FutureFlow (“we”, “our”) takes your privacy seriously. This policy explains what data we collect, how we use it, and your rights under UK GDPR. It is written in plain English on purpose.
The short version
- We only collect what we need to run FutureFlow for you.
- We never sell your data. Ever.
- You can export or delete your data at any time.
- Your bank data (if connected) is read-only and processed by an FCA-authorised provider, not us directly.
What we collect
Account data: email address, password (hashed), and any personal details you provide in onboarding (age band, eligibility, financial comfort level, goals).
Financial data you enter: bills, goals, savings opportunities you act on. This is stored securely and never shared with third parties.
Bank data (if you connect): account names, balances, transactions, and recurring payments. Processed by our FCA-regulated Open Banking provider. We never see your banking credentials.
Usage data: minimal analytics (which pages you view, not what you type) to help us improve the product. No third-party ad trackers.
How we use your data
- To provide you with personalised savings opportunities, deals, and projections.
- To send you the monthly briefing email if you’ve opted in.
- To maintain your account and provide customer support.
- For fraud prevention and account security.
What we don’t do
- We don’t sell your data to anyone, ever.
- We don’t share your data with advertisers.
- We don’t allow third parties to track you within FutureFlow.
- We don’t use your data to train AI models without your explicit opt-in.
Your rights
Under UK GDPR, you have the right to:
- Access the data we hold about you (request an export from Settings → Privacy).
- Correct any inaccurate data.
- Delete your account and all associated data.
- Object to certain uses of your data.
- Complain to the ICO if you feel we’ve mishandled your data.
Data retention
We keep your account data while your account is active. If you delete your account, we remove personal data within 30 days, except where we’re legally required to retain some records (e.g. payment history for tax purposes — 6 years in the UK).
Security
Your data is encrypted in transit and at rest. Passwords are hashed with industry-standard algorithms. We use Supabase for authentication and storage, which meets SOC 2 Type II standards.
Contact us
Questions about your privacy? Email privacy@futureflow.example. We aim to respond within 48 hours.