Privacy Policy
Last updated: 3 November 2026
Who we are
MarketGraphs Ltd, company number 17285514, registered office in London E14 9BF, England. We run the website market-graphs.com, the Praxis research library and its connector for AI assistants at mcp.market-graphs.com, and the newsletter. MarketGraphs Ltd is the data controller for the personal data described on this page. Registration with the Information Commissioner's Office (ICO): ZC271157.
Questions about this policy, and every request about your data: alex@market-graphs.com.
What we hold
It depends on what you do with us.
- Newsletter subscribers. Your email address, the campaign tags of the link you arrived by (for example
utm_source=instagram), and, if you answer it, one optional question about who you are. Answering is optional and the answer can be changed. - Praxis readers on the website. Your email address and an access token on our own server, so that a seat request or a referral you make can be attributed to you.
- Praxis accounts, free and paid. The account id, organisation id and email address that WorkOS passes to us at sign-in, your plan, the interests you save, and the shares you make. A share is a snapshot, kept for 90 days, opened only by signed-in members of your organisation, and you can revoke it at any time. If you upload a paper on the paid plan we keep the file until its record is built, then delete it, and keep its name and size.
- One line per tool call. The time, your account, the tool, the paper ids, the outcome and how long it took. We never keep your words, your conversation or the model's answers.
- Sign-in events. Sign-ins and failed sign-ins, with the time, the path, the result and the IP address they came from.
- Buyers of a reproduction package. Your email address, the paper, the licence issued, the download link sent to you and the payment reference from Stripe. Card details never reach us.
- Visitors. Page views counted with a pseudonymous identifier made from a hash that changes every day. Your IP address is not stored, no cookie is set, and visits cannot be linked from one day to the next. Named automated crawlers are logged by their user agent.
- Authors of papers in the library. See the section on authors below.
How long we keep it
| What | How long |
|---|---|
| Tool-call lines | 90 days, then only anonymous totals per tool and per paper |
| Sign-in events, with the IP address | 12 months |
| Praxis account data | While you are subscribed, then 30 days |
| A share | 90 days, or until you revoke it |
| An uploaded paper | Until its record is built |
| Newsletter email address | Until you unsubscribe, then a hashed suppression token for 12 months so that we do not email you again |
| Praxis reader token | While you remain a reader, deleted on request |
| Payment and licence records | 6 years, as UK company records |
| Backups | A copy of the database is kept for up to 5 weeks, so data you have deleted can remain in a backup for that long |
| Page-view counts | Kept as counts, with nothing that identifies you |
Why we hold it, and the legal basis
- Consent (Article 6(1)(a) of the UK General Data Protection Regulation, UK GDPR) for the newsletter and product updates. Withdraw it at any time with the unsubscribe link in any email.
- Contract (Article 6(1)(b)) for running your account, a trial, a subscription, and delivering a purchase.
- Legitimate interest (Article 6(1)(f)) for the security and sign-in logs, abuse prevention, aggregate audience statistics, and describing published research, which is what we hold about authors.
- Legal obligation (Article 6(1)(c)) for payment and accounting records, and for the UK financial-promotion rules. We keep the source a subscriber came from to show that the site operates outside the regulated perimeter (Articles 17 and 20 of the Financial Promotion Order, FPO, and the Financial Conduct Authority's Perimeter Guidance manual, PERG 8.30).
Who else handles it
These companies process data on our instructions. No one else sees it. We do not sell personal data.
| Company | What it does for us | Where |
|---|---|---|
| Hetzner Online GmbH | Server and database | Germany |
| Cloudflare, Inc. | File storage and encrypted backups | European Union, Eastern Europe region. A United States company |
| WorkOS, Inc. | Sign-in for Praxis accounts | United States |
| Amazon Web Services | Runs the AI models that read paper text | London region |
| Netlify, Inc. | Website hosting | United States |
| Beehiiv Inc. | Newsletter | United States |
| Stripe | Payments | Ireland and United States |
| Resend, Inc. | Account and purchase emails | United States |
Each of them processes data under its standard data processing agreement with us. Where the company is outside the United Kingdom, the transfer rests on the UK's standard data transfer terms or on the company's certification under the UK-US data bridge. Copies of the agreements on request.
The AI models
AI models running on Amazon Web Services in London read paper text and help fill a paper's record. The models see the paper, never your account, your organisation, your words or your usage. Every record names the model that helped, and anything a model wrote is marked as such.
Authors of papers in the library
For each paper the library describes, we hold the authors' names and affiliations, the title, the abstract, the publication details and links to the original, all taken from public sources such as the publisher's page, OpenAlex, arXiv, RePEc and Crossref. We hold them to describe published research, under legitimate interest (UK GDPR Article 6(1)(f)). We never serve a paper's text.
What we publish about a paper is our own description of it, its classification, the facts its abstract states, one quoted sentence, and, where the licence allows, a record of how the strategy works with short attributed quotes. Nothing a model helped write goes out unmarked.
If you are an author and want a record about you corrected, your paper described from its abstract only, or you object to it being described at all, write to alex@market-graphs.com. We answer within 30 days.
How we protect it
All traffic travels over HTTPS with TLS (Transport Layer Security) 1.2 or newer. Sign-in runs through WorkOS, so we hold no passwords. The library is read through two read-only database roles, one per plan, and every account has a cap on calls per minute. The logs are append-only. Every file on the server is listed in a manifest and checked against it. An encrypted copy of the database goes to a separate provider each night and a restore is tested monthly. Access to personal data: the founder only.
Cookies and browser storage
The website sets no cookies and runs no third-party analytics or tracking scripts. Your browser keeps a few values for itself: your theme choice, the campaign tags within a session, and, for Praxis readers, the access token. Signed-in pages on mcp.market-graphs.com set one signed session cookie that holds your account and organisation ids for the length of the session.
Your rights
Under UK GDPR and EU GDPR you have the right to:
- Access your personal data.
- Correct inaccurate data.
- Delete your data.
- Withdraw consent at any time.
- Object to processing based on legitimate interest.
- Receive your data in a structured format.
- Complain to the ICO at ico.org.uk or to your local supervisory authority.
To use any of these rights, email alex@market-graphs.com. We respond within 30 days.
California residents (CCPA)
If you are a California resident you have the right under the California Consumer Privacy Act (CCPA) to know what personal information we collect, to request its deletion, and to opt out of its sale. We do not sell personal information. Requests go to alex@market-graphs.com.
Children
MarketGraphs is not directed at people under 18 and we do not knowingly collect data from them. If you believe a minor has given us data, tell us and we delete it.
Changes to this policy
We update this page when something changes. A material change goes by email to subscribers and account holders. The date at the top is the last revision.