Legal

Privacy Policy

Last updated: 27 July 2026

This Privacy Policy explains how BlockPhi (“BlockPhi”, “we”, “us”, or “our”) collects, uses, shares, and protects personal data when you visit www.blockphi.com or analytics.blockphi.com, use our account or member services, subscribe to our research, engage with our community, or otherwise interact with us (collectively, the “Services”).

1. Who we are and how to contact us

BlockPhi is an investment analytics firm operating the Services. For the purposes of the EU and UK General Data Protection Regulation (“GDPR”), BlockPhi acts as the data controller of personal data processed through the Services, except where a third party acts as an independent controller under its own privacy policy.

For any question about this Privacy Policy or about your personal data, contact contact@blockphi.com.

2. Scope of this Privacy Policy

This Privacy Policy applies to the BlockPhi websites, account and member areas, analytics services, contact forms, newsletters, private community, and related communications. It does not replace the privacy policies of third-party services such as Whop, Discord, Substack, X, YouTube, Medium, or other services that you choose to use. Those parties may process personal data for their own purposes under their own terms and privacy policies.

3. Personal data we collect

3.1 Information you provide directly

  • Contact and correspondence data, including your name, email address, subject line, message content, support requests, and other communications that you send to us.
  • Membership and account data, including your Whop account identifiers, username, email address, membership tier, membership status, purchase, renewal, refund and application information, and any referral or affiliate information associated with your membership. Whop and its payment providers handle payment-card details; BlockPhi does not store full payment-card details.
  • Community data, including your Discord username or identifier, messages, posts, reactions, moderation history, and other activity in the BlockPhi community.
  • Newsletter and marketing data, including your email address, subscription status, preferences, and engagement with communications delivered through Substack or another authorised provider.
  • Member and analyst submissions, including portfolios, frameworks, systems, code, files, screenshots, journal entries, profile information, and other material that you choose to upload or publish through the Services.
  • Feedback and survey data, including testimonials, reviews, survey answers, suggestions, and other voluntary feedback.

3.2 Information collected automatically

  • Technical and security data, including IP address, user-agent string, browser type, operating system, device and connection information, language, approximate location derived from IP address, requested URL, referrer URL, timestamps, error data, and security events.
  • Authentication and preference data, including session and authentication cookies, membership-verification information, and your stored cookie-preference selection.
  • Website usage and performance data, including page views, navigation events, button or conversion events, page performance, and aggregated usage statistics collected through Vercel Web Analytics and Speed Insights.
  • Whop analytics and attribution data, including page and conversion events, referral or campaign information, and a device or browser identifier used by Whop’s analytics and attribution technology to recognise returning visitors.
  • X advertising-measurement data, including page views, conversion events, X click identifiers where available, IP address, user-agent and device or browser information transmitted through the X advertising pixel.
  • Video usage data, including playback events, device information, approximate location and performance information when you play videos delivered through Mux, YouTube, or another video provider.

3.3 Information received from third parties

We may receive personal data from Whop, Discord, Substack, affiliate or referral partners, advertising platforms, and other providers used to operate the Services. This may include membership status, payment or refund confirmation, account identifiers, referral information, community identifiers, newsletter status, and advertising or conversion information. We may combine this information with data collected directly through the Services.

4. How we use personal data

  • Provide and administer the Services, including creating and managing accounts, verifying membership, granting tier-specific access, operating the private community, and delivering research, analytics, frameworks, and related features.
  • Process memberships and payments, including applications, purchases, renewals, cancellations, refunds, disputes, tax and accounting records, and customer support relating to transactions.
  • Communicate with you, including responding to enquiries, sending service notices, security messages, membership information, and newsletters or marketing communications where permitted.
  • Operate, analyse and improve the Services, including measuring website use, performance, reliability, content engagement, conversion paths, and the effectiveness of campaigns.
  • Advertising and attribution, including measuring whether advertising resulted in a visit, application, registration, or purchase and improving the relevance and effectiveness of our campaigns.
  • Security and enforcement, including preventing fraud, abuse, account sharing, unauthorised access, scraping, redistribution of paid material, and violations of our Terms of Service or EULA.
  • Legal and business administration, including complying with legal, tax, accounting and regulatory obligations, resolving disputes, protecting legal rights, and conducting internal administration.

