Privacy Policy
Last updated 30 October 2026
Version 4.2 | Last updated 30 October 2026
1. About this Privacy Policy
1.1 This Privacy Policy explains how Earnly Limited, a private limited company registered in England and Wales (company number 16183799), whose registered office is at 41 New Cross Street, Swinton, Manchester, England, M27 4TU ("Earnly", "we", "us", "our"), collects, uses, shares and keeps personal data when you use the Earnly platform (the "Platform") and the services provided through it (the "Services"), when you visit our website at earnly.co.uk or join our waitlist, when you contact us, and when information about you reaches us through someone else's use of the Platform.
1.2 It is given to meet our obligations under Articles 13 and 14 of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 ("DPA 2018") as amended by the Data (Use and Access) Act 2025 ("DUAA"), and the Privacy and Electronic Communications (EC Directive) Regulations 2003 ("PECR").
1.3 This Privacy Policy is incorporated into the agreement between you and Earnly (the "Agreement") under the "Documents forming part of the Agreement and order of precedence" clause of the Terms and Conditions. Accepting the Agreement is not consent to any processing for which we rely on consent; where we rely on consent, we ask for it separately. If there is a conflict between documents forming the Agreement, the order of precedence in that clause applies, under which this Privacy Policy prevails on any matter concerning the processing of personal data. Nothing in the Terms and Conditions limits your rights under data protection law.
1.4 The Platform is a responsive web application. We do not currently offer a native mobile app. If we release mobile apps, this Privacy Policy applies to them too.
1.5 Definitions. In this Privacy Policy:
1.5.1 "Account" means an account registered with Earnly to use the Platform;
1.5.2 "Business Day" means Monday to Friday, excluding bank holidays in England and Wales;
1.5.3 "Business User" means anyone using the Platform for a trade, business or profession, including without limitation a sole trader, contractor, freelancer, partnership, LLP, limited company or other organisation, and any individual (for example a director) acting on its behalf;
1.5.4 "Connected Account" means a bank or payment account that has been authorised to be linked to an Account through the Provider;
1.5.5 "Consumer" means an individual acting wholly or mainly outside their trade, business, craft or profession;
1.5.6 "Counterparty" means a person, other than the Account holder, who is named or identifiable in Open Banking Data or other information on the Platform, for example the payer or payee of a transaction;
1.5.7 "Individual" means any natural person who uses the Platform, whether as a Consumer or as a sole trader or other Business User;
1.5.8 "Open Banking Data" means the account details, balances and transaction data obtained from a Connected Account through the Provider;
1.5.9 "Organisation" means a company, LLP, partnership or other entity that is a Business User;
1.5.10 "Outputs" means the categorisations, confidence scores, estimates, forecasts, summaries and other results generated by the Platform; and
1.5.11 "Provider" means Finexer Ltd (company number 12191948), registered office 124 City Road, London, EC1V 2NX.
2. Who this applies to
2.1 This Privacy Policy applies to every Individual whose personal data we process, whatever their reason for using the Platform. Every Individual has rights under UK data protection law, whether they use the Platform as a Consumer or as a Business User.
2.2 If you are a Consumer, this Privacy Policy applies to all the personal data we hold about you.
2.3 If you are a sole trader, contractor, freelancer or member of a partnership, the information about your business is also information about you. We treat your business records, transactions and tax information as your personal data and apply this Privacy Policy to all of it.
2.4 If you are a director, partner or member registering or managing an Organisation in your Account, this Privacy Policy applies to the personal data we hold about you. Information that is only about the Organisation itself (for example its company number, its corporate bank balances or its Corporation Tax position) is not personal data, but we protect it to the same security standard. Where a record about the Organisation also identifies you or another person, we treat it as personal data.
2.5 One Account can hold one or more companies and a personal profile. The Platform does not currently offer team, staff or accountant access to an Account, so each Account is used only by the Individual who registered it.
2.6 If you are a Counterparty, or another person whose details appear in information an Account holder gives us, section 7 explains how we handle your personal data.
2.7 This Privacy Policy also applies to visitors to our website, people who join our waitlist, and people who contact us or make a complaint.
3. Regulatory status
3.1 Earnly Limited (FRN 1058277) is registered on the Financial Services Register as an agent of Finexer Ltd, which is authorised and regulated by the Financial Conduct Authority under the Payment Services Regulations 2017 (Firm Reference Number 925695) for the provision of account information services. You can check this on the Financial Services Register at register.fca.org.uk. Earnly is not itself authorised by the Financial Conduct Authority. Earnly does not provide payment initiation services, cannot initiate payments or move money, and never receives, sees or stores your online banking credentials.
3.2 The Outputs are information only. They are not tax, accounting, legal, investment or financial advice, they are not a tax return or statutory accounts, and they do not replace the judgement of a qualified adviser. Earnly does not file anything with HMRC or Companies House, is not HMRC-recognised Making Tax Digital software, and is not your tax agent. You must check Outputs before you rely on them or file anything with HMRC, as set out in the Financial Disclaimer and the Terms and Conditions.
4. Who is responsible for your personal data
4.1 Earnly is the controller of the personal data described in this Privacy Policy, except where this section says otherwise. This includes personal data processed in connection with Organisations: Earnly decides how the Platform processes data and acts as a controller, not as a processor for the Organisation.
4.2 Data Protection Lead. Our Data Protection Lead is Adam Marsh, Director. You can contact him at privacy@earnly.co.uk or by post at the address in section 20.
4.3 Data Protection Officer. We have not appointed a Data Protection Officer because the law does not require us to. Earnly is not a public authority, and its core activities do not involve large-scale, regular and systematic monitoring of individuals or large-scale processing of special category data or criminal offence data. Our Data Protection Lead is responsible for data protection compliance instead. We review this position when the Platform reaches 10,000 active users or if our core activities change.
4.4 Registration. Earnly is registered with the Information Commission (ICO) as a data protection fee payer under registration number ZB962890.
4.5 The Provider. Finexer Ltd provides the regulated account information service through which Open Banking Data reaches us. Its roles are:
4.5.1 Finexer is an independent controller for the account information consent journey (the screens where you give and manage your consent and are passed to your bank), the authoritative consent and audit record, security and fraud prevention, and its own regulatory complaints. Finexer explains how it handles personal data in its privacy notice at https://finexer.com/legal/privacy, and its end user terms are at https://finexer.com/legal/end-user-terms. Finexer's data protection contact is privacy@finexer.com and its ICO registration number is ZB841505;
4.5.2 Finexer acts as our processor when it delivers Open Banking Data to us, under Finexer's data processing agreement; and
4.5.3 Earnly is an independent controller of the Open Banking Data it receives and processes to provide the Platform.
4.6 Your bank. Your bank or other account provider is a separate controller of the data it holds about you, under its own privacy notice.
5. The personal data we process
5.1 Identity and contact data: your first and last name, email address and mobile number.
5.2 Account and authentication data: your password (stored only as a secure hash, never in readable form), email verification and two-step verification records, session records, the date, time, document versions and IP address recorded when you accept the Terms and Conditions, and your declaration that you are 18 or over and resident or established in the UK.
5.3 Company data: details of each company you add, taken from the Companies House public register when you search for it (including without limitation company name, number, registered office address, status and incorporation date), together with your VAT registration number, VAT scheme and the VAT-number validity result we obtain from HMRC's public VAT number checker, and your accounting periods.
5.4 Personal tax profile data: the income, allowance and other figures you enter so that the Platform can estimate your personal tax, for example salary, dividends and savings income.
5.5 Open Banking Data: account holder name, account name and type, bank name, sort code, the last four digits of the account number, balances, and transaction detail including dates, amounts, payer and payee names, merchant names, references and narrative text, and the bank's own transaction category, obtained through the Provider under the consent you give.
5.6 Derived data and Outputs: transaction categorisations, VAT treatment notes, confidence scores, review status, detection of transfers between your own accounts, estimates of Income Tax, National Insurance, dividend and savings tax, Corporation Tax, VAT and employer PAYE and NIC, and forecasts and summaries.
5.7 Correction data: the changes you make to categorisations and the merchant rules the Platform learns from your corrections.
5.8 Receipt images: images of receipts and similar documents that you upload and attach to transactions, with their file name and size.
5.9 Support and complaint data: the content of emails, forms and attachments you send to us, any notes of calls arranged as a reasonable adjustment, and records of complaints and data rights requests and how we handled them.
5.10 Waitlist data: if you join our waitlist, your first and last name, email address, industry, company size, country, role, how you heard about us and why you are interested, the date and time you accepted our terms, whether you opted in to marketing and when, and the IP address from which you gave your consent.
5.11 Marketing data: your marketing preferences, opt-ins and opt-outs, and the suppression record that stops us contacting you after you unsubscribe.
5.12 Security and technical data: IP address, browser and device type, date and time of requests, and records of sign-ins, verification codes issued, Open Banking connection and revocation events, and access to personal data by our staff. We do not use analytics or advertising tools that track you. The Cookie Policy explains what is stored on your device.
5.13 Data that stays on your device. If you set up a device PIN on a mobile browser, a salted hash of your PIN is kept in your browser's storage on that device. It is not sent to us.
5.14 Special category data. We do not ask for special category data (information about health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, genetic or biometric data, sex life or sexual orientation). Transaction descriptions can incidentally reveal it, for example a payment to a trade union, a church or a clinic. Our position is:
5.14.1 we do not analyse, infer, record or use any special category characteristic. Our categories are financial categories only;
5.14.2 where special category data appears incidentally, we process it only as part of the transaction record in which it appears, for the categorisation and calculation functions described in this Privacy Policy, and we keep it no longer than that record. The processing is incidental and minimised, and we do not create any separate record of it; and
5.14.3 where we need to use a transaction record containing such data to establish, exercise or defend a legal claim, we rely on Article 9(2)(f) UK GDPR.
5.15 Criminal offence data. We do not collect criminal offence data about users. If we suspect fraud or other crime, we may record that suspicion and report it as described in section 9.
6. Where your personal data comes from
6.1 From you: when you join the waitlist, register, set up or use your Account, add a company, enter tax profile information, upload a receipt, correct an Output, contact us, make a complaint or respond to marketing.
6.2 From your bank, through the Provider: Open Banking Data, obtained only after you give explicit consent to the Provider and authenticate with your own bank. On first connection we import up to five complete UK tax years plus the current tax year of history. After that, data refreshes automatically about every 15 minutes while you are using the Platform, and whenever you open the Platform or select Refresh.
6.3 From public sources: company and officer information from the Companies House public register, and the validity of a VAT number from HMRC's public VAT number checker. When you look up a company or VAT number, we send the company name or number, or the VAT number, to Companies House or HMRC to obtain the result.
6.4 Automatically: security and technical data collected when you use the website or the Platform.
6.5 We do not obtain information about you from credit reference agencies, data brokers or accounting software. The Platform does not currently connect to accounting software.
