Privacy Policy

Your privacy matters to us, Bill-e-Buddy is built for people who already have enough to manage and the last thing we want is to add to that by being unclear about your data. This policy explains what information we collect, why we collect it, how we keep it safe, and what rights you have. We have written it in plain English because we believe that is the only way it is actually useful. If anything in here is unclear, please email us at privacy@bill-e-buddy.com and we will explain it.
This policy applies to personal data collected through the Bill-e-Buddy app and website.

It does not cover third-party sites or services that we may link to, please check their own privacy policies before sharing information with them.

1) Who we are

Bill-e-Buddy (“we”, “us”, “our”) is a personal finance support app designed to help people track bills and manage money in a more ADHD-friendly way.

Data Controller:
Bill-e-Buddy Limited, UK Company No. 16510682, Lowin House, Tregolls Road, Truro, Cornwall, TR1 2NA
Data Protection Officer:
Marnie McLeod – Hyplon, contactable at privacy@bill-e-buddy.com
ICO Registration Number:
C1826879
General privacy contact:
privacy@bill-e-buddy.com
Website:
https://bill-e-buddy.com

2) The short version

Here is what matters most:
We collect only the information we need to run Bill-e-Buddy, keep it secure, and improve it.
We do not sell personal data.
Where we use suppliers (such as hosting, analytic providers, email, and payments), they only process data on our behalf and under contract.
We use appropriate technical and organisational measures to keep your information safe, but no system is 100% secure.
Where we ask you to share sensitive information about your health, neurodivergence or financial situation, we will also ask for your explicit consent first.
You have rights over your data and we make it easy to exercise them.

3) Law and Regulation

You can depend upon us to comply with the current UK law relating to privacy, data protection and data security. This policy does not provide all the legal detail, but it makes numerous references to the UK General Data Protection Regulation (UK GDPR). All references to Articles are references to provisions of the UK GDPR.
We are also regulated by the Information Commissioner’s Office, and you will see references to the ICO in this policy.

4) The data we collect and why

The information we collect depends on how you use Bill-e-Buddy. Here is a plain-English guide to each category.

A) Account and profile data
When you sign up, we collect your name, email address, and password (stored securely, we never hold your actual password in readable form). You can also set personal preferences and app settings. We use this to create and manage your account, provide the service to you, and contact you about important things like security updates or changes to this policy.

Special category data (Article 9): Where you choose to share information about your health, neurodivergence, or support needs, this is special category data under UK GDPR. We process this only on the basis of your explicit consent (Article 9(2)(a)). You can withdraw that consent at any time by emailing privacy@bill-e-buddy.com.

B) Financial and bills data you provide
This is the core of what Bill-e-Buddy does. We collect the bills, amounts, due dates, categories, notes, reminders, and budgeting settings you enter, including your “safe-to-save” figures. We use this to power the app’s tracking, reminder, planning, and insight features.

A note on financial data: Financial information, particularly data about bills, debt, spending difficulty, or financial stress is not classified as special category data under UK GDPR Article 9. However, we treat it as sensitive in practice. Many of our users are managing financial difficulty alongside neurodivergent challenges, and we recognise that this data could cause real harm if mishandled. We apply the same high standard of care to your financial data. We will not make decisions about you that you have not consented to, and we will never share your financial data in a way that could disadvantage or identify you.

C) Financial and bills data from integrations
If you choose to connect a third-party service, such as open banking, we will receive data from that provider to the extent needed to run the features you have enabled. That data is additionally protected under the Payment Services Regulations 2017 and applicable Financial Conduct Authority (FCA) rules. You are always in control of which integrations you turn on, and you can turn them off at any time.

D) Communications and support data
If you contact us for support or send feedback, we keep a record of that correspondence so we can respond properly and improve the product and service Bill-e-Buddy offers. If we ever ask to record a call or interview, we will only do so with your consent.

E) Optional survey and Bill-e LLM interaction data
From time to time we may invite you to take part in surveys, research, or optional community insight activities. We may also collect information from your interactions with the Bill-e-Buddy AI assistant, called Bill-e LLM. This can include information about your conditions, symptoms, lived experience, or support needs relating to ADHD, neurodivergence, and money management.

Important:
This type of information is sensitive and we will treat it with extra care. We will only collect it on an opt-in basis. Before we ask, we will explain exactly what we are collecting, why, how it will be used, and how long it will be kept. You can skip questions or stop participating in optional surveys, research, or feedback activities at any time. We will never use this information to make automated decisions about you.

