Privacy Policy

01Who we are

WealthR is a personal finance tracking application built and operated by Liam Kane, trading as WealthR — a sole trader based in Edinburgh, Scotland. Liam Kane is the data controller for all personal data processed through WealthR.

For the purposes of UK GDPR, Liam Kane (trading as WealthR) is responsible for ensuring your personal data is handled lawfully, fairly and transparently.

You can reach us any time at [email protected] for privacy questions, data subject requests, or anything else covered by this policy.

ADVAdvisers, firms & client portals — our role as a processor

Most of WealthR is a service we provide directly to you, where Liam Kane (trading as WealthR) is the data controller — that's everything else on this page. The Adviser Workspace works differently. Where a financial adviser or firm uses WealthR to manage their own clients — entering figures, keeping notes, sharing a branded client portal, and exchanging messages and documents — the adviser firm is the data controller for that client information, and WealthR acts as their data processor, handling it only on the firm's documented instructions.

If you are a client of a firm that uses WealthR, your firm decides what information to hold about you and why. For questions about your data, or to exercise your rights, please contact your adviser firm in the first instance — they are the controller. We will support them in responding to you.

What we process on a firm's behalf can include: the client's name and contact details; the financial figures, fact-find and planning information the adviser enters; messages exchanged through the portal; documents the adviser or client upload to the secure document area; and a portal access PIN. We process this only to operate the service for the firm — never for our own purposes, never to advise the client, never for advertising, and never to train AI models.

How it's protected. Client data sits in the same EU-hosted Supabase infrastructure as the rest of WealthR, isolated per firm by database Row Level Security. Portal links require a per-client PIN (not derived from the client's data) with an automatic lockout after repeated wrong attempts. Documents are held in a private store reached only through short-lived, signed links — never a public URL — and can be set to auto-delete on a retention schedule, with an audit trail of every removal. Branded emails to a firm's clients are sent through our email provider (Resend) and carry only a name, a short message and a secure link — never financial figures.

The relationship between WealthR and each adviser firm — including our processor commitments, the sub-processors we use, security measures, breach notification, and what happens to data when a firm leaves — is governed by a separate Data Processing Agreement entered into with the firm. Firms can request a copy from [email protected].

02What data we collect

We collect the minimum data necessary to provide the service:

• Account data — your email address and a hashed password, or a Google OAuth token if you sign in with Google. We never see your raw password.
• Financial tracking data — the investment values, property figures, debt balances, asset values and monthly entries you choose to log. This data is stored against your account so it syncs across devices.
• Profile data — your name, date of birth (month and year only), target retirement age, monthly contribution and expected growth rate. These power your forecasts and are never shared.
• Tax calculator inputs — if you use the Tax tab, your gross salary, region, pension contribution percentages, student loan plan and any optional flags you set (e.g. children, marriage allowance) are saved to your profile so they pre-fill next time. This data is stored as part of your account, is never shared, and can be deleted by clearing your profile or closing your account.
• Subscription and billing data — if you subscribe to WealthR Pro, our payment processor Stripe collects and processes your card details, billing address and country for the transaction. We never see your full card number. Stripe returns us only a customer ID, a subscription status (active, trialing, past_due, canceled), the plan you're on and the renewal date. This is the data we use to unlock Pro features.
• Usage data — basic technical logs (errors, performance) to keep the app running. We do not use analytics platforms that track individual behaviour across sessions.
• Abuse-prevention signal — when you create an account, sign in or start a trial, we store a one-way cryptographic hash of your IP address — never the IP address itself. We use it solely to detect and prevent fraudulent or abusive account activity (for example, multiple accounts created to abuse free trials). The hash cannot be reversed back to your IP address, and it is automatically deleted after 180 days.
• Marketing email address — if you choose to join our product update list or Pro waitlist, we store the email address you provide. This is separate from your account email and is only used for the purpose you consented to. You can withdraw consent at any time by emailing [email protected].
• 0% Balance Transfer Tracker data — the free Balance Transfer Tracker runs in your browser and keeps your cards on your own device by default. Only if you opt in to email reminders do we store, on our servers: your email address, the card labels and 0% end dates you entered (and any optional balance and revert-APR figures), your reminders consent, and — only if you separately tick it — your consent to hear about relevant balance-transfer offers in future. These are card nicknames and dates only, never card numbers or account details. You can turn these reminders off at any time via the unsubscribe link in any reminder email.
• Adviser share tokens — if you generate a read-only share link, we store a randomly generated token linked to your account. Anyone with this token can view (but not edit) your dashboard. You can revoke this token at any time from Settings.