7. Information about other people
7.1 Counterparties. Open Banking Data often names people other than the Account holder, for example customers who pay a sole trader, suppliers, employees, landlords or family members. We receive this information from the Account holder's bank through the Provider. This section is the information we give to Counterparties under Article 14 UK GDPR:
7.1.1 the controller is Earnly, contactable as set out in section 4;
7.1.2 the data is the Counterparty's name, the payment reference and narrative, and the amount and date of the payment, as they appear in the Account holder's transaction record;
7.1.3 the source is the Account holder's bank, through the Provider;
7.1.4 the purpose is to categorise the Account holder's transactions and produce Outputs for that Account holder, and the lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): the Account holder's and Earnly's interest in keeping accurate financial records;
7.1.5 the recipients are the processors on our Sub-processor List, and the data is stored primarily in Ireland, with some providers in the United States under the safeguards in section 12;
7.1.6 the data is kept only as part of the Account holder's Open Banking Data and is deleted with it (section 13); and
7.1.7 Counterparties have the rights described in section 15, including the right to object and the right to complain to us and to the Information Commission (ICO).
7.2 We do not contact Counterparties individually. We have assessed that doing so would involve disproportionate effort within Article 14(5)(b) UK GDPR, because:
7.2.1 we hold no contact details for Counterparties, only a name or reference as it appears in a bank transaction, often abbreviated or incomplete;
7.2.2 to contact them we would have to collect additional personal data about them that we do not otherwise need, which would itself be more intrusive than the processing;
7.2.3 Open Banking Data across all Accounts contains a very large number of Counterparties, most of whom appear in a single payment; and
7.2.4 the processing has a limited effect on Counterparties: it is confined to the Account holder's own records of payments that the Counterparty already knows were made.
7.3 Because we rely on Article 14(5)(b), we apply these safeguards to protect Counterparties:
7.3.1 we publish this information in this Privacy Policy;
7.3.2 we use Counterparty data only within the Account holder's records. We do not build profiles of Counterparties, contact them, use their data for marketing, or combine their data across different Accounts;
7.3.3 merchant keywords that are personal names, person-to-person payment references or account references are excluded from the anonymised merchant consensus table (section 10);
7.3.4 Counterparty data is deleted with the Account holder's Open Banking Data (section 13); and
7.3.5 the data is protected by the security measures in section 14.
7.4 If you are a Business User, you must only connect accounts and enter information that you are entitled to share with us. If you are a Consumer, we do not ask you to take on any wider obligation, but you must only connect accounts you are entitled to access.
7.5 Joint accounts. If you connect a joint account, the other account holder's transaction data will be processed. You must only connect a joint account where you are entitled to do so under the account's terms. We treat the other account holder's personal data in the same way as Counterparty data under this section.
8. How the Open Banking connection works
8.1 The connection to a Connected Account is made through the Provider, which is the authorised account information service provider. You give explicit consent to the Provider in its consent journey and then authenticate in your own bank's journey. Your online banking credentials are entered only with your bank and are never received, seen or stored by Earnly.
8.2 To set up the connection, we give the Provider your name or your company's name, your email address and an internal reference for your Account, so that it can create your connection record.
8.3 Access is limited to account details, balances and transactions. It does not include payment initiation. Neither the Provider nor Earnly can move money from a Connected Account.
8.4 We use Open Banking Data only to provide the Services you have asked for. We do not sell it, use it for marketing or advertising, or share it with anyone for their own purposes.
8.5 Access lasts 90 days. You must reconfirm your consent at least every 90 days, through the Provider's flow, to keep the connection active. Reconfirming does not normally require you to log in to your bank again, although your bank may ask you to. We remind you in the Platform (from 14 days before expiry) and by email 14 days, 7 days and 1 day before the consent expires.
8.6 You can withdraw consent at any time, free of charge and without giving a reason, in the Platform under Settings → Integrations, or directly with your bank. Disconnecting in the Platform revokes your consent with the Provider and stops access immediately.
8.7 When a consent is withdrawn, expires without being reconfirmed, or the Connected Account is disconnected, or when you close your Account, we stop collecting data from that Connected Account at once. A 30-day cooling-off period then applies, during which you can reactivate the connection (by reconfirming or reconnecting it) or your Account, in which case your data is kept, or export your transactions as a CSV file. If you do not reactivate, we delete the Open Banking Data at the end of the cooling-off period. Withdrawing consent stops future access. It does not make earlier processing unlawful and does not close your Account.
8.8 The Open Banking Consent Notice gives more detail.
9. Purposes, lawful bases and retention
9.1 The table sets out each purpose for which we process personal data, the data used, our lawful basis, and how long we keep it. Retention is explained further in section 13 and in our Data Retention Policy.
