1. Who we are
‍
Attainsy is provided by Attainsy Limited, a company registered in England and Wales with company number 17485567, registered office 66 Paul Street, London, EC2A 4NA, United Kingdom. Attainsy Limited is the data controller for the personal information described in this policy.

You can contact us about privacy, or exercise any of your rights, at dataprotection@attainsy.com or by writing to the Data Protection Lead at our registered office. We are registered with the Information Commissioner’s Office.

2. The information we collect
‍
Information you give us
‍•    Account details: your name, email address, password and year of birth or date of birth.
•    Planning information you choose to enter: for example your income, spending, savings, investments, pensions, property, debts, insurance, goals and retirement plans. You decide how much to enter - Attainsy works with whatever you provide.
•    Household details you choose to add, such as a partner’s or child’s details. If you add information about another person, please make sure you are allowed to share it and point them to this policy.
•    Messages you send us, for example support requests and feedback.
‍
Information collected automatically
‍•    Device and usage information: device type, operating system, app version, IP address, and how you move through the app and website. Our Cookie Policy explains what we collect on the website through cookies and similar technologies.
‍
Payment information
‍•    If you subscribe to a paid plan, your payment is processed by our payment provider, currently Stripe, or by the Apple App Store or Google Play if you subscribe through them. They process your card details and tell us that you have paid; we do not see or store your full card details.

3. How we use your information
‍
UK data protection law requires us to have a lawful basis for each use. Here they are:
‍
What we use it for -- and -- Lawful basis
‍
‍Running your account and providing Attainsy: building your financial picture, projections and scenarios from the information you enter -for- Performing our contract with you

Taking payment for paid plans and managing your subscription -for- Performing our contract with you

Keeping Attainsy secure, preventing fraud and misuse, and verifying your identity -for- Legitimate interests and legal obligations

Understanding how Attainsy is used and improving it, using aggregated information wherever possible -for- Legitimate interests

Sending you service messages, such as changes to terms, security alerts and renewal reminders -for- Performing our contract and legal obligations

Sending you news, tips and offers about Attainsy by email, if you opt in -for- Consent - you can opt out at any time

Measuring our website advertising and showing Attainsy ads to people who have visited our website, using advertising cookies -for- Consent - through the cookie banner, withdrawable at any time

Meeting legal and regulatory duties, such as tax and accounting rules -for- Legal obligations
‍
What we never do: we never sell your personal information, we never share it with third parties for their marketing, and we never use the information you enter inside the app - your financial information, goals and plans - for advertising or ad targeting of any kind. Attainsy’s outputs are illustrations generated from your inputs; they are guidance for you to consider, not decisions made about you.

4. Who we share your information with
We never share your personal information with any third party for that third party's own purposes. It is disclosed only to the service providers and group companies that help us operate Attainsy, listed below, and to an external partner only when you expressly instruct us to share it.

People who help us run Attainsy
‍•    Our group companies in the United Kingdom, which provide the technology platform, hosting, customer support and other operational services for Attainsy on our behalf.
•   Our group company in India, which provides software development and technical support for Attainsy. Access is limited to what is needed to run and support the service and is covered by the safeguards in section 5.
•    Service providers who host and run the service for us, currently Amazon Web Services with data held in the United Kingdom.
•    Payment providers - currently Stripe, and Apple or Google if you subscribe through their stores - to manage paid subscriptions.
•    Marketing and contact providers - currently Flodesk and HubSpot - which store contact details, enquiries and marketing preferences for people who sign up to hear from us or get in touch.
•    Customer support and email providers - currently Help Scout and Google Workspace - which handle the messages you send to our support team.
•    Analytics providers that help us understand how Attainsy is used, and, if you consent to advertising cookies, our advertising providers - currently Google and Meta - who receive limited information about your visit to our website, such as pages viewed and whether you signed up, so we can measure our ads and show Attainsy ads to people who visited our site. They never receive anything you enter inside the app. Our Cookie Policy has the details.
•    Professional advisers, insurers and authorities where we need to - for example our auditors, or where the law requires us to share information.
•    A buyer or successor if our business is sold or reorganised, with your rights protected in the same way. Everyone who processes personal data for us does so under a written contract that meets UK GDPR requirements.

