Privacy notice
GainPal collects as little about you as possible, keeps it for as short a time as possible, and never sells it or shares it for marketing.
Last updated: 29 October 2026
Who we are
GainPal is a trading name of Saurabh Pandey, a sole trader based in the UK. Saurabh Pandey is the data controller for the personal data described here.
Contact: [email protected]. Address for documents: 3 Craven Road, Newbury, RG14 5NG. ICO registration number: [pending].
What we collect and why
| When | What we collect | Why, and our lawful basis |
|---|---|---|
| You fill in one of our forms (free check, Report Review request or contact) | Your email address, and answers about your crypto activity (tax years, number and names of exchanges and wallets, types of activity), how you heard about us, and the link tag that brought you to the form if the link you followed had one. We ask you not to include wallet addresses or files. | To reply with a quote and answer your questions. Taking steps at your request before a contract. |
| You ask for our partner terms (accountants) | Your firm name, work email, role and roughly how many of your clients have crypto, plus how you heard about us. | To email you our partner terms and pricing: taking steps at your request. If you tick the box, occasional updates about the partner programme: consent, which you can withdraw at any time using the unsubscribe link. |
| You book a call | Name, email and the time you choose. | To hold the call. Taking steps at your request before a contract. |
| You become a client | Exchange export files and public wallet addresses you send us, plus your contact and billing details. For a source-of-funds report, also any bank statements or transfer records you choose to send. | To reconcile your records and prepare your report or review. Performance of our contract with you. |
| We must keep records by law | Invoices, engagement records and, where required, identity checks. | To meet tax and anti-money-laundering record-keeping duties. Legal obligation. |
| You visit this website | Anonymous visit counts only. No cookies, no tracking, no advertising. | To understand how many people use the site. Legitimate interests. |
We never ask for passwords, API keys or seed phrases.
Clients referred through an accountant
If you are a client of one of our partner accountancy firms, the firm is the data controller and we process your data only on its instructions, usually under a reference code rather than your name. The firm's own privacy notice applies.
Who we share it with
- Tally (form provider, Belgium), which stores form answers, including partner-terms requests.
- Calendly (booking provider, USA), only if you book a call.
- Google reCAPTCHA (USA), which our form provider uses to block spam on our forms. It may collect technical information about your device and browser, such as your IP address, and may set cookies on the form page. We use it to protect our forms from abuse (legitimate interests), and Google's privacy policy applies to that information.
- Stripe (payment provider), which processes your payment and billing details when you pay through our payment link. We never see or store your full card details.
- Our email provider, to send and receive messages.
- Cloudflare, which hosts this website and provides cookieless visit counts.
- An end-to-end encrypted file-transfer service, which holds the files you upload, encrypted so only we can open them, until we collect them.
- Public blockchain data services, which we use to look up the transaction history of the public wallet addresses you give us. We send them the addresses only, never your name or files.
- A partner accountant, only if you ask us to introduce you.
- Your solicitor, lender or broker, only if you ask us to send them your report.
- Authorities, only where the law requires it.
Apart from the encrypted transfer, your crypto files are never stored in cloud storage and never shared with anyone else. Where a provider stores data outside the UK, it does so under legally recognised safeguards.
How long we keep it
- Enquiries that don't go ahead: deleted within 12 months.
- Partner-terms requests: deleted within 12 months unless we start working together or you opted in to updates; if you opted in, until you unsubscribe.
- Your crypto files and working data: deleted when your report is delivered and accepted.
- Your final report, invoices and engagement records: kept for 6 years, as tax rules require, then deleted.
- Identity checks, where required: kept for 5 years after our work ends, as anti-money-laundering rules require.
How we protect it
Files arrive by end-to-end encrypted transfer and are worked in a dedicated, encrypted user account used only for client work, with no cloud sync. Every account used for the work is protected by two-factor sign-in. Files are labelled by reference code rather than name where possible. The transfer link expires once we collect your files.
Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to you in a portable format. Email [email protected] and we will reply within one month. We make no decisions about you by automated means.
If you're unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes
We will update this notice if how we use data changes, and show the date of the latest version at the top.