Privacy Policy

Last updated: 27 September 2026

This policy explains what personal information Bankrolled collects when you visit bankrolled.com, why we collect it, who we share it with, how long we keep it and what your rights are. It also explains how we use cookies and similar technologies. We have tried to write it in plain English. If anything is unclear, please ask us using the contact details below.

1. Who we are

Bankrolled is a trading name of CLYFAR LTD, a private limited company registered in England and Wales (Companies House number 08922294). CLYFAR LTD is the data controller for the personal information described in this policy. In this policy, “Bankrolled”, “we”, “us” and “our” mean CLYFAR LTD trading as Bankrolled.

  • Registered office: 1 Market Hill, Calne, Wiltshire, SN11 0BT, United Kingdom
  • Privacy contact: privacy@bankrolled.com
  • ICO registration number: ZC259271

Bankrolled is an editorial publication. We do not give personalised financial advice, and we do not ask you to create an account.

2. What we collect, why, and our lawful basis

UK data protection law (the UK GDPR and the Data Protection Act 2018) requires us to have a lawful basis for each use of personal information. The main bases we rely on are consent, where you have given clear permission, and legitimate interests, where we have a reasonable business reason that does not override your rights. Where we rely on legitimate interests, you can object at any time (see “Your rights” below).

Contact form

If you use the form on our contact page, we collect your name, your email address, the subject and your message. We also receive the technical details any web request carries, such as your IP address. The form is built with WPForms, a WordPress plugin that runs on our own website. Your message is delivered to our email inbox, and our website may also store a copy. We use this information only to read and reply to your message and to keep a record of our correspondence.

Lawful basis: legitimate interests (responding to people who contact us). If your message is about something you want from us, such as a correction or a partnership, we also rely on taking steps at your request.

Newsletter (Beehiiv)

If you sign up for our newsletter, we collect your email address. Our sign-up form and mailing list are provided by Beehiiv. The form appears on our pages inside a small embedded frame that Beehiiv serves. We use a confirmation (double opt-in) process, so you will only be added once you confirm your address. Beehiiv also records basic information such as where you signed up, when, and whether our emails are opened or clicked. We use this to send the newsletter and to understand which content readers find useful. Every newsletter includes an unsubscribe link.

To protect its forms from spam and automated abuse, Beehiiv uses security services inside the form frame, including Cloudflare and HUMAN Security. These can set their own cookies on Beehiiv’s domain (see the cookie table below).

Lawful basis: consent. You can withdraw it at any time by unsubscribing or by emailing us.

Website analytics (Google Analytics 4)

We use Google Analytics 4, added to the site through Google’s Site Kit plugin for WordPress, to understand how our website is used. Google Analytics uses cookies to record things like the pages you visit, how long you stay, how you arrived (for example, from a search engine or a link), your approximate location (country or city), and your device, browser and screen size. Google states that Google Analytics 4 does not log or store IP addresses.

We also record a small number of specific interactions as analytics events:

  • wise_cta_click: when you click one of our links to Wise. This records the link, the page address and the page title.
  • Listen (text-to-speech) events: tts_play_start, tts_play_progress, tts_play_complete and tts_play_stop. These are recorded when you use the Listen button on articles that have one. They record the page, the article ID, the length of the text and roughly how far through you listened.
  • Site Kit’s standard events, such as a note that a contact form was submitted. The contents of your message are not sent to Google Analytics.

We see this information in aggregated reports. We do not use Google Analytics to identify individual visitors.

Lawful basis: legitimate interests (understanding and improving our website), together with consent where the law requires it for analytics cookies.

Cookieless visitor statistics (Ahrefs and Cloudflare Web Analytics)

We also use Ahrefs Web Analytics and Cloudflare Web Analytics to count page views and see which pages and referring sites are popular. In our own testing, neither service set any cookies or stored anything in your browser. They process technical information from your visit, such as the page address, the referring page, your browser type and your IP address, to produce aggregated statistics.

Lawful basis: legitimate interests (understanding how our website is used).

