Privacy Policy

Introduction

Welcome to Endless Curiosity Ltd’s (“we”, “us”, “our”) privacy policy. This privacy policy explains who we are, what personal data we collect, why we collect it, how we use it, who we share it with and how long we keep it. It also explains your rights and how to contact us or the Information Commissioner’s Office (ICO).

Controller and how to contact us

Endless Curiosity Ltd is the controller of your personal data when we supply our personal financial management subscription software services to you or when you use or browse our website.

If you have questions about this policy or how we handle your data, please contact our data privacy manager:

Email: [email protected]

Registered address: The Accountancy Partnership, 70 Grange Road East, Wirral, United Kingdom, CH41 5FE

Your right to complain

If you have any concerns about how we collect, use, or handle your personal data, you have the right to make a complaint to us. You can do this by contacting us using the details above.

Please provide enough information to help us understand and investigate your complaint.

We will acknowledge your complaint within 30 days of receiving it and will respond without undue delay. If we need further information from you in order to investigate your complaint, we may contact you.

We encourage you to contact us first so that we have the opportunity to investigate and try to resolve the issue. However, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues. Further information about how to do this can be found on the ICO’s website: https://ico.org.uk.

Keeping your data up to date and policy updates

Please keep us informed if your personal data changes during your relationship with us.

We keep this policy under regular review. This version was last updated in September 2026

Third‑party links and services

Our website may contain links to third‑party websites, plug‑ins and apps. Clicking on those may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy statements.

If you access our services via third‑party apps, websites or services (for example, social media platforms), your use is subject to their terms and privacy policies.

1. What data we collect

Personal data means any information about an individual from which that person can be identified. It does not include anonymous data.

Identity Data: name.
Contact Data: email address.
Marketing Data: your marketing preferences.
Financial Data: We collect financial information that you enter into the service, which may include income information, account names and balances, spending information, debts, savings goals and tax figures. We do not collect or store bank account credentials or payment card details.
Transaction Data: payments to and from you and details of products purchased.
Usage Data: information about how you use our website, IT, communications and other systems.
Technical Data: IP address, browser type and version, pages visited, dates/times, time on page, device type, operating system, unique identifiers, device settings and geo‑location data.

Aggregated and special category data

We also use Aggregated Data (statistical or demographic data) that may be derived from personal data but does not identify you. If we combine it with personal data so it can identify you, we treat it as personal data.

We do not intentionally collect special category data or data about criminal convictions and offences.

If you do not provide data

If you do not provide data we need by law or under a contract, we may be unable to perform the contract and may have to cancel a product you have purchased. We will notify you if so.

2. How we collect your data

Direct interactions

You may give us data when you create an account, use the application, subscribe to the subscription service, subscribe to publications, request marketing, give feedback or contact us by phone, email or otherwise.

Automated technologies

We collect Technical Data about your equipment using cookies, server logs and similar technologies.

Third parties

We receive data from providers of technical, payment and delivery services (such as Stripe).

3. How and why we use your data and our lawful bases

We only use your personal data when the law allows.

The main lawful bases that we rely on are: to perform a contract with you; for our legitimate interests (and your interests and rights do not override those interests); to comply with legal obligations; and, in limited cases, with your consent.

Purposes and lawful bases

We use your data for the purposes below. For each, we state the lawful basis. Where legitimate interests apply, we explain them in plain language.

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
Registering users and creating accounts	Identity and Contact	Performance of a contract with the user
Providing access to and operating the service	Identity, Contact, Financial, Technical and Usage	Performance of a contract with the user
Generating financial forecasts, tax estimates and cashflow projections	Identity, Financial	Performance of a contract with the user
Managing subscriptions and billing	Identity, Contact and Transaction	Performance of a contract with the user
Sending transactional and service communications, including sign-in links and account notifications	Contact, Technical	Performance of a contract with the user
Operating security measures, fraud prevention and authentication controls	Technical	Legitimate interests in securing the platform, preventing unauthorised access and maintaining service integrity
Maintaining audit logs and monitoring platform usage	Usage and Technical	Legitimate interests in operating, supporting and improving the service, troubleshooting issues and maintaining security records
Analysing aggregated website and application usage through cookieless analytics	Aggregated Usage and Limited Technical	Legitimate interests in understanding and improving service performance and user experience
Managing customer support enquiries and responding to communications	Identity, Contact, Usage	Performance of a contract with the user and legitimate interests in providing effective customer support
Sending marketing communications and newsletters	Contact, Marketing	Consent
Maintaining legal, regulatory and tax records	Identity, Contact, Transaction	Compliance with legal obligations
Enforcing terms, defending legal claims and protecting business interests	Identity, Contact, Technical, Usage, Transaction	Legitimate interests in protecting the business, users and legal rights