Where we use this data for research or insight purposes, we will anonymise or aggregate it so it cannot identify you personally. We do not sell or share research data with third parties for their own use.

F) Technical data and usage
When you use the app or visit our website, we automatically collect certain technical information, such as your device type, browser, IP address, app events (like which screens you visit), and crash logs. We use this to keep the service secure, troubleshoot problems, detect fraud or abuse, and understand which features are most useful so we can improve them.

G) Cookies (website)
Our website uses cookies and similar technologies to make the site work properly, measure performance, and improve your experience. Non-essential cookies are not set until you have given consent via our cookie banner. For full details see our Cookie Policy.

5) Our Lawful bases under UK GDPR

UK GDPR requires us to have a lawful basis for processing personal data.

Here is how that maps to what we do:

Contract (Article 6(1)(b)): your account, billing, and financial data is necessary to provide the Bill-e-Buddy service to you.

Legitimate interests (Article 6(1)(f)): We have a legitimate interest in keeping the services secure, detecting fraud and abuse, and understanding how users interact with Bill-e-Buddy so we can improve it. We have balanced these interests against your rights and do not consider them to override your interests in these specific contexts. Our Legitimate Interests Assessments are available on request by emailing privacy@bill-e-buddy.com.

Consent (Article 6(1)(a)): Where we rely on consent, for example optional research data, certain cookies, marketing, call recordings, we will ask you clearly and separately. You can withdraw consent at any time.

Legal obligation (Article 6(1)(c)): Where we are required by law to process your data.

6) How we collect data

We collect personal data in three ways:
Directly from you: when you create an account, enter bills, contact support, or take part in research or surveys;
Automatically : when you use the app or visit our website, via technical logs, cookies, and analytics; and
From third parties: if you choose to connect integrations such as open banking.

7) Who we share your data with

We share your personal data only where needed to run Bill-e-Buddy, comply with the law, or protect our users and service.

A) Service providers (subprocessors)
We use trusted third-party suppliers to help deliver the service. They process personal data on our behalf under contracts that require appropriate security and confidentiality. Our current key subprocessors are:

Hosting and infrastructure: Hostinger UK Limited (UK)
Analytics: Google Ireland Limited (Ireland / EEA)
Email service: Google Ireland Limited (Ireland / EEA)
Payments: Stripe, LLC (USA) – transfers covered by the UK International Data Transfer Agreement
Website and app development: Create Better Things Ltd (UK)
Survey (Firebase): Google Ireland Limited (Ireland / EEA) – custom-built survey data stored via Firebase. Firebase uses browser storage rather than cookies: no HTTP cookies are set by the survey
Firebase infrastructure: Google Ireland Limited (Ireland / EEA) – app backend infrastructure and data storage for the Bill-e-Buddy Survey and App service.

We will keep this list up to date. We will not add a subprocessor without first completing due diligence and putting a current agreement in place.

B) Legal and safety
We may share data if required to do so by law, or to enforce our terms, or protect users, the public, or our rights.

C) Open banking and financial data partners
Bill-e-Buddy offers open banking features to premium subscribers through Moneyhub Financial Technology Ltd, a regulated third-party provider authorised by the Financial Conduct Authority as an Account Information Service Provider (AISP). Moneyhub enables us to securely retrieve your financial account data with your permission. You can find out more about how Moneyhub handles your data at Money Hub Global Privacy Policy.

8) International data transfers

We primarily store and process data in the UK and the European Economic Area. Where we transfer personal data outside the UK or European Economic Area, for example Stripe in the USA, we will put appropriate safeguards in place. For Stripe, this is the UK International Data Transfer Agreement (UK IDTA). You can request a copy of the relevant transfer safeguards by emailing privacy@bill-e-buddy.com

9) AI-assisted features and automated processing

A) How Bill-e-Buddy AI works
Bill-e-Buddy uses Artificial Intelligence (AI) to help generate personalised financial insights and guidance. The Bill-e-Buddy AI assistants process information you provide to produce outputs tailored to you. The data inputs that feed into the AI include:

Your bills, amounts, due dates, and budgeting settings
Your “safe-to-save” figures and spending patterns within the app
Your conversations with the Bill-e Chat and Bill-e-Buddy Account AI assistants, these are logged
Feedback you provide through surveys

Where you have opted in: information you have shared about your neurodivergent support needs, ADHD characteristics, or financial behaviours.

B) Special category data and AI – strict rules apply
Because Bill-E-Buddy’s users include people with neurodivergent conditions, that AI may process information that constitutes special category data under UK GDPR, specifically health and conditions-related information. Under the Data (Use and Access) Act 2025, the stricter automated decision-making safeguards continue to apply in full wherever special category data is involved in AI processing, regardless of Article 22 for non-sensitive data.

This means: where Bill-e-Buddy AI assistant processes your health or neurodivergence data as part of generating outputs, we must have your explicit consent (Article 9(2)(a)), and you have the right to request human review of any output that affects you. We will always make that option available to you.

We also recognise that financial data, while not special category data under Article 9 UK GDPR, is functionally sensitive to our users. The Bill-e-Buddy AI Assistant will never use your financial data to produce outputs that could disadvantage you, and you have the same rights to challenge and to request a human review of any AI-generated financial insights as you have over any other output.

C) What the AI does and does not do
The Bill-e-Buddy AI produces personalised suggestions and insights to help you manage your money. These are guidance only, they do not constitute financial advice and do not make decisions about you. No output from Bill-e-Buddy’s AI assistant will determine your access to products, credit, services, or any other decision with legal or significant effect.

D) Your right to challenge an AI output
If you believe an AI-generated output was based on incorrect, incomplete, or irrelevant information, you have the right to challenge it.

To do so:
Please contact us at privacy@bill-e-buddy.com
Describe the output you are querying
Tell us what you think was wrong or missing from the information used

We will review the output, correct any error in the underlying data if needed, and let you know the outcome.

You also have the right to request that a human reviews any AI-assisted output rather than relying on it solely as generated. We will never prevent you from exercising your right.

We do not make solely automated decisions about you that have legal or otherwise significant effects without human oversight. If you have any questions about how the AI features work and what data they use, please contact us at privacy@bill-e-buddy.com.

10) Data security

A) How we protect your data
Because Bill-e-Buddy holds both financial data and health-adjacent information, we set our security standards at the higher end of what is appropriate under UK GDPR Article 32 and the ICO’s guidance on security for organisations processing sensitive personal data.

The measures we have in place include:
Encryption in transit: all data transmitted between your device and our system is encrypted using TLS.
Encryption at rest: personal data stored on our system is encrypted at rest.
Access controls: access to personal data is restricted to those who need it to do their job, on a least-privilege basis which means only the people who genuinely need to see your data to do their job can access it.
Monitoring and logging: we monitor our systems for unusual activity and maintain audit logs
Supplier security: all subprocessors are contractually required to meet the same Article 32 security standards we apply ourselves. We carry out due diligence on suppliers before engaging them.
Secure backups: data is backed up securely and regularly tested for recovery

B) AI and security
The same security standards apply to AI-assisted processing as to all other data processing. Where the Bill-e-Buddy AI Assistant processes your personal data, access to that processing is authenticated, activity is logged, and the same security safeguards are applied. 

C) What to do if you think your account has been compromised
Please keep your login details confidential and do not share with anyone. You are responsible for keeping your login details confidential. If you think your account may have been accessed without your permission and has been compromised, contact us immediately at privacy@bill-e-buddy.com so we can investigate and take steps to protect your data.

If there is a data breach:
Despite our best efforts, no system is completely secure. If a breach occurs that is likely to affect your personal data or your privacy, we will notify you without undue delay. We will tell you what happened, what data was involved, what we are doing about it, and what steps you can take to protect yourself. 

11) How long we keep your data
We keep personal data only for as long as necessary for the purposes described in this policy.

Typical retention approach:
Account data: kept for the life of your account, and deleted within 90 days of account closure.
Bills and financial data: kept while your account is active, and deleted or anonymised within 90 days of account closure, unless we are required to keep it longer for legal reasons).
Support communications: kept for 2 years from the resolution of your request, or as long as needed to resolve your request and maintain adequate records.
Security logs: kept for 90 days.
Optional research and survey data: kept for 12 months from the date of collection, after which it will be anonymised or deleted when no longer needed for the stated research purpose.

If you would like your data deleted sooner, you can exercise your right to erasure at any time – see Section 12.

12) Your rights

Under UK GDPR, you have the following rights in relation to your personal data.

Access: you can request a copy of the personal data we hold about you;
Correction: you can ask us to correct inaccurate or incomplete data;
Erasure: you can ask us to delete your personal data in certain circumstances;
Portability: you can ask us to provide your data in a machine-readable format so you can transfer it;
Restriction: you can ask us to limit how we use your data in certain circumstances; and
Withdrawal of consent: where we rely on your consent, you can withdraw it at any time. This will not affect anything we did before you withdraw.
Rights in relation to AI and automated processing: where AI is used to process your data, you have the right to understand the logic involved, to challenge an output you think is wrong, and to request human review. See Section 9D for how to do this.