| Purpose | Categories of data | Lawful basis | Retention |
|---|---|---|---|
| Creating and running your Account, verifying your email address and providing the Services | Identity and contact, account and authentication, company, personal tax profile | Contract (Article 6(1)(b)) | While the Account is open, then deleted at the end of the 30-day cooling-off period after Account closure, except the contract record below |
| Connecting a Connected Account and retrieving Open Banking Data | Identity and contact, Open Banking Data | Contract (Article 6(1)(b)), on the explicit consent you give to the Provider for the account information service under the Payment Services Regulations 2017 | While the connection is active, then deleted at the end of a 30-day cooling-off period after it ends |
| Categorising transactions (including AI-assisted categorisation, where only a cleaned merchant name and amount are sent to Anthropic to suggest a category, as explained in section 10), detecting transfers, estimating tax and producing forecasts and other Outputs | Open Banking Data, company, personal tax profile, derived data and Outputs, correction data | Contract (Article 6(1)(b)) | Transaction-level data: as for Open Banking Data. Other Outputs: while the Account is open, then deleted at the end of the 30-day cooling-off period after Account closure |
| Storing receipt images you upload | Receipt images | Contract (Article 6(1)(b)) | Until you delete them, and in any case deleted at the end of the 30-day cooling-off period after Account closure |
| Looking up company details and checking VAT numbers | Company data | Contract (Article 6(1)(b)) | While the Account is open, then deleted at the end of the 30-day cooling-off period after Account closure |
| Processing Counterparty and joint account holder data contained in Open Banking Data | Names, references, amounts and dates in transaction data | Legitimate interests (Article 6(1)(f)) of the Account holder and Earnly in keeping accurate financial records | As for Open Banking Data |
| Building and using the anonymised merchant consensus table (section 10) | Merchant keyword and chosen category, with no user, account or company identifier | Legitimate interests (Article 6(1)(f)) in providing accurate categorisation to all users. Once the controls in section 10 apply, the table is not personal data | Kept indefinitely in anonymised form |
| Service communications about your Account, security, consent expiry and changes to our terms | Identity and contact | Contract (Article 6(1)(b)); legal obligation (Article 6(1)(c)) where notice is required by law | While the Account is open |
| Securing the Platform, two-step verification, preventing and detecting fraud and misuse, and investigating incidents | Account and authentication, security and technical data, Open Banking Data where relevant | Legitimate interests (Article 6(1)(f)) in network and information security and protecting users; recognised legitimate interest (Article 6(1)(ea)) where we detect, investigate or prevent crime; legal obligation (Article 6(1)(c)) where a statutory duty applies | Security and audit logs: 12 months. Application diagnostic logs: 30 days. Longer only while an incident is under investigation |
| Disclosures to public bodies, law enforcement and regulators that ask for data to carry out their public tasks, and safeguarding and emergencies | Any relevant category | Recognised legitimate interest (Article 6(1)(ea) and Annex 1 UK GDPR); legal obligation (Article 6(1)(c)) | Record of each disclosure: 6 years |
| Support | Identity and contact, support data, any data relevant to the request | Contract (Article 6(1)(b)); legitimate interests (Article 6(1)(f)) in helping people who are not customers | 2 years from the last message, or as for complaints if the contact becomes a complaint |
| Managing the waitlist and telling you when you can join | Waitlist data | Legitimate interests (Article 6(1)(f)) in managing interest in the Platform you asked to hear about | Until you create an Account, ask to be removed, or 24 months after you joined, whichever is first |
| Marketing by email to people who have opted in, including waitlist members | Identity and contact, marketing data | Consent (Article 6(1)(a) and regulation 22(2) PECR) | Until you withdraw consent. Consent records: 2 years after withdrawal. Suppression record: kept while needed to stop further contact |
| Marketing by email to existing customers about similar Earnly services | Identity and contact, marketing data | Legitimate interests (Article 6(1)(f)), using the soft opt-in under regulation 22(3) PECR | Until you opt out or close your Account. Suppression record: kept while needed to stop further contact |
| Handling complaints, including complaints about the account information service and data protection complaints | Any relevant category | Legal obligation (Article 6(1)(c)), including the FCA complaints rules applying through the Provider and section 164A DPA 2018; legitimate interests (Article 6(1)(f)) | 6 years from closure of the complaint |
| Responding to requests to exercise your data protection rights | Identity and contact, the data concerned | Legal obligation (Article 6(1)(c)) | 6 years from closure of the request. Copies of data disclosed: 30 days after the response |
| Keeping a record of our contract with you and of your Open Banking consents | Identity and contact, terms and policy versions accepted with date, time and IP address, age and residence declaration, consent dates and scope | Legitimate interests (Article 6(1)(f)) in evidencing our contract and the lawfulness of each access | 6 years from the end of the Agreement, or from the end of the consent for consent records |
| Establishing, exercising or defending legal claims | Any relevant category | Legitimate interests (Article 6(1)(f)) in protecting our legal position; Article 9(2)(f) for any special category data | For the limitation period and while a claim is live |
| Managing a corporate transaction such as a financing, merger or sale of the business | Identity and contact, aggregated business data | Legitimate interests (Article 6(1)(f)) in the orderly conduct of corporate activity, under confidentiality restrictions | For the duration of the transaction, then deleted by recipients who do not proceed |
9.2 Legitimate interests. Where we rely on legitimate interests (Article 6(1)(f)), we have assessed whether the processing is necessary for the interest identified, whether a less intrusive route would achieve the same result, and whether the processing is within your reasonable expectations, and we have balanced our interests against your interests, rights and freedoms. Our assessments are recorded in writing and reviewed at least annually. You may ask for a summary of any assessment by emailing privacy@earnly.co.uk, and you may object as described in section 15.
9.3 Recognised legitimate interests. Since 5 February 2026 the UK GDPR has allowed processing for certain "recognised legitimate interests" listed in Annex 1, including disclosures to public bodies that ask for data for their public tasks, national security and defence, emergencies, detecting, investigating or preventing crime, and safeguarding vulnerable individuals. For these purposes the law does not require a balancing test, but we still disclose only what is necessary and keep a record of each disclosure.
