Privacy Notice

Personal data we collect

• Identity and contact data: first name, last name, email address.
• Account data: password (hashed), role, created date, last login date.
• Preferences: marketing consent and consent timestamp.
• Date of birth (for eligibility verification) – stored as provided.
• Technical logs: limited diagnostic logs for security and performance.

How we use your data

• To create and manage your account and provide the Service.
• To verify eligibility (18+), security and fraud prevention.
• To send essential service communications.
• To send marketing communications if you have opted in (you can opt out at any time).
• To comply with legal obligations and enforce our Terms.

Legal bases for processing

• Performance of a contract: account setup, access, and support.
• Legitimate interests: security, service improvement, and fraud prevention.
• Consent: marketing emails (opt‑in), which you may withdraw at any time.
• Legal obligation: where required by law or regulation.

Data sharing

We do not sell personal data. We may share limited data with service providers under contracts that require confidentiality and security (e.g., hosting, analytics). Broker integrations you connect to are processed under their own terms and privacy notices.

International transfers

Where data may be processed outside the UK, we use appropriate safeguards such as Standard Contractual Clauses or adequacy decisions, as applicable.

Data retention

We keep your personal data only for as long as necessary for the purposes described above, including for legal, accounting, or reporting requirements. You may request deletion of your account at any time.

Your rights

• Access, rectification, erasure, restriction, and portability.
• Objection to processing where we rely on legitimate interests.
• Withdraw consent to marketing at any time.
• Complain to the UK ICO: Information Commissioner’s Office.

Contact

To exercise your rights or ask questions about this notice, please contact us via the support form in your account. We will respond within one month as required by UK GDPR.