Security and performance (Cloudflare)

Our website is delivered through Cloudflare, which protects it against attacks, spam and automated abuse and helps pages load quickly. To do this, Cloudflare processes technical information about every request to our site, including your IP address, browser details, the page requested and the time. Cloudflare may run a short automated check in your browser to tell people apart from bots. If it does, it may set a security cookie (see the cookie table). Cloudflare also hides email addresses on our pages from spam-harvesting bots.

Lawful basis: legitimate interests (keeping our website secure, available and fast).

Website security (Wordfence)

We use Wordfence, a WordPress security plugin made by Defiant, Inc., to protect our website. Wordfence runs a firewall and records security information such as IP addresses, the pages requested, browser details and blocked or suspicious activity. It may check IP addresses against Defiant’s threat-intelligence service. Wordfence sets cookies only for people who log in to the website (our own staff). It does not set cookies for readers.

Lawful basis: legitimate interests (preventing hacking, fraud and abuse).

Affiliate links (Wise, via Partnerize)

Some of our articles contain affiliate links. At the moment, our only affiliate partner is Wise. Our Wise links go through our own address (bankrolled.com/go/wise), which sends you on to Wise through Partnerize, the affiliate network Wise uses, and then to wise.com. We do not set any cookie when you click one of these links. Partnerize sets a cookie on its own domain to record the click, and Wise sets its own cookies when you arrive on wise.com. If you then sign up with Wise, Partnerize can tell us that a referral happened so that we can be paid a commission. We receive commission and reporting information, such as the number and value of referrals. We do not receive your name or contact details from Wise.

Lawful basis: legitimate interests (earning revenue through affiliate partnerships to fund the site). Partnerize and Wise are responsible for their own processing under their own privacy policies.

Advertising (Google AdSense)

We use Google AdSense to show advertising on our website. Google’s advertising code is installed on our pages. When ads are shown, Google and its partners may use cookies and similar technologies to show ads, limit how often you see the same ad, measure ad performance, detect fraud and, depending on your settings and location, show ads based on your interests. See section 4 for more detail and for how to opt out.

Lawful basis: consent where the law requires it for advertising cookies and personalised ads, and otherwise legitimate interests (funding free content through advertising).

Listen button (browser text-to-speech)

Some articles have a “Listen” button that reads the article aloud. It uses the Web Speech API built into your web browser. The speech is produced by your browser and device, not by us, and we do not receive any audio or recording of you. Depending on your browser and the voice you choose, your browser provider may generate the voice using its own online service. That is covered by your browser provider’s privacy terms. Nothing plays until you press the button. When you use it, we record the analytics events described above.

Ask Bankrolled (our question box)

Ask Bankrolled lets you type a money question and get a short, automatically generated answer. It gives general information only, not financial, tax or legal advice. When you use it, we process:

  • Your question and the answer we give, with the answer setting you chose, the time, the country your request came from, and the guides and web pages the answer linked to. We read these to improve our guides and to spot misuse.
  • A scrambled code made from your IP address, so we can limit how many questions one person can ask (three a minute and 20 a day). We do not store your IP address itself in the question log.
  • A browser check from Cloudflare Turnstile, which confirms you are a person and not an automated script before a question is answered.

Please do not include names, account numbers, tax reference numbers, addresses or other personal details in your questions. Before a question is saved, we automatically remove anything that looks like an email address, a phone number, a bank account number (IBAN) or a card number. This removal is automatic and may not catch everything.

Your answer setting is remembered in your browser’s local storage (key askScope) so the box opens with the same setting next time. It is not sent to us except as part of a question.

Who provides it: Ask Bankrolled runs on Cloudflare. Cloudflare hosts the question box, stores the question log, runs the browser check and runs the AI model that writes the answers (Cloudflare Workers AI), as our processor. If you choose “Guides + web” or “Go wild”, the text of your question is also sent to a web search service to find relevant pages: Exa, or Perplexity AI, Tavily or Wikipedia (Wikimedia Foundation) if Exa is unavailable. These services receive the question text only, not your IP address or browser details.

Lawful basis: legitimate interests (answering your question, keeping the service safe and affordable, and improving our guides).

