Privacy

Privacy policy.

Last updated: 19 June 2026

The Carry ("we", "us", "our") is a free editorial newsletter published from the United Kingdom. This page explains what personal data we collect when you subscribe, answer our survey, or visit thecarry.co.uk, why we collect it, who we share it with, and the rights you have under UK GDPR and the Data Protection Act 2018.

The short version: we collect your email so we can send you the newsletter. We don't sell it, we don't rent it, and we don't pass it to advertisers. You can leave in one click, any time.

Who is the data controller

The data controller is Carry Media Ltd, registered in England and Wales (company number 17283278), registered office 124-128 City Road, London EC1V 2NX, the publisher of The Carry. For anything to do with your data, email editor@thecarry.co.uk.

What we collect

When you subscribe, we collect:

• Your email address.
• The date, time, and IP address from which you subscribed, kept as a record that you consented.
• The broad type of device you subscribed from - mobile, desktop, or tablet - worked out from your browser, so we can see how readers reach us. We don't fingerprint or store full device details.
• Delivery and engagement data - whether an issue was delivered, opened, or clicked, and whether it bounced.

If you choose to answer our subscriber survey, we also collect the answers you give - for example the kind of investing you do, your region, the sectors you follow, and (only if you enter them) your name and LinkedIn. Every question is optional.

We keep our own copy of your subscription and survey answers, stored on Cloudflare, so the record is ours. We send the newsletter through Resend, our email delivery provider, which processes your email address to deliver each issue and records whether it was delivered, opened, or clicked.

When you visit the website, our host (Cloudflare) keeps standard server logs (IP address, browser type, the page requested, and a timestamp) for security and to keep the site running.

If you accept it in the cookie notice, we use Google Analytics to measure how the site is used: pages viewed, rough location (country and region, not your street address), device type, and which site you came from. It only runs, and only sets cookies, after you accept. Decline and it stays off. We don't fingerprint your device.

When we run newsletter sign-up adverts on Meta (Facebook and Instagram), we measure how well they work using Meta's Conversions API. This runs on our server, not in your browser, so we set no Meta cookies and use no tracking pixel. When you sign up, we send Meta a limited set of data, including a hashed (scrambled, one-way) version of your email, so it can credit the sign-up to an advert and help us reach similar readers. We never share your survey answers. You can control how Meta uses this through your Meta ad preferences.

Why we collect it, and our lawful basis

• Your email address - processed on the basis of your consent (UK GDPR Art. 6(1)(a)), which you give by subscribing. We use it for one thing: to send you The Carry.
• Your survey answers - processed on the basis of your consent. We use them only to understand who reads us and make the newsletter more relevant, never to give you or anyone else investment advice. Answering is entirely optional.
• Server logs - processed on the basis of our legitimate interests (Art. 6(1)(f)) in keeping the site secure and working.
• Analytics - processed on the basis of your consent, which you give (or refuse) in the cookie notice when you first visit. We use it only to understand how the site is used.
• Advertising measurement - when we run sign-up adverts, we share a limited set of data with Meta (through its Conversions API, no cookies or pixel) to measure how the adverts perform and reach similar readers, on the basis of our legitimate interests (Art. 6(1)(f)) in advertising the newsletter effectively. You can object through your Meta ad preferences.
• Device type at signup - the broad mobile, desktop, or tablet category, processed on the basis of our legitimate interests (Art. 6(1)(f)) in understanding how readers reach us. It is coarse and never used to identify or track you.
• Where you came from - the referring website or the campaign tag on the link you clicked, recorded at signup (not stored on your device), processed on the basis of our legitimate interests (Art. 6(1)(f)) in understanding which writing and channels bring readers to the newsletter. It is a short source label only, never your browsing history, and never shared with an ad network.

How long we keep it

We keep your email address and survey answers for as long as you stay subscribed, and afterwards until you ask us to delete them. When you unsubscribe you stop receiving the newsletter, and we keep a minimal record so we don't accidentally email you again. You can ask us to erase your data at any time and we will (see "Your rights" below). Server logs kept by our host are short-lived and rotated out automatically.