5. Legal bases for processing

Where the GDPR applies, we process personal data on one or more of the following legal bases:

  • Performance of a contract where processing is necessary to provide the Services you requested, administer your membership, verify access, process cancellations or refunds, or enforce the agreements governing the Services.
  • Legitimate interests in operating, securing, measuring and improving the Services, preventing fraud and misuse, communicating with users, maintaining business records, protecting our rights, and measuring advertising effectiveness, provided those interests are not overridden by your rights and freedoms.
  • Consent where you subscribe to optional marketing communications, choose to load optional third-party content, or where applicable law requires consent for a cookie, device identifier, fingerprinting technology, or advertising technology. You may withdraw consent at any time without affecting processing that occurred before withdrawal.
  • Legal obligations where processing is necessary to comply with tax, accounting, consumer-protection, court-order, regulatory, or other legal requirements.

Where a third party acts as an independent controller, that third party determines its own legal bases for processing under its privacy policy.

6. Cookies, pixels and similar technologies

The Services use cookies, local storage, pixels, device identifiers, and similar technologies for the purposes described below:

  • Strictly necessary technologies support authentication, security, session management, stored preferences, access control, and checkout functionality.
  • Vercel Web Analytics and Speed Insights provide aggregated website-usage and performance information. Vercel Web Analytics is designed not to use personal identifiers to track users across different websites or applications.
  • Whop analytics and attribution pixel measures visits, referrals and conversions and may use device-fingerprinting or similar technology to recognise a browser or device.
  • X advertising pixel measures page visits and advertising conversions and may enable X to connect activity on the Services with information it holds under its own privacy policy and settings.
  • Google Analytics measures how visitors reach and move through the Services. It runs under Google Consent Mode, so in regions where consent is required it is set to denied until you accept.
  • Meta (Facebook) advertising pixelrecords page visits so that we can reach visitors again with advertising on Meta's platforms. Meta may connect that activity with information it already holds about you, under its own privacy policy and settings.
  • Reddit advertising pixel measures page visits and advertising conversions for the same purpose on Reddit, and Reddit may likewise combine it with information it holds under its own policy.
  • Embedded third-party content such as videos, articles, newsletter widgets, charts, or checkout components may set cookies or collect data when loaded or used.

You can review or change your cookie preference at any time: .

7. How we share personal data

We do not sell personal data for money. We disclose or make personal data available only as described below:

  • Service and infrastructure providers, including Vercel for hosting, analytics and performance monitoring; Whop for membership, billing, authentication, access control and attribution; Supabase for database and backend services; Resend and Google Workspace for communications and administration; Discord for the community; Substack for newsletters; Mux and YouTube for video delivery; Medium for embedded or linked research; Modal and other infrastructure providers for hosted computation and automation; and security, monitoring, storage, rate-limiting or support providers used to operate the Services.
  • X, Meta and Reddit, to receive limited online identifiers and page or conversion events for advertising measurement and for reaching visitors again with advertising on their platforms. Depending on the applicable law, this may be treated as “sharing” for cross-context behavioural advertising even though we do not sell personal data for money. Each of them acts as an independent controller for what it receives, under its own privacy policy, and not on our instructions.
  • Google, for Google Analytics measurement of how visitors reach and use the Services.
  • Legal and regulatory recipients where disclosure is required by law, court order, lawful government request, or reasonably necessary to protect the rights, safety, security, or property of BlockPhi, our users, or others.
  • Business transfers in connection with a merger, acquisition, financing, reorganisation, insolvency, or sale or transfer of all or part of the business or its assets.
  • With your direction or consent where you ask us to disclose information or otherwise authorise the disclosure.

8. Third-party services and independent controllers

Some third parties, including Whop, Discord, Substack, X, Google/YouTube, Medium and certain payment providers, may act as independent controllers for some of the personal data they process. Their processing is governed by their own privacy policies and settings. BlockPhi is not responsible for the privacy practices of an independent third party.

9. International data transfers

BlockPhi operates from the European Union, but many service providers process data in the United States or other countries outside the European Economic Area, the United Kingdom, or Switzerland. Where required, international transfers are based on an adequacy decision, the European Commission Standard Contractual Clauses, the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may contact us for further information about the safeguards relevant to a transfer of your personal data.

10. Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, taking into account the nature of the data, the purpose of processing, technical requirements, legal obligations, limitation periods, disputes, and security needs. Our general retention approach is:

  • Contact and support correspondence: generally up to 24 months after the matter is closed, unless a longer period is needed for a dispute or legal obligation.
  • Membership and transaction records: for the duration of the membership and generally up to 7 years afterwards where needed for tax, accounting, fraud prevention, or legal claims.
  • Account and member submissions: for as long as the account or relevant feature remains active and for a reasonable period afterwards, unless you delete the material earlier or a longer period is required to protect legal rights or comply with law.
  • Newsletter data: until you unsubscribe, after which a limited suppression record may be retained to record and respect the opt-out.
  • Raw server and security logs: generally up to 90 days, unless retained longer to investigate a security incident, fraud, abuse, or legal claim.
  • Cookie and preference records: generally up to 12 months or until you change the preference, after which we may ask you to choose again.
  • Analytics and advertising data held by third parties: according to the applicable provider settings and retention policies.

We may retain anonymised or aggregated information that can no longer reasonably identify you for longer periods.

11. Your rights under European and UK data-protection law

Subject to applicable law, you may have the right to:

  • Access the personal data we hold about you and obtain information about its processing.
  • Correction of inaccurate or incomplete personal data.
  • Erasure of personal data in circumstances provided by law.
  • Restriction of certain processing.
  • Object to processing based on legitimate interests and to processing for direct marketing. Where you object to direct marketing, we will stop using your personal data for that purpose.
  • Data portability where processing is based on consent or contract and carried out by automated means.
  • Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
  • Complain to the relevant Data Protection Authority or to the supervisory authority in the country of your habitual residence, place of work, or place of the alleged infringement.

12. California and other United States privacy rights

Where applicable United States privacy law, including the California Consumer Privacy Act as amended, applies to BlockPhi, residents may have rights to know or access personal information, request deletion or correction, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive equal service and pricing when exercising privacy rights.

BlockPhi does not sell personal information for money. The disclosure of limited online identifiers and conversion events to X for advertising measurement may be classified as “sharing” under California law. Our website does not currently differentiate responses to browser Do Not Track or Global Privacy Control signals. You may submit an opt-out or other privacy request by emailing contact@blockphi.com. You may also adjust the privacy and advertising settings offered by X and your browser or device.

13. How to exercise your rights

Email contact@blockphi.com and describe the right you wish to exercise. We may request information reasonably necessary to verify your identity and protect your account. We will respond within the period required by applicable law. Under the GDPR, this is generally within one month, subject to any lawful extension for complex or numerous requests.

You may use an authorised agent where permitted by law. We may request evidence of the agent’s authority and may still need to verify your identity directly.

14. Marketing communications

We send optional marketing communications, such as newsletters, only where permitted by law. You can unsubscribe using the link in the message, through the relevant provider, or by emailing contact@blockphi.com. We may continue to send non-marketing communications that are necessary to administer your account, membership, security, or transactions.

15. Children’s privacy

The Services are intended only for persons aged 18 or older. We do not knowingly collect personal data from children. If you believe that a child has provided personal data to us, contact contact@blockphi.com and we will take appropriate steps to investigate and delete the information where required.

16. Security

We use technical and organisational measures appropriate to the nature of the personal data and the risks involved. These measures may include HTTPS/TLS, access controls, server-side membership verification, restricted administrative access, authentication cookies with security protections, monitoring, and backups where available. No method of transmission, processing, or storage is completely secure, and we cannot guarantee absolute security.

17. Personal-data breaches

If a personal-data breach occurs, we will assess the risk and make any notification to supervisory authorities or affected individuals required by applicable law. Where the GDPR applies and a breach is likely to result in a risk to individuals’ rights and freedoms, the competent supervisory authority will be notified without undue delay and, where feasible, within 72 hours after we become aware of it.

18. Automated decision-making

BlockPhi does not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significant effects on you. Certain access-control and security functions are automated, such as verifying your Whop membership status or detecting suspicious activity, but material account actions may be reviewed where appropriate.

19. Third-party links and embedded content

The Services may link to or embed content from third parties. When you follow a link, play embedded media, use an embedded checkout, or interact with a third-party feature, that third party may collect personal data under its own privacy policy. Review the relevant third-party policy before providing information or using the feature.

20. Nothing here is investment advice

All content on the Services is educational and informational only. Nothing is financial, investment, legal, or tax advice. Past performance is not indicative of future results. Do your own research and consult a qualified professional before making investment decisions. See our Terms of Service for the investment-risk disclosures.

21. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, technology, providers, legal requirements, or our data practices. We will publish the revised version with a new “Last updated” date and, where required by law, provide additional notice or request renewed consent.

22. Contact

For questions, privacy requests, or complaints concerning this Privacy Policy or our processing of personal data, email contact@blockphi.com.