Privacy Policy

1. Who is the data controller

Strata Money Limited (registered in England & Wales, company number 17290666, registered office 66 Paul Street, London, EC2A 4NA) is the data controller for personal data processed through the Strata Money service. We are registered with the UK Information Commissioner's Office (ICO) under registration number ZC184102. Data-protection contact: legal@stratamoney.co.uk.

2. What data we collect

• Account data: the email address and password you provide when signing up, and authentication session tokens issued to keep you signed in.
• Profile inputs: the financial figures you enter, for example salary, pension contributions, dependants, assets, liabilities, mortgage details, and scenario assumptions. These are stored against your account so you can return to them.
• Payment data: when you subscribe, your name, email, billing address, and payment-method details are collected and processed by our payment provider (Stripe). We store only the resulting subscription identifiers and status (Stripe customer ID, subscription ID, current period end, plan). We do not store card numbers or CVCs on our servers.
• Email delivery metadata: when we send you a transactional or authentication email (sign-up confirmation, magic link, password reset, invoice), our email infrastructure records send status, timestamps, and any bounce or suppression events, keyed to your email address.
• Technical logs: our hosting provider processes standard request metadata (IP address, user agent, timestamps) to deliver the service and protect against abuse.
• Usage analytics: we do not run any third-party analytics, advertising, tracking, or session-replay tools. See our Cookie Policy.

3. Lawful basis

We process personal data on the following UK GDPR lawful bases:

• Contract, to provide the service you have signed up for.
• Legitimate interests, to operate, secure and improve the service, balanced against your rights.
• Legal obligation, to comply with UK law including tax and consumer-protection requirements.

4. Who we share data with (sub-processors)

Strata Money uses a small number of infrastructure providers to run the service. Each is contractually bound to process personal data only on our instructions.

• Supabase: database and authentication. Stores your account credentials, session tokens, and all profile inputs you enter. Data is hosted in the European Economic Area (Ireland).
• Amazon Web Services (AWS): underlying cloud infrastructure on which the database and storage run.
• Mailgun: transactional and authentication email delivery from our verified sender domain notify.stratamoney.co.uk. Processes your email address, email content, and delivery-status metadata. Located in the United States.
• Stripe: payment processing for subscriptions. Receives your name, email, billing address, and payment-method details directly from you at checkout. We receive back only non-sensitive identifiers and subscription status. Located in the United States.

These services are provided to us via our platform provider, Lovable. Lovable's full current sub-processor list is published at trust.lovable.dev/subprocessors and may be updated from time to time.

We do not share personal data with advertising networks, data brokers, or analytics providers.

5. International transfers

Your core personal and financial data (the database) is stored in the European Economic Area (Ireland). Transfers from the UK to the EEA are covered by the UK's adequacy regulations for the EEA.

Certain sub-processors, including Mailgun and Stripe and some infrastructure services, are located in the United States. Where personal data is transferred to the US or other countries outside the UK and EEA, it is protected by appropriate safeguards, specifically the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, as set out in our data processing agreement with our platform provider.

We have an executed Data Processing Agreement in place with our platform provider governing the processing of personal data.

6. Retention

• We retain your personal data for as long as your account is active.
• If you close your account or request deletion, we delete your personal data within 90 days.
• We retain transaction and payment records for 7 years, as required by UK tax and accounting law, even after account closure.
• Data held in backups is removed in line with our hosting provider's standard backup cycle.
• To request deletion of your account or data, email hello@stratamoney.co.uk.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you;
• Have inaccurate data corrected;
• Have your data erased (right to be forgotten);
• Restrict or object to processing;
• Data portability;
• Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact legal@stratamoney.co.uk. You can also delete your account directly from the account settings page.

8. Cookies and similar technologies

See our Cookie Policy for how we use cookies and local storage.

9. Complaints

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.