Who we share it with

We share your data only with the suppliers who help us run the newsletter, and only so they can do that job:

• Resend - our email delivery provider, which processes your email address to send each issue and tracks delivery, opens, and bounces. The subscriber list itself lives in our own Cloudflare database, not theirs.
• Cloudflare - which serves the website, keeps the server logs, and stores our own copy of your subscription and survey answers.
• Google - if, and only if, you accept analytics cookies, Google Analytics receives anonymised data about your visit so we can measure how the site is used.
• Meta - when you sign up while we're running adverts, our server sends Meta (through its Conversions API) a limited set of data, including a hashed version of your email, so we can measure how well our sign-up adverts perform and reach similar readers. No Meta pixel or cookies are used.

Resend, Cloudflare and Google act as our data processors under Art. 28 UK GDPR. Meta is different: for advert measurement and audience building it acts as a separate (independent or joint) controller of the data it receives, under its own terms and data policy. We do not sell, rent, or trade your data, and we don't run referral schemes that hand your email to third parties. We'll only ever disclose data beyond this if the law requires it.

Where your data is processed

Our own copy of your data is stored by Cloudflare in the European Union (Western Europe region), so that copy stays inside the UK/EU.

Resend (our email delivery provider), Google (analytics, only if you accept) and Meta (advert measurement on our sign-up pages) are based in the United States, so data sent to them is transferred outside the UK. Where that happens, the transfer is protected by the EU Standard Contractual Clauses with the UK Addendum and the UK Extension to the EU-US Data Privacy Framework, so your data keeps an equivalent level of legal protection.

Cookies and local storage

We set no cookies by default. The first time you visit, a short notice asks whether you'll allow Google Analytics. If you accept, Google Analytics sets its own cookies (named _ga and similar) to measure how the site is used. If you decline, no analytics cookies are set. You can change your mind at any time by clearing your browser storage, which brings the notice back. Our sign-up adverts use no cookies at all (see Meta, above).

Separately, we keep a few small items in your browser's local storage. These are not cookies, are read only by this site, and are never sent to an advertising network:

• tc_consent - your choice in the cookie notice (accept or decline), kept so we don't ask you again.
• tc_email - if you subscribe, your email address, kept only so the welcome survey can attach your answers to your subscription.
• tc_survey_complete - a marker that you have finished the welcome survey, so we don't show it to you again.

These stay in your browser until you remove them. You can clear them at any time through your browser settings, and clearing them brings the cookie notice back.

If you click a link in one of our emails, we record the click by sending it through a redirect on our own domain (thecarry.co.uk). This sets no cookie. Whether an issue was opened is measured with a small tracking pixel in the email.

Marketing and your control

The only email we send is The Carry itself: one editorial issue a week, plus a welcome message when you join. No sales emails, no sponsored blasts between issues. Every email carries a one-click unsubscribe link, and you can opt out at any time with no questions asked.

How we protect your data

Data is held with reputable providers who encrypt it in transit and at rest, and access is limited to the people who run the publication. No system is perfectly secure, but we keep what we collect to the minimum and review who can reach it.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Have it corrected if it's wrong, or erased.
• Restrict or object to how we process it.
• Receive a copy in a portable format.
• Withdraw consent at any time - just unsubscribe, or email us.
• Complain to the Information Commissioner's Office (ICO), the UK regulator, if you think we've got something wrong.

To exercise any of these, email editor@thecarry.co.uk. We'll respond within one month.

No investment advice

The Carry is an editorial publication. It is not an investment adviser and is not authorised or regulated by the Financial Conduct Authority (FCA). Nothing we publish - on this website, in the newsletter, or anywhere else - is investment advice, a personal recommendation, or an offer or invitation to buy, sell, or subscribe for any investment.

What you read is general information and editorial opinion about the UK early-stage market. It doesn't take account of your circumstances and isn't a substitute for advice from a qualified, FCA-authorised adviser. Early-stage investing carries a high risk of losing all the money you put in. Any decision about your capital is yours alone, and we'd always suggest taking proper advice before you commit it.

Children

The Carry is written for an adult, professional audience and isn't directed at anyone under 18. We don't knowingly collect data from children.

Changes to this policy

If anything material changes, we'll update the "Last updated" date at the top of this page, and we'll flag significant changes in an issue of the newsletter.