External partners you choose to contact
The app may show you external third-party financial services partners. We never share anything with a partner on our own initiative.
‍
There are only two ways a partner receives your information, and both start with you:
•    Contact and query details. If you choose to contact a partner - for example through an Expert help button - we share your contact details (your name, phone number, email address and address) and any query details, depending on what you complete and choose to share, and nothing else. This happens only when you confirm it.
•    Your financial information. If you want to save time explaining your current position, you can actively ask us to share your financial information with a partner you choose. We share only what you select, only with that partner, and only when you confirm it. We will never share your financial information with any partner otherwise.

Once shared, the partner handles your information as its own data controller under its own privacy policy, which you should read. Which partners you see may depend on how you came to Attainsy - for example, the partner connected with your employer or another organisation that made the app available to you. We may receive payment from partners, and we tell you this before you share. Our Terms of Use explain how partner listings work.

Affiliate links
‍The app may contain affiliate links to third-party websites and services, and the third party may pay us if you use them. We do not send them any of your information. When you follow an affiliate link, you deal with the third party directly, and their own terms, privacy policy and cookies apply from that point.

Shared plans
‍If you invite people to your plan, or accept an invitation to someone else’s, everyone in the shared plan sees the information in it, including financial details others have entered. Only invite, or accept an invitation from, people you are happy to share this with. You can remove an invited person, and anyone can leave, at any time in the app.

5. Where your information is stored
Your information is stored in cloud infrastructure located in the United Kingdom. We do not store it in, or transfer it to, the European Union or anywhere else, with the exceptions below.

Our group development and support team in India accesses the service remotely to maintain and support it. This access is a restricted transfer under UK GDPR, and it is protected by an intra-group agreement incorporating the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, together with technical measures such as encryption and strict access controls. You can ask us for a copy of the relevant safeguards.

Contact details, enquiries and marketing preferences held with Flodesk, Help Scout and HubSpot may be stored in the United States or EU. These transfers are protected by the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum.

6. How long we keep your information
•    While your account is open, we keep your planning information in full, including its history since you joined. Attainsy is a lifetime planning service, so your history is part of the service itself - it is what lets your plan, scenarios and progress work over time.
•    If you delete your account, or ask us to delete your information, we remove it from our live systems within 30 days and from backups within 3 months. Until backups are purged, the data in them is put beyond use - it is not accessed or restored except where the law requires it.
•    We keep basic subscription and payment records for up to 6 years after the relevant tax year, because tax and accounting law requires it.
•    We keep support messages while your account is open so we can help you with anything that comes up again, and for up to 2 years after your account closes.
•    If you stop using Attainsy without deleting your account, we will contact you after 3 years of inactivity. If we do not hear from you, we will delete your account and information after 4 years of inactivity, with backups purged within 3 further months.

7. How we protect your information
Your data is encrypted in transit and at rest. Access is restricted to people who need it to do their jobs, protected by authentication controls, and logged. We maintain backup, business continuity and incident response arrangements, and our development company is certified to ISO/IEC 27001. No system is completely secure, but we treat the security of your financial information as a first-order responsibility.

8. Your rights
You have rights over your information: to see a copy of it, correct it, delete it, restrict or object to how we use it, receive it in a portable format, and withdraw any consent you have given (such as for marketing emails) at any time. To use any of these rights, email us or use the options in the app - we will respond within one month and may need to verify your identity. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk, though we would welcome the chance to resolve it first.
‍
To exercise any right, email dataprotection@attainsy.com or use the options in the app. To delete your account, use the option in the app or email account-deletion-request@attainsy.com. We will respond within one month. We may need to verify your identity first.

9. Who Attainsy is for
Attainsy is for adults aged 18 or over. We do not knowingly collect information from anyone under 18, other than details you choose to enter about children in your household for planning purposes. If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy
We may update this policy from time to time. If we make a significant change, we will tell you in the app or by email before it takes effect. The "last updated" date at the top shows the current version.

11. Other services
‍Attainsy may link to other websites and services. This policy covers Attainsy only; other services have their own privacy policies, which we recommend you read.