choice at any time via Cookie settings in the footer.

We also run a Meta (Facebook) pixel, which is an advertising cookie and tracking pixel. It loads on the same consent — if you decline, or ignore the banner, it never loads and Meta receives nothing at all. When it is loaded, it tells Meta that a visit turned into a click through to a prop firm, which is how we judge whether an ad was worth running. We do not send Meta your name, email or any account details, and we never sell your data.

Pageview counting

We count page views ourselves, on our own servers, so that we know how many people use FirmScopes and which sources send them. This runs whether or not you accept cookies — because it uses no cookies at all. Nothing is stored on your device and nothing is read from it. We record:

• The page you opened (e.g. /rankings)
• The website that sent you — the domain only, such as instagram.com or google.com. We deliberately do not keep the full address you came from, because that can contain search terms and other personal details.
• Campaign tags (utm_source, utm_medium, utm_campaign) when one of our own ads or links added them
• The time of the visit, and whether the request came from a bot
• An anonymised hash of your IP address, salted with the day, so a visitor counts once per day. The raw IP is never stored and the hash rotates daily — it cannot be used to recognise you tomorrow, or on any other website.
• An anonymised hash of your browser's user-agent string
• Your cookie-banner choice (accepted, declined, or not yet chosen), so we can see what proportion of visitors Google Analytics is permitted to measure

Why we do this. Google Analytics only runs for visitors who accept cookies, which is a minority of them — so it cannot tell us how many people actually use the site, or whether an ad we paid for sent anyone. This count can. It is the same approach we already use for outbound clicks, below.

Where it goes. Nowhere. These counts stay in our own database, are used only in aggregate, and are never sent to Google, Meta, any advertising network, or any other third party. Because no information is stored on or read from your device, this does not require cookie consent; we rely on our legitimate interest in understanding how our own site is used. You can object at any time using the contact details in Section 12.

Outbound click logging

When you click a "Visit firm" or "Scope" button on FirmScopes, the click is routed through our server (at firmscopes.com/go/<firm> ) so we can count outbound clicks per firm. We log:

• The firm slug (e.g. ftmo)
• The page you clicked from (e.g. rankings, firm detail, compare)
• The time of the click
• An anonymised hash of your IP address, salted with the day, so a visitor counts once per day. The raw IP is never stored and the hash rotates daily — it cannot be used to track you across days.
• An anonymised hash of your user-agent string

We use these counts internally for product analytics and share aggregate per-firm totals with prop firms during partnership negotiations (e.g. "FirmScopes sent FTMO 1,847 clicks last month"). We never share per-user data. The server-side log itself sets no cookie and involves no third party.

We also give the click a reference of our own — a random string like fs_a8k2m9x4qz — and pass it to the firm on the link. It is not derived from anything about you: it is a parcel-tracking number for one click. If you later buy something, the firm can tell us that a purchase happened against that reference, which is how we get paid and how we find out which of our pages and ads are worth running. Alongside it we store the campaign labels from your fs_attr cookie (above) and the page you arrived on.

Only if you accepted cookies, and only on that record, we also store your IP address and browser user-agent in full, plus Meta's _fbp / _fbc cookie values — because Meta requires them to recognise a sale as belonging to an ad click. If you declined, or ignored the banner, all five of those fields are left empty at the moment the click is recorded, so there is nothing stored to send later. This is separate from the click count described above, which is hashed and holds no advertising identifiers at all.

Also only if you accepted cookies: the click is reported to Meta as a conversion, and so is any sale that follows from it, so we can tell which of our ads actually send people to a firm rather than just to the homepage. Meta is told that a click-through or a purchase happened and what we earned — not who you are. If you declined cookies, this does not happen and no advertising network sees your click.

We also append utm_source=firmscopes, and the name of the campaign that brought you here if there was one, to outbound URLs so the destination firm's own analytics can verify the traffic came from us and which of our channels it came through. This is a standard referral marker; no personal data is included.

We use the following third-party services that may process your data:

• Supabase — Database and authentication. Privacy policy
• Vercel — Website hosting. Privacy policy
• Google (OAuth) — Sign-in via Google (only if you choose this option). Privacy policy
• Google Analytics — Anonymised website-usage analytics — loaded only after you accept analytics cookies. Privacy policy
• Meta (Facebook) — Advertising measurement — told when a visit becomes a click through to a prop firm, so we can judge our ads. Loaded only after you accept cookies. Privacy policy

FirmScopes is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify users via email or a prominent notice on the site. The "Last updated" date at the top of this page indicates when the policy was last revised.

For any privacy-related questions, requests, or complaints:

Email: contact@firmscopes.com

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk