Privacy Policy

Last updated: 6 May 2026

1. Who We Are

Ledgr360 ("we", "our", "us") is a household financial management platform. We are committed to protecting your personal data and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect and process the following categories of personal data:

• Account information: Name, email address, and password (hashed).
• Household data: Household name, member names, roles, and relationships you choose to add.
• Financial data: Renewal amounts, subscription details, income, savings balances, and property information you enter.
• Connected services: If you connect your email or bank account, we access limited data (email subjects/senders for renewal detection, transaction data for recurring payment identification) via secure OAuth connections.
• Documents: Files you upload such as contracts, bills, and receipts.
• Usage data: Pages visited, features used, and technical information (browser type, device).

3. How We Use Your Data

We use your data to:

• Provide and improve the Ledgr360 service
• Send renewal reminders and notifications you've configured
• Detect recurring payments and subscriptions from connected accounts
• Process payments and manage your subscription
• Provide customer support
• Comply with legal obligations

4. Legal Basis for Processing

• Contract: Processing necessary to provide the service you've signed up for.
• Consent: For optional features like email scanning and analytics cookies.
• Legitimate interest: To improve our service and prevent fraud.
• Legal obligation: To comply with applicable laws and regulations.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Your household members: Data you add to your household is visible to other members you invite.
• Service providers: We use trusted third parties for hosting, payment processing (Stripe), email delivery, and bank connectivity (Plaid), all bound by data processing agreements.

We do not sell, rent, or transfer your personal data — including any data obtained from Google APIs — to third parties, data brokers, or advertisers.

6. Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete all your personal data within 30 days, except where we are required by law to retain it (e.g., financial records for tax purposes).

7. Your Rights

Under UK GDPR, you have the right to:

• Access: Request a copy of your personal data (available via Settings → Data Export).
• Rectification: Correct inaccurate data via your account settings.
• Erasure: Delete your account and all associated data (available via Settings → Delete Account).
• Portability: Export your data in a machine-readable format (JSON).
• Objection: Object to processing based on legitimate interest.
• Withdraw consent: Where processing is based on consent, you can withdraw it at any time.

8. Cookies

We use essential cookies to keep you signed in and remember your preferences. We only use analytics cookies with your explicit consent. You can change your cookie preferences at any time by clearing your browser data.

9. Data Security

We implement industry-standard security measures including encryption in transit (TLS), row-level security policies on all database tables, secure OAuth token handling (tokens are never exposed to the frontend), and multi-factor authentication support.

10. International Transfers & Children

Ledgr360 is intended for adults aged 18 and over. We do not knowingly collect personal data from children. Your data is primarily processed within the UK and EEA. Where any sub-processor operates outside these regions, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement or Standard Contractual Clauses.

11. Google User Data

If you choose to connect your Google account for email scanning, the following applies to data obtained via the Gmail API:

• What we access: We request the Gmail API read-only scope (gmail.readonly) to access email metadata including subject lines, sender addresses, and dates. We do not access email attachments or full message bodies.
• How we use it: We scan email metadata solely to detect renewal-related messages and extract structured data such as service name, renewal amount, frequency, and renewal date, used only to populate your renewal tracker within Ledgr360. We do not use Google user data for advertising, profiling, credit decisions, resale, or to train, fine-tune, or develop generalised AI/ML models.
• How we store it: Only the extracted renewal information is stored in your Ledgr360 account. Raw email content is processed in memory and is not persisted. OAuth tokens are stored encrypted server-side and are never exposed to the browser.
• Retention & deletion: Extracted renewal data is retained while your account is active. Disconnecting your Gmail account purges all stored Gmail-derived metadata and revokes our tokens within 30 days. Deleting your Ledgr360 account removes all associated Google-derived data within 30 days.
• How we share it: Google user data is never sold, rented, or transferred to third parties, data brokers, or advertisers for any purpose beyond providing the Ledgr360 service to you, as described in Section 5.
• Security: Google user data is protected with TLS in transit, encryption at rest, row-level security policies, and strict access controls limited to authorised personnel performing service maintenance.
• Revocation: You can disconnect your Google email account at any time from Settings, which immediately revokes Ledgr360's access. You can also revoke access directly from your Google Account permissions.

Ledgr360's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

12. Contact Us

If you have questions about this policy or wish to exercise your rights, please contact us.