Marketing and opting out

We aim to give you choices about marketing.

If you are an individual customer, you may receive marketing from us if you have consented, or if you requested information or purchased from us and have not opted out.

You can opt out of marketing at any time by using unsubscribe links or by emailing us. Opting out does not affect service messages related to purchases or other transactions.

Use of AI tools

We do not use AI tools to support the provision of our services.

Cookies

We only use strictly necessary cookies on our website.

Change of purpose

We will only use your data for the purposes we collected it for unless we reasonably consider we need to use it for another compatible reason. If we need to use it for an unrelated purpose, we will notify you and explain the legal basis. We may process your data without your knowledge or consent where required or permitted by law.

4. Sharing your data

We may share your personal data with third parties including:

service providers acting as processors such as hosting and infrastructure providers, security and traffic management providers, encryption key management providers, payment processing providers, transactional email delivery providers and analytics providers;
professional advisers (lawyers, bankers, auditors, insurers);
HMRC and other UK authorities; and
third parties involved in a sale, transfer or merger of our business.

We require third parties to respect the security of your data and to process it only for specified purposes and in accordance with our instructions.

5. International transfers

We aim to store and process personal data within the UK and EEA where possible, however, in some instances we may transfer your data outside the UK. We will ensure an adequate level of protection by transferring to countries deemed adequate or by using UK‑approved contractual safeguards.

For details, contact: [email protected]

6. Data security

We implement security measures including encryption of financial information at application level, separation of identity information from financial information, encrypted communications using TLS, access controls, audit logging, and infrastructure and network security protections. While no system can be guaranteed completely secure, we take security seriously and continuously review our safeguards.

For details, contact: [email protected]

7. How long we keep your data

We keep your data only as long as necessary for the purposes we collected it for, including to satisfy legal, regulatory, tax, accounting or reporting requirements, and longer where there is a complaint or a prospect of litigation.

We consider the amount, nature and sensitivity of the data, the risk of harm, the purposes of processing and whether these can be achieved by other means, and applicable requirements.

For details, contact: [email protected]

8. Your rights

You can contact us at [email protected] to exercise your rights.

You will not usually have to pay a fee to access your data or exercise your rights. We may charge a reasonable fee or refuse a request if it is unfounded, repetitive or excessive.

We may need information to confirm your identity and to help us respond.

We aim to respond within one month. If your request is complex or you have made multiple requests, we may take longer and will keep you updated.

Your legal rights

Access: You can request a copy of the personal data we hold about you and check we are processing it lawfully.

Correction: You can ask us to correct incomplete or inaccurate data. We may need to verify the accuracy of the new data.

Erasure: You can ask us to delete your data where there is no good reason for us to continue processing it, where you have objected successfully, where we processed it unlawfully or where we must erase it to comply with law. We may not always be able to comply for specific legal reasons, which we will explain if applicable.

Objection: You can object to processing based on our legitimate interests if you feel it impacts your rights and freedoms, and you can always object to direct marketing. We may demonstrate compelling legitimate grounds to continue processing in some cases.

Restriction: You can ask us to suspend processing where you want us to check accuracy, where processing is unlawful but you do not want erasure, where you need us to keep data to establish, exercise or defend legal claims, or where you have objected and we are considering our grounds.

Portability: You can ask us to transfer your data to you or a third party in a structured, commonly used, machine‑readable format. This applies to automated information you provided, where we process it based on consent or contract.

Withdraw consent: Where we rely on consent, you can withdraw it at any time. This will not affect processing carried out before withdrawal. If you withdraw consent, we may be unable to provide certain services and will advise you if so.

Last updated: 15 September 2026