Privacy Policy

MultiWallet Ltd is the data controller responsible for your personal data. We are registered in England and Wales under company number 17280320. Our website is https://multiwallet.uk.

We are in the process of registering with the Information Commissioner’s Office (ICO) as required for organisations that process personal data. [Update with ICO registration number once confirmed.]

2.1 Information you give us directly

• Account details: full name, email address, password (stored as a salted hash, never in plain text)
• Profile information you choose to add
• Communications you send us, such as support requests

2.2 Financial data via Open Banking

When you connect a bank account, we use TrueLayer, an authorised provider regulated by the Financial Conduct Authority, to access your financial data under the UK Open Banking framework. With your explicit consent, we receive:

• Account holder name, account number and sort code
• Account balances
• Transaction history (amounts, dates, merchant/payee descriptions, categories)

MultiWallet has read-only access to this data. We cannot move money, initiate payments, or make any changes to your bank accounts. Access is granted for a defined period and can be revoked by you at any time, either within the App or directly with your bank.

Bank connection tokens are encrypted at rest using AES-256-GCM and are never stored in plain text.

2.3 Information collected automatically

• Device information (device type, operating system)
• App usage and log data, for the purpose of fixing bugs and improving the App
• Approximate location derived from IP address, where used for fraud prevention

2.4 Payment information

Subscription payments are processed by Stripe, Inc. We do not store your card details. Stripe acts as an independent data controller for payment processing — see Stripe’s own privacy policy at stripe.com/privacy.

• To provide the core App functionality: aggregating your connected accounts, calculating your net worth, and presenting your income split
• To generate estimated UK tax calculations based on your transaction data (see Section 9 — Important Limitations)
• To process subscription payments and manage your Pro plan
• To send essential account and security emails (e.g. email verification, password resets)
• To send service-related communications, which you can opt out of where not essential to the App’s operation
• To detect and prevent fraud, and to keep the App secure
• To comply with our legal and regulatory obligations

• Contract — processing necessary to provide the App and Pro subscription you have signed up for
• Consent — for connecting bank accounts via Open Banking, which requires your explicit, revocable consent
• Legitimate interests — for fraud prevention, service improvement, and security, balanced against your rights
• Legal obligation — where we must retain or disclose information to comply with the law

We do not sell your personal data. We share data only with the following categories of third party, each acting under their own data protection obligations:

• TrueLayer Limited — to facilitate Open Banking connections
• Stripe, Inc. — to process subscription payments
• Resend — to deliver transactional emails (e.g. verification, password reset)
• Neon (hosting our database) and Vercel Inc. (hosting the App) — as our infrastructure providers
• Law enforcement or regulators, where required by law

We require all third-party processors to handle your data securely and only for the purposes we specify.

Some of our service providers may process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or an adequacy decision recognised under UK GDPR.

• Account data: retained for as long as your account is active
• Transaction data: retained for as long as needed to provide the income split and tax estimate features, or until you disconnect the relevant account
• Data after account deletion: deleted or anonymised within 30 days, except where we must retain certain records for legal, tax, or fraud-prevention purposes

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request erasure of your data (‘right to be forgotten’)
• Restrict or object to certain processing
• Receive your data in a portable format
• Withdraw consent at any time (e.g. by disconnecting a bank account)
• Lodge a complaint with the Information Commissioner’s Office (ico.org.uk)

You can delete your account directly within the App at any time via Account settings. You can also exercise these rights by contacting us at support@multiwallet.uk.

MultiWallet provides estimated tax figures (Income Tax, National Insurance, and Payment on Account) based on the transaction data available to us and the current UK tax year’s published HMRC rates. These figures are estimates for general guidance only and do not constitute tax, financial, or professional advice. They may not reflect your full financial circumstances. You should consult a qualified accountant or tax adviser, or HMRC directly, before making financial decisions or filing a Self Assessment return.

We use industry-standard security measures, including encryption of sensitive data at rest (AES-256-GCM for bank connection tokens) and in transit (TLS), to protect your information. No system is completely secure, and we encourage you to use a strong, unique password and enable any additional security features we offer.

MultiWallet is not directed at, and is not intended for use by, anyone under the age of 18.

We may update this policy from time to time. If we make material changes, we will notify you via the App or by email before the changes take effect.

MultiWallet Ltd