Author images (Gravatar)

Author profile pictures on our articles are loaded from Gravatar, a service run by Automattic. When your browser loads these images, Gravatar receives your IP address and browser details, as happens with any image loaded from another website.

Lawful basis: legitimate interests (showing who wrote each article).

Your theme preference

If you use the light/dark mode switch, your browser saves your choice (bankrolled-color-scheme) in its local storage so the site remembers it. This setting stays on your device and is not sent to us.

Information we do not collect

We do not ask for or knowingly collect sensitive information, such as information about your health or your financial accounts. We do not offer user accounts or comments. Please do not send us sensitive personal information through the contact form.

3. Cookies and similar technologies

Cookies are small text files that a website saves in your browser. Similar technologies include local storage and small scripts that read information from your device. Some cookies are essential for security or for a feature you have asked for. Others are used for analytics, advertising or affiliate tracking. Cookies set by our own domain (bankrolled.com) are “first-party”. Cookies set by other companies’ domains, such as doubleclick.net or beehiiv.com, are “third-party” and are controlled by those companies.

If you visit from the UK, the European Economic Area or Switzerland, Google shows you a consent message on our behalf. We use Google’s own consent tool for publishers, which is certified under the IAB Transparency and Consent Framework. The message asks whether you agree to Google and its advertising partners using cookies and your personal information for purposes such as personalised ads and measuring ad performance. You can accept, or choose “Manage options” to make choices by purpose and by partner. If you do not consent, Google may still show limited or non-personalised ads, which use fewer cookies. Visitors outside those regions do not see the message.

Changing your consent choice

You can change or withdraw your choice at any time. Use the “Privacy and cookie settings” link that Google adds at the bottom of our pages. It opens the consent message again, where you can choose “Consent”, “Do not consent” or “Manage options”. Withdrawing consent does not affect anything done before you withdrew it. You can also delete cookies in your browser settings, as described below.

The table below lists the cookies we saw when we tested our website as a new visitor on 27 September 2026. It also lists cookies that are only set in certain situations, which are marked as conditional. Durations are the ones we observed, unless the table says a duration comes from the provider’s published documentation. Browsers can also limit how long a cookie lasts. For example, Chrome caps cookies at 400 days.

Cookie Provider (domain) Purpose Type Duration
cf_clearance Cloudflare (bankrolled.com) Records that your browser passed Cloudflare’s automated security check, so you are not checked again Essential 1 year
__cf_bm Cloudflare (bankrolled.com) Conditional: set only if Cloudflare’s bot protection needs it, to tell people apart from bots Essential 30 minutes (per Cloudflare)
_ga Google Analytics (bankrolled.com) Distinguishes one visitor from another for statistics Analytics Up to 400 days
_ga_RM0R0M9BLR Google Analytics (bankrolled.com) Keeps track of your visit (session) for statistics Analytics Up to 400 days
IDE Google (doubleclick.net) Used by Google to show, measure and personalise ads and to prevent fraud Advertising Up to 400 days observed. Google states 13 months for UK/EEA users
test_cookie Google (doubleclick.net) Checks whether your browser accepts cookies Advertising 15 minutes
__gads, __gpi Google AdSense (bankrolled.com) Conditional: set when an ad is served, to show and measure ads and limit repeats Advertising 13 months (per Google)
__eoi Google AdSense (bankrolled.com) Conditional: set when an ad is served, for ad security and fraud prevention Advertising 6 months (per Google)
_subscribe_forms_session Beehiiv (subscribe-forms.beehiiv.com) Keeps the newsletter sign-up form working Essential (newsletter form) Session (deleted when you close your browser)
cf_clearance, __cf_bm Cloudflare, for Beehiiv (beehiiv.com) Protects Beehiiv’s sign-up form from bots Essential (newsletter form) 1 year; 30 minutes
_pxvid, _px3, pxcts HUMAN Security, for Beehiiv (beehiiv.com) Bot and fraud detection on Beehiiv’s sign-up form Essential (newsletter form) 1 year; about 5 minutes; session
tPHG-PS Partnerize (prf.hn) Conditional: set only if you click a Wise affiliate link, to record the referral so we can be paid Affiliate 1 year
wfwaf-authcookie-*, wf_loginalerted_* Wordfence (bankrolled.com) Conditional: set only for people who log in to manage the website, for firewall and login security. Not set for readers Essential Set by Wordfence for logged-in users only
bankrolled-color-scheme (local storage) Bankrolled (bankrolled.com) Conditional: remembers your light/dark mode choice if you use the switch Essential (preference) Until you clear your browser storage

Wise sets its own cookies when you arrive on wise.com. Those are covered by Wise’s cookie policy, not this one. Google and our other providers may change the cookies they use from time to time. For Google’s current list, see Google’s advertising and measurement cookies.

How to manage cookies

You can block or delete cookies, and clear local storage, in your browser settings. Most browsers also let you block third-party cookies only. Your browser’s help pages explain how:

You can also stop Google Analytics from collecting data about you on any website by installing the Google Analytics opt-out browser add-on. If you block essential cookies, some features, such as the newsletter sign-up form or Cloudflare’s security checks, may not work properly.

4. Advertising and advertising cookies

Bankrolled.com (a trading name of CLYFAR LTD) uses Google AdSense to show advertising on some pages. Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and/or other sites on the internet.

You can opt out of personalised advertising from Google by visiting Google Ads Settings (https://adssettings.google.com). You can also opt out of some third-party vendors’ use of cookies for personalised advertising at www.aboutads.info (or, in the UK and EU, www.youronlinechoices.eu).

Other third-party vendors and ad networks may also serve ads on this site through Google. You can see how Google uses information from sites that use its services at https://policies.google.com/technologies/partner-sites.

Google acts as an independent controller for the personal information it collects through its advertising cookies. Its privacy policy explains how it uses that information.

5. Affiliate links

Bankrolled is funded partly by affiliate commissions. If you click an affiliate link on our site and then sign up for or buy a product, we may earn a commission. This does not change the price you pay or the product you get. Our editorial choices are based on what we think is useful to readers, not on commission alone. Every article that contains an affiliate link says so next to the link. How we earn and how links are labelled is set out in our Affiliate disclosure.

At the moment, our only affiliate partner is Wise, which we work with through the Partnerize affiliate network. How the click is tracked is explained in section 2. When you leave our site, the other website’s privacy and cookie policies apply, and we are not responsible for how they handle your information.

6. Who we share information with, and international transfers

We do not sell your personal information for money. We share it only with the service providers and partners we need to run the website. Some of them act as our processors, meaning they handle data only on our instructions. Others, such as Google for advertising or Partnerize and Wise for affiliate tracking, also act as independent controllers under their own privacy policies. They are:

  • Google: Google Analytics, Site Kit and Google AdSense (analytics and advertising).
  • Cloudflare: website delivery, security, email-address protection and cookieless visitor statistics, and for Ask Bankrolled: hosting, the question log, the Turnstile browser check and the AI model that writes answers.
  • Exa: web search for some Ask Bankrolled questions, when you choose “Guides + web” or “Go wild”.
  • Tavily and the Wikimedia Foundation (Wikipedia): web search for Ask Bankrolled questions, when you choose “Guides + web” or “Go wild”.
  • Perplexity AI: web search and answer writing for some Ask Bankrolled questions, when you choose “Guides + web” or “Go wild”.
  • Beehiiv: newsletter sign-up forms and email delivery, including the security services Beehiiv uses on its forms (such as Cloudflare and HUMAN Security).
  • Defiant, Inc. (Wordfence): website firewall and security.
  • WPForms: the contact form plugin, which runs on our own website.
  • Fasthosts: website hosting. Our website, including any stored contact form messages, is hosted on Fasthosts’ servers.
  • Ahrefs: cookieless visitor statistics.
  • Automattic (Gravatar): author profile pictures.
  • Partnerize and Wise: affiliate referral tracking and commission reporting.
  • Our email provider, which receives messages sent through the contact form.