Right to object: You have the right to object at any time to our processing of your personal data where we rely on legitimate interests as our lawful basis. To do this, please email privacy@bill-e-buddy. We may need to verify your identity before we respond. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.

To exercise any of these rights, email us at privacy@bill-e-buddy.com. We may need to verify your identity before we can respond. We will always respond within one month.

You also have the right to make a complaint to the ICO if you are unhappy with how we have handled your data: https://ico.org.uk/make-a-complaint/

13) Children and young people

Bill-e-Buddy is intended for users aged 13 and over. This is the minimum age for digital consent in the UK under Article 8 UK GDPR and the Data Protection Act 2018.

We do not knowingly collect personal data from anyone under 13. If you are under 13 and have created an account, please ask a parent or guardian to contact us at privacy@bill-e-buddy.com so we can delete your data.

If you are between 13 and 17, the ICO’s Children’s Code (Age Appropriate Design Code) applies to how we handle your data. We do not use data from under 18-users for behavioural advertising or profiling. We comply with the Data (Use and Access) Act 2025, which has further strengthened children’s data protections by requiring online services like ours to take children’s higher protection needs into account in our data protection by design obligations.

14) Research, surveys, and community insights

From time to time, we may invite you to take part in surveys, pre-launch research, feedback activities, or optional community insight projects. These are designed to help us understand the real needs and experiences of neurodivergent people, and to make Bill-e-Buddy genuinely better.
Participation is voluntary and opt-in. You do not have to take part to use Bill-e-Buddy. You can skip questions or stop participating at any time without any effect on your account or service.

What we collect
When you take part in a survey or research activity, we may ask you about:
how you feel about money and financial tasks
your financial habits and behaviours
your neurotype (for example, whether you identify as ADHD, autistic, or dyslexic)
your sensory and communication preferences
your age, gender, and where in the UK you live
how your income arrives, and who you manage money for
If you sign up to join our Co-Design Team via our website, we also collect your first name, last name, email address, and optionally your post code.

This is sensitive information
Some of what we ask about, particularly your neurotype and how you experience money emotionally is classified as special category data under UK data protection law. This type of data gets extra protection, and we only collect it with your explicit consent.

How we use it
We use your response to shape how Bill-e-Buddy works, its features, design, and tone. Where findings are published or shared (for example, to support funding or product decisions), they will always be anonymised or aggregated so they cannot identify you personally. We do not sell or trade research data.

How long we keep it
We keep survey responses for 12 months. If you would like your responses deleted before then, you can contact us at privacy@bill-e-buddy.com or use the electronic form below and we will remove and send you a response to state the removal within 30 days of receiving your request.

The legal basis for collecting this data
We collect and use your survey responses on the basis of your explicit consent. You can withdraw your consent at any time by contacting us (See section 17 – Contact Us). This will not affect anything that happened before you withdrew it.

15) Changes to this policy

We may update this policy from time to time. When we do, we will post the updated version on this page and update the “last updated” date at the top.

If we make material changes to our app or service, particularly to how we use your health or neurodivergence data, we will notify you directly by email before the change takes effect so you have a chance to review it and, where relevant, withdraw consent.

16) How to raise a data protection complaint

We take all data protection concerns seriously. If you think we have handled your personal data incorrectly, of if you have any concerns about how we use your information, including how our AI features process your data, we want to hear from you directly first.

Step 1 – Contact us
Email use at privacy@bill-e-buddy.com with a description of your concern. You can also use the electronic complaint form by clicking here. We will acknowledge your complaint within 30 days of receiving it, and will take appropriate steps to investigate and respond to your without undue delay.

Step 2 – Escalate to ICO
If you are not satisfied with our response, or if you would prefer to go directly to the regulator, you have the right to make a complaint to the UK Information Commissioner’s Office (ICO):

Website: https://ico.org.uk/make-a-complaint/
Telephone: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We encourage you to contact us first as we would genuinely like the opportunity to put things right.

17) Contact us

For any questions about this policy or about how we handle your personal data, please get in touch.

Email: privacy@bill-e-buddy.com
Data Protection Officer: Marnie McLeod – Hyplon
Post: Bill-e-Buddy Limited, Lowin House, Tregolls Road, Truro, Cornwall, TR1 2NA