9.4 Consent. Where we rely on consent, you can withdraw it at any time, as easily as you gave it, using the unsubscribe link in our emails or the contact details in section 20. Withdrawal does not affect processing before it.
9.5 Do you have to give us your data? You must give us your name, email address, mobile number and a password, and make the age and residence declaration, to create an Account, because we need them to enter into and perform the Agreement. Connecting a Connected Account is your choice, but the main features of the Services depend on it. Your personal tax profile, company details and receipts are optional, but the related features will not work without them. Marketing is always optional. If you do not give us information we need, we may not be able to provide some or all of the Services.
9.6 Your mobile number. We use your mobile number only to contact you about your Account or its security where we cannot reach you by email, or to arrange a telephone call where you ask for one as a reasonable adjustment. We do not send marketing by text message or telephone.
9.7 New purposes. We will use personal data for a new purpose only if it is compatible with the purpose for which we collected it, or if the law otherwise permits it, and we will update this Privacy Policy before we start.
9.8 Paid plans. The Platform is free of charge during early access and we do not collect payment card details. If we introduce paid plans, we will update this Privacy Policy and name our payment provider on the Sub-processor List before we take any payment.
10. Categorisation, AI and automated decision-making
10.1 How Outputs are produced. The Platform categorises each transaction first using rules-based, deterministic logic that runs within Earnly's own systems, together with your own merchant rules and the merchant consensus table described in section 10.3. Only where none of these can assign a category, the Platform asks a third-party AI model to suggest one, as explained in section 10.4. Each proposed category has a confidence score from 0 to 100. The score shows how strong the matching rule is. It is not a probability that the category is correct.
10.2 Review. Proposals scoring 95 or more are marked as reviewed automatically. All others are shown to you for review. You can change any category at any time, and your corrections always take precedence over the Platform's proposals. The Platform learns merchant rules from your own corrections and applies them only to your data.
10.3 The merchant consensus table. To improve categorisation for everyone, when users confirm or change a category the Platform records an anonymised entry in a shared table. The table stores only a merchant keyword of at least three characters, a category, a count of confirmations and the date of the last confirmation. It holds no user, account or company identifier and no amounts. A keyword is used only where at least 60% of confirmations agree on the same category. Keywords that are personal names, person-to-person payment references or account references are excluded. Once these controls apply, no entry can be linked to any user or Counterparty, and the table is not personal data. A category suggested by the AI model described in section 10.4 is added to the table only once a user confirms it.
10.4 AI-assisted categorisation. Where our rules, your own merchant rules and the merchant consensus table cannot categorise a transaction, we use Anthropic's Claude Haiku 4.5 model, called from our platform backend, to suggest a category. It works as follows:
10.4.1 What we send. We send only a cleaned merchant name (for example "BT") and the transaction amount (for example £123.34).
10.4.2 What we never send. We never send your name or contact details, any user, company, Account or bank account identifier, account numbers or sort codes, raw bank descriptions, payment references or transaction dates, the names of your customers, or any other data in your Account.
10.4.3 What we exclude. Before anything is sent, we remove payments to or from individuals, person-to-person payments and transfers between your own accounts. These are never sent.
10.4.4 Who processes it. The model is provided by Anthropic Ireland, Limited, with Anthropic, PBC in the United States as its sub-processor. Anthropic acts as our processor under its Data Processing Addendum. The information we send is designed not to identify anyone, but because a merchant name could occasionally relate to an identifiable sole trader, we treat it with the protections of data protection law. Our lawful basis is contract (Article 6(1)(b)), because categorisation is part of the Services.
10.4.5 No training. Anthropic's commercial terms prohibit it from training its models on the data we send or the suggestions it returns. We do not use your personal data to train AI models.
10.4.6 Retention by Anthropic. Anthropic deletes the data we send and its responses within 30 days. If Anthropic's automated trust and safety systems flag a request under its Usage Policy, Anthropic may keep it for up to 2 years, and it may keep data for longer where the law requires. We keep only the suggested category with the transaction, and request metadata (time, model, and success or failure, with no content) for 30 days.
10.4.7 Your review. A category suggested by the model is labelled "AI suggested" in the Platform and is never marked as reviewed automatically. You review it and can change it, and your correction always takes precedence. The suggestion is a proposal for you to review, not a decision about you.
10.4.8 "Ask Earnly". The "Ask Earnly" feature is a preview that shows pre-written help content. It is not an AI chat feature and does not send your data anywhere.
10.4.9 Any new AI provider. We will not use a new AI provider, or send an AI model any data beyond that described in this section 10.4, unless we first complete a data protection impact assessment, give you at least 30 days' notice, update this Privacy Policy, the AI Policy and the Sub-processor List, and use only a provider that is contractually prohibited from training on Earnly user data and that limits its routine retention of that data to no more than 30 days.
10.5 Accuracy. Outputs can be wrong or incomplete. Tax estimates use the rates for England, Wales and Northern Ireland for the current tax year. Scottish income tax rates are not supported, so if you are a Scottish taxpayer you must not rely on the Platform's income tax estimates. You must check Outputs before you rely on them, as set out in the Financial Disclaimer.
10.6 Automated decision-making. Articles 22A to 22D UK GDPR give you safeguards where a significant decision about you is taken based solely on automated processing, meaning with no meaningful human involvement. A significant decision is one that has a legal effect on you or a similarly significant effect.
10.7 We do not take any significant decision about you based solely on automated processing. Categorisations (including AI suggested categories), tax estimates and forecasts are information for you to review and decide on. They do not decide anything about you. A decision to suspend or close an Account is always reviewed by a person before it takes effect.