We may also disclose information if the law requires it, to protect our rights or the safety of others, or to a buyer if our business is ever sold.

International transfers

Several of these providers, including Google, Cloudflare, Beehiiv, Defiant (Wordfence) and Automattic, are based in the United States or process data outside the UK. When personal information is transferred outside the UK, we rely on the safeguards UK law allows. These include UK adequacy regulations, such as the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, and the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, which providers typically include in their data processing terms. You can contact us for more information about the safeguards that apply.

7. How long we keep information

  • Contact form messages and replies: up to 24 months after our last correspondence with you, unless we need them longer to deal with a dispute or a legal requirement.
  • Newsletter subscription: until you unsubscribe. After that, Beehiiv may keep a minimal record of your email address so that you are not emailed again by mistake.
  • Google Analytics data: user-level data is kept for up to 14 months and is then deleted automatically. Aggregated reports, which do not identify you, may be kept longer.
  • Security logs (Cloudflare and Wordfence): kept for a short period, typically days to weeks, under the providers’ standard settings, unless we need them longer to investigate a specific security incident.
  • Affiliate and commission records: kept for as long as UK tax and company law requires us to keep financial records, which is generally six years.
  • Cookies: for the durations shown in the cookie table above, or until you delete them.
  • Ask Bankrolled questions and answers: 90 days, after which they are deleted automatically. We may keep counts that do not identify anyone, such as how many questions were asked each day.

8. Your rights

If you are in the UK or the European Economic Area, you have the following rights over your personal information:

  • Access: to ask for a copy of the personal information we hold about you.
  • Rectification: to ask us to correct information that is wrong or incomplete.
  • Erasure: to ask us to delete your information.
  • Restriction: to ask us to limit how we use your information.
  • Objection: to object to our use of your information where we rely on legitimate interests, and to object at any time to direct marketing.
  • Portability: to ask for information you gave us in a commonly used electronic format, or for it to be sent to another organisation.
  • Withdrawing consent: where we rely on consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

Some rights apply only in certain circumstances. To use any of them, email privacy@bankrolled.com. We will respond within one month. We may need to ask you to confirm your identity first. There is normally no charge.

If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the UK Information Commissioner’s Office (ICO) at https://ico.org.uk, or to the data protection authority in your country if you live in the EEA.

9. Visitors in the United States

Some US states, including California, give their residents rights over their personal information. These can include the right to know what personal information a business collects and shares, to access it, to correct it, to delete it, and to opt out of certain uses. This section explains how those rights apply to our website.

  • What we collect: the categories are described in section 2. They are identifiers (such as email address, IP address and cookie IDs), internet activity (such as pages viewed and links clicked) and approximate location.
  • Selling: we do not sell personal information for money.
  • Advertising cookies: Google’s advertising cookies on our site may be used to show ads based on your activity across different websites. Under some US state laws, including the California Consumer Privacy Act, this may count as “sharing” personal information for cross-context behavioural advertising, or in some states as “targeted advertising”. You can opt out of personalised Google ads at Google Ads Settings and through the industry tools listed in section 4. You can also block third-party cookies in your browser.
  • Sensitive information: we do not knowingly collect sensitive personal information.
  • Making a request: to ask about or use your rights, email privacy@bankrolled.com. We will not treat you differently for using your privacy rights.

10. Children

Bankrolled is written for adults and is not directed at children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, please contact us and we will delete it.

11. Security

We take reasonable technical and organisational steps to protect personal information. These include encrypted (HTTPS) connections, Cloudflare’s network protection, the Wordfence firewall, keeping our software up to date and limiting who can access our systems. No website or internet transmission is completely secure, so we cannot guarantee the security of information you send us.

12. Changes to this policy

We may update this policy when our website, our service providers or the law changes. We will change the “Last updated” date at the top of this page whenever we do. If we make a significant change, we will make it clear on this page.

13. Contact us

For any questions about this policy or your personal information, please contact us:

Bankrolled is a trading name of CLYFAR LTD (Companies House 08922294).

Trending now

Wise is the rail, not your emergency fund