03Legal basis for processing (UK GDPR)

Under UK GDPR, we are required to identify a lawful basis for processing your personal data. We rely on the following:

04How we use your data

Your data is used exclusively to:

• Provide and sync your WealthR account across devices
• Generate your net worth calculations, forecasts, charts and insights within the app
• Send transactional emails (password reset, account confirmation, trial-ending reminder, payment failure notices, receipts) — no marketing without explicit consent
• Send product update or Pro launch emails — only where you have explicitly opted in via a consent checkbox
• Send the 0% balance transfer reminders you opted into — emails ahead of each card's deal-end date — and, only if you separately consented, occasional information about relevant balance-transfer offers
• Process Pro subscription payments and manage your subscription lifecycle (start trial, upgrade, downgrade, cancel, resume) via Stripe
• Power the adviser share link feature — if you generate a share link, the recipient can view your dashboard in read-only mode using a randomly generated token. We never proactively share your data; this is always user-initiated
• Fetch live cryptocurrency prices from CoinGecko — your device makes a direct request to CoinGecko's public API using a coin identifier (e.g. "bitcoin"). No personal data is sent to CoinGecko
• Diagnose errors and improve the reliability of the service
• Maintain our customer relationship records — who you are, your subscription status, and our correspondence with you — so we can respond to support requests properly. These records never include your financial tracking data
• Operate the service efficiently using AI-assisted tooling (see Anthropic below) — for example helping us draft replies to emails you send us. A human reviews every reply before it is sent, and no automated decisions are made about you

We do not use your data for advertising, profiling, automated decision-making, or sale to third parties — under any circumstances.

05Who we share data with

We use a small number of trusted infrastructure providers. No one else has access to your data.

We do not use Google Analytics, Meta Pixel, or any advertising or behavioural tracking networks.

Affiliate links. Some links on WealthR may be affiliate links. Following one does not share your personal data with the merchant beyond the standard click referral, and affiliate activity never affects what we recommend. How we label and handle these is set out in our Terms and, in full, our Affiliate Disclosure.

06International data transfers

Your account and financial data is stored on Supabase infrastructure hosted in the European Union.

Some of our processors (notably Stripe, Render, Resend, Notion, Anthropic and Google Fonts) are based in the United States and may process limited data there. Where personal data is transferred outside the UK, we rely on one of the following safeguards as required by UK GDPR:

• The UK's adequacy decision for the EU / EEA, where applicable
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses
• Processors' participation in the UK–US Data Bridge extension to the EU–US Data Privacy Framework, where available

We keep transfers to the minimum necessary, and in all cases your financial tracking data stays on EU-hosted Supabase infrastructure.

07Data retention

Your data is retained for as long as your account is active. You can permanently delete your account at any time from Settings → Delete account inside the app. This immediately and permanently deletes all your financial data, profile information and activity history. This action cannot be undone.

If you subscribe to Pro and then cancel, your subscription record is marked cancelled but your account and data remain intact — you can resume at any time. If you delete your account, we also cancel any active Stripe subscription, remove your customer record from our side, and remove your entry from our customer relationship records (held in Notion) as part of a routine daily sync — normally within 24 hours.

We may retain billing records (invoice number, amount, tax, plan, date) for up to 6 years after the last transaction to meet UK tax and accounting obligations (HMRC). These records do not contain your card number.

We may retain anonymised, aggregated data (e.g. total number of active users) that cannot be linked to any individual.

08Your rights under UK GDPR

You have the following rights in relation to your personal data. Most can be exercised directly within the app — for others, email [email protected].

We will respond to all rights requests within 30 days. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint.

09Cookies

WealthR uses a single session cookie to keep you signed in, plus a short-lived cookie set by Stripe on the checkout page to enable secure payment processing and fraud prevention. We do not use tracking cookies, advertising cookies, or any third-party cookies for analytics or profiling.

No cookie consent banner is required because we use only strictly necessary cookies as defined under UK PECR.

10Security

We implement appropriate technical and organisational measures to protect your personal data:

• All data is transmitted over HTTPS / TLS
• Passwords are hashed using industry-standard bcrypt — never stored in plain text
• Your financial data is stored with Row Level Security (RLS) enforced at the database level — each user can only ever access their own data, even at the query level
• Card payments are handled entirely by Stripe (PCI DSS Level 1 certified). We never store, log or process card numbers
• No financial institution credentials are ever requested or stored

11Data breach notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, as required by UK GDPR Article 33.

Where a breach is likely to result in a high risk to you personally, we will also notify you directly without undue delay, including what happened, what data was affected, and what steps we are taking.

12Children

WealthR is a financial tracking tool intended for adults aged 18 and over. We do not knowingly collect or process data from anyone under the age of 18. If you believe a minor has created an account, please email [email protected] and we will delete it promptly.

13Changes to this policy

We may update this policy from time to time to reflect changes in the law, our practices, or the services we offer. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you by email.

Continued use of WealthR after changes have been published constitutes your acceptance of the updated policy.

14Contact & data requests

Questions about this policy, how we handle your data, or to exercise any of your rights? The fastest route is email — we respond within 30 days (usually much sooner).

Prefer a form? Use the button below — it opens our contact form and goes to the same inbox.