10.8 If we ever introduce a significant decision based solely on automated processing, we will update this Privacy Policy before it starts, tell you when such a decision has been taken about you, and let you make representations, obtain human intervention from someone with authority to change the decision, and contest the decision. We will not take such a decision using special category data unless the strict conditions in Article 22B UK GDPR are met.
11. Who we share personal data with
11.1 We share personal data only as described in this section.
| Recipient | Role | What and why |
|---|---|---|
| Service providers listed on our Sub-processor List, currently Supabase (database, authentication and file storage), Amazon Web Services (infrastructure for Supabase), Cloudflare (application hosting and delivery), Lovable Labs Incorporated (application build, hosting and email delivery), Google Cloud EMEA Limited with Google LLC (Google Workspace business email, which carries support requests, complaints, rights requests and other correspondence), Atlassian Pty Ltd (Confluence and Jira, which hold our internal registers, including the complaints log, the data subject request log and the breach register) and Anthropic Ireland, Limited with Anthropic, PBC (AI categorisation suggestions, receiving only a cleaned merchant name and amount, as explained in section 10.4) | Processors and their sub-processors | Hosting, storing and delivering the Platform, sending and receiving emails, keeping our internal records and suggesting categories, only on our instructions |
| Finexer Ltd | Independent controller for the account information consent journey, consent and audit record, security and fraud prevention and its regulatory complaints; our processor for delivering Open Banking Data | Your name or company name, email address and Account reference to set up your connection; consent records; complaints about the account information service, which we refer to Finexer |
| Google (Google Fonts) and jsDelivr | Providers of web content loaded by your browser | Some pages load web fonts from Google Fonts and bank logos from the jsDelivr network, which means your browser sends your IP address to them when the page loads. No other personal data is sent. We are moving these files to our own hosting, after which these providers will no longer receive your IP address |
| Companies House and HMRC | Public bodies providing public data | The company name or number, or VAT number, you look up |
| Professional advisers, auditors and insurers | Independent controllers | Where they need information to advise or insure us, under duties of confidentiality |
| The Information Commission (ICO), the Financial Conduct Authority (through the Provider), the Financial Ombudsman Service, HMRC, the National Crime Agency, law enforcement, courts and other public bodies | Independent controllers | Where the law requires it, where they ask for data for their public tasks, to report suspected financial crime, or to establish, exercise or defend legal claims |
| A buyer, investor or financing counterparty and their advisers | Independent controllers | In connection with a corporate transaction, under confidentiality terms |
11.2 Our processors act only on our written instructions under contracts that meet Article 28 UK GDPR. The Sub-processor List gives each provider's service, the data it handles, its location and the transfer safeguard. We publish any change on that page at least 30 days before it takes effect, as explained on the page.
11.3 We do not sell personal data. We do not share personal data with third parties for their own marketing. We do not use Open Banking Data for advertising.
12. International transfers
12.1 Our primary data storage (database, authentication and file storage) is in Amazon Web Services' eu-west-1 region in Ireland, in the European Union. The UK has adequacy regulations confirming that the EU meets the data protection test, so storage in Ireland needs no further safeguard.
12.2 Some providers are based in the United States or operate global networks. Cloudflare delivers the Platform through its global edge network, so your requests may be handled at the location nearest to you. Supabase, Inc., Cloudflare, Inc., Lovable Labs Incorporated and Google LLC are US companies that may access personal data from the United States. Our business email (Google Workspace) is provided by Google Cloud EMEA Limited in Ireland, with Google LLC as its sub-processor, so emails may be processed in the EU and the United States. Our internal registers are held in Atlassian's Confluence and Jira, provided by Atlassian Pty Ltd, an Australian company, and hosted in the United States. AI categorisation suggestions are provided by Anthropic Ireland, Limited, with Anthropic, PBC as its sub-processor, and the cleaned merchant name and amount we send may be processed in the United States. The safeguards for these providers are: for Lovable Labs Incorporated, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses under Lovable's data processing agreement dated 17 November 2025; for Google, the UK Extension to the EU-US Data Privacy Framework where Google is certified, and otherwise the UK International Data Transfer Addendum; for Atlassian, the UK International Data Transfer Addendum, together with the UK Extension to the EU-US Data Privacy Framework for Atlassian's certified US entities; and for Anthropic, the EU Standard Contractual Clauses (Module 2) with the UK International Data Transfer Addendum (B1.0), under Anthropic's Data Processing Addendum. In each case we carry out a transfer risk assessment where the Addendum is used.
12.3 We transfer personal data outside the UK only where:
12.3.1 the destination is covered by UK adequacy regulations confirming that it meets the data protection test, meaning that its standard of protection is not materially lower than in the UK, including the UK Extension to the EU-US Data Privacy Framework where the US recipient is certified under it; or
12.3.2 otherwise, we have put in place the UK International Data Transfer Addendum to the EU Standard Contractual Clauses and carried out a transfer risk assessment, acting reasonably and proportionately, confirming that the data protection test is met for the transfer; or
12.3.3 an exception under Article 49 UK GDPR applies.
12.4 The Sub-processor List shows the safeguard used for each provider. You can ask for a copy of the safeguards for any transfer by emailing privacy@earnly.co.uk. We may remove commercially sensitive terms.
