Privacy Policy
Last updated: 6 July 2026
SpendWise (“we”, “us”) respects your privacy. This policy explains what personal data we collect, why we collect it, how long we keep it, and the rights you have over it. It is written to align with the UK GDPR and the Data Protection Act 2018.
1. What personal data we collect
- Account data: name, email address, WhatsApp/phone number, username, and an encrypted (hashed) password.
- Subscription data: plan type, package type, start and expiry dates, account status, and payment status records.
- Budgeting data you enter: income entries, expenses, categories, saving goals, bills, and notes.
- Documents you upload: invoices, receipts, and tax-related documents you choose to store.
- Support communication: messages you send via the contact form, email, or WhatsApp.
- Technical data: login timestamps, session tokens, and basic device/browser information needed to keep your account secure.
2. Why we collect it (lawful bases)
- To provide the service (contract): creating your account, showing your dashboard, storing your entries and documents.
- To keep accounts secure (legitimate interest): authentication, session management, two-factor codes, and the admin audit log.
- To manage subscriptions (contract): renewals, expiry reminders, and payment records.
- To answer your messages (legitimate interest / contract).
- To meet legal obligations: basic business and accounting records we are required to keep.
We do not sell your personal data, use it for third-party advertising, or analyse your financial entries for marketing.
3. How long we store it
| Data | Retention |
|---|
| Account & budgeting data | While your subscription is active, plus 12 months after expiry (so you can renew and continue) |
| Uploaded documents | Same as above, unless you delete them earlier |
| Support messages | Up to 24 months |
| Payment/business records | Up to 6 years (UK legal requirement) |
| Audit log entries | Up to 24 months |
4. Your rights
Under the UK GDPR you can ask us to:
- Access the personal data we hold about you (a copy, free of charge);
- Correct inaccurate data;
- Delete your data (“right to erasure”) — see section 6;
- Restrict or object to certain processing;
- Export your data in a portable format (your reports already support CSV export);
- Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you're unhappy with how we handle your data.
5. Cookies
We use a small number of essential cookies to keep you logged in and keep the service secure, plus optional preference cookies. We do not use third-party advertising cookies. Full details are in our Cookie Policy.
6. How to request data deletion
- Contact us by email or WhatsApp from the contact details registered on your account, asking for deletion.
- We verify your identity (we may ask a security question or send a confirmation link).
- We delete your account data, budgeting entries, and uploaded documents within 30 days and confirm when done.
- Limited payment/business records may be retained where UK law requires it (see section 3); these are kept isolated and are not used for any other purpose.
7. Data security
Passwords are stored only as strong one-way hashes; temporary passwords expire within 72 hours; sessions are encrypted in transit (HTTPS); client data is strictly separated so no client can access another client's data; and all admin account actions are recorded in an audit log.
8. Contact
Questions about this policy or your data: contact@spendwise.site or via the contact page.