13. How long we keep personal data
13.1 We keep personal data only for as long as we need it for the purposes in section 9 or as the law requires. The main periods are:
13.1.1 Open Banking Data, including Counterparty data and transaction-level categorisations: kept while the connection is active and deleted following a 30-day cooling-off period after consent is withdrawn, expires without being reconfirmed, or the Connected Account is disconnected, or after your Account is closed, whichever happens first. During the cooling-off period you can reactivate the connection or your Account, in which case the data is kept. We do not keep transaction history beyond this period;
13.1.2 your Account and profile data, company data, personal tax profile, receipt images, corrections and other Outputs: kept while your Account is open and deleted following a 30-day cooling-off period after it is closed, during which you can reactivate your Account. You can export your transactions as a CSV file before closure and during the cooling-off period;
13.1.3 a minimal record of our contract with you (identity and contact details, the terms and policy versions you accepted with the date, time and IP address, and your declarations): 6 years after the end of the Agreement, to deal with any legal claim;
13.1.4 a minimal record of each of your Open Banking consents (its scope and dates, reconfirmations, expiry and withdrawal, and when data was retrieved under it, but not the data itself): 6 years after the consent ends, to show that each access was authorised and to deal with any complaint or claim within the limitation period (section 5 Limitation Act 1980). This record contains no transaction data. The Provider keeps its own consent records and audit trail for 5 years from the end of the consent, complaint records for 3 years and security logs for up to 12 months, under its privacy notice;
13.1.5 support correspondence: 2 years from the last message;
13.1.6 complaint records, data protection complaint records and records of data protection rights requests: 6 years from closure;
13.1.7 security and audit logs: 12 months; application diagnostic logs: 30 days; AI request metadata (time, model, and success or failure, with no content): 30 days. Anthropic's own retention is described in section 10.4.6;
13.1.8 waitlist data: until you create an Account, ask to be removed, or 24 months after you joined, whichever is first; and
13.1.9 marketing consent records: 2 years after you withdraw consent. We keep a minimal suppression record (your email address and the date you opted out) for as long as we need it to make sure we do not contact you again.
13.2 Backups. Deleted data stays in our encrypted backups until the backup set expires, which is no more than 35 days later. Backup data is used only to restore the Platform after an incident, and anything deleted before a restore is deleted again afterwards.
13.3 Your own tax records. Earnly does not keep records on your behalf for HMRC or Companies House purposes. You are responsible for keeping your own business and tax records for as long as the law requires, and you should export what you need before you close your Account or disconnect a Connected Account.
13.4 Dormant Accounts. If you have not used your Account for 24 months, we will email you, and if you do not sign in within 30 days of that email, we will close the Account and apply the periods above.
13.5 Legal holds. We may keep data for longer where a complaint, dispute, claim or investigation is live, and only for as long as it is needed for that purpose.
13.6 Anonymised information that can no longer identify anyone, including the merchant consensus table described in section 10, may be kept indefinitely because it is not personal data.
14. Security and personal data breaches
14.1 We use appropriate technical and organisational measures to protect personal data, including:
14.1.1 encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
14.1.2 email verification when you sign up, and two-step verification with a one-time code sent to your email address every time you sign in, for all users;
14.1.3 an optional six-digit device PIN on mobile browsers;
14.1.4 multi-factor authentication for all staff and contractor access to production systems, least-privilege access, quarterly access reviews, and removal of leavers' access within 1 Business Day;
14.1.5 access to your data by our support staff only when you ask for help, for no more than 24 hours, and with every access logged;
14.1.6 no use of real personal data in development or testing, where only synthetic data is used;
14.1.7 security patching within 14 days for critical vulnerabilities and 30 days for high-risk vulnerabilities;
14.1.8 encrypted backups taken hourly for transactional data and daily for the full system, with restores tested every 6 months;
14.1.9 data protection and security training for staff on joining and every year;
14.1.10 written contracts with our processors, which must tell us of any personal data breach within 24 hours; and
14.1.11 a documented incident response and disaster recovery plan.
14.2 No system is completely secure. We do not claim that our measures remove all risk, and we do not hold any security certification.
14.3 If a personal data breach occurs, we will report it to the Information Commission (ICO) within 72 hours of becoming aware of it where the law requires, tell you without undue delay where it is likely to result in a high risk to you, and tell the Provider without undue delay and within 24 hours where Open Banking Data is involved.
14.4 You must keep your Account login details confidential, use a strong password that you do not use elsewhere, and tell us at once at security@earnly.co.uk if you suspect unauthorised access. Earnly will never ask for your online banking credentials. Our emails come from noreply@notify.earnly.co.uk, which is not monitored. To report a security vulnerability, see our Vulnerability Disclosure Policy.
15. Your rights
15.1 Subject to the conditions and exemptions in UK data protection law, you have the right to:
15.1.1 be informed about how we use your personal data, which this Privacy Policy provides;
15.1.2 access your personal data and receive a copy;
15.1.3 have inaccurate personal data corrected and incomplete data completed;
15.1.4 have your personal data erased;
15.1.5 restrict how we use your personal data;
15.1.6 object to processing based on legitimate interests (including recognised legitimate interests), and object at any time to direct marketing, in which case we will stop;
15.1.7 data portability: receive the personal data you gave us, including Open Banking Data, in a structured, commonly used and machine-readable format, and have it sent to another controller where technically feasible;
15.1.8 withdraw consent at any time where we rely on consent;
15.1.9 the safeguards for automated decision-making in section 10; and
15.1.10 complain to us and to the Information Commission (ICO), as described in section 18.
15.2 How to make a request. Use our online form at https://earnly.co.uk/privacy-request, email privacy@earnly.co.uk, or write to us at the address in section 20. Tell us which right you want to use. You do not have to use any particular form of words. You can also export your transactions as a CSV file at any time from the Platform.
15.3 Timescale. We will respond without undue delay and within one month of receiving your request. If a request is complex, or you have made several requests, we may extend this by up to two further months, and we will tell you within the first month why.
15.4 Identity and clarification. We may ask for information to confirm your identity, or to clarify a request where we hold a large amount of data about you. The time limit is paused until we receive what we need.
15.5 Searches. We will carry out reasonable and proportionate searches for the personal data you have asked for.
15.6 Fees and refusals. We do not charge a fee. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why and how to complain.
15.7 Erasure. If you ask us to erase your data, we will erase it unless we must or are entitled to keep it, for example the records described in 13.1.3, 13.1.4 and 13.1.6. We will tell you what we are keeping and why, and we will not refuse the whole request if part of it can be met.
15.8 If you are a Counterparty, we can only find information about you if you give us enough detail to search for it, for example the Account holder's name and the transaction concerned.
16. Marketing
16.1 Service messages (for example security alerts, verification codes, consent expiry reminders and changes to our terms) are not marketing and we will send them whatever your marketing choices.
16.2 Waitlist. When you join our waitlist, the marketing opt-in is optional and unticked. We send you marketing only if you tick it, and we record the date, time and IP address of your consent.
16.3 Existing customers. If you have an Account, we may send you marketing emails about our own similar services under the soft opt-in, but only if we gave you a simple, free chance to opt out when we collected your details (an unticked box at signup that you can tick to opt out), and we give you that chance again in every message through an unsubscribe link.
16.4 We send marketing only by email. We do not send marketing by text message or telephone.
16.5 You can unsubscribe at any time, free of charge, using the one-click unsubscribe link in any marketing email or by emailing privacy@earnly.co.uk. We will act on it within 2 Business Days, and we will record that you no longer consent to marketing.
16.6 We do not use Open Banking Data for marketing and we do not sell or share personal data for third-party marketing.
17. Children
17.1 The Services are only for people aged 18 or over. You must confirm that you are 18 or over when you sign up, and you must not create an Account or use the Platform if you are under 18. We do not knowingly collect personal data from anyone under 18.
17.2 If we learn that we hold personal data of a user under 18, we will close the Account and delete the data without undue delay, keeping only a minimal record that the Account was closed and why. If you believe a child has given us personal data, contact us at privacy@earnly.co.uk.
17.3 Information about children may appear in Open Banking Data as Counterparty data (for example a payment to a child's account). We treat it as described in section 7.
18. How to complain
18.1 Complaining to us. If you are unhappy with how we have handled your personal data, you can complain to us:
18.1.1 using our online complaint form at https://earnly.co.uk/complaints, which includes a form for data protection complaints;
18.1.2 by email to privacy@earnly.co.uk or complaints@earnly.co.uk;
18.1.3 in the Platform, under Settings → Help; or
18.1.4 by post to Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU.
18.2 What we will do. Under section 164A DPA 2018, we will:
18.2.1 acknowledge your complaint within 2 Business Days of receiving it, and in any event within the 30-day statutory maximum;
18.2.2 investigate it and take appropriate steps without undue delay, including asking you for more information if we need it;
18.2.3 keep you informed of progress; and
18.2.4 tell you the outcome in writing within one month of receipt, and if the complaint is complex, no later than 3 months after receipt. If we need longer than one month, we will tell you why.
18.3 Complaining to the Information Commission. You have the right to complain to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113. The ICO will normally expect you to have complained to us first, but you do not have to wait for our response if you are unhappy.
18.4 Complaints about the account information service. Complaints about the Open Banking connection or the account information service are handled under our Complaints Procedure. We refer them to the Provider within 1 Business Day, and you receive a final response within 15 Business Days (35 Business Days in exceptional cases). The Provider is responsible for handling these complaints and issuing the final response. You may then be able to refer the complaint to the Financial Ombudsman Service. You can also complain to the Provider directly at complaints@finexer.com, or about its handling of your personal data at privacy@finexer.com. If a complaint raises both kinds of issue, we will handle it under both procedures and tell you which timescales apply.
19. Changes to this Privacy Policy
19.1 We may update this Privacy Policy to reflect changes to the Services, our processing, our providers, or the law. The version number and date at the top show when it last changed.
19.2 If we make a material change, we will tell you by email or in the Platform at least 30 days before it takes effect, unless the change is needed sooner to comply with the law or to protect security, in which case we will tell you as soon as we can.
19.3 If a change means we would rely on your consent for a new purpose, we will not start that processing unless you give consent.
20. Contact
20.1 Data Protection Lead: Adam Marsh, Director, privacy@earnly.co.uk
20.2 Data rights requests: https://earnly.co.uk/privacy-request or privacy@earnly.co.uk
20.3 General support: support@earnly.co.uk (Monday to Friday, 9:00 to 17:30 UK time, excluding bank holidays in England and Wales)
20.4 Security: security@earnly.co.uk
20.5 Post: Earnly Limited, 41 New Cross Street, Swinton, Manchester, England, M27 4TU
20.6 Information Commission (ICO): ico.org.uk, 0303 123 1113
20.7 If you need this Privacy Policy in another format, such as large print, an accessible PDF or plain-text email, or would prefer to discuss it by telephone, email support@earnly.co.uk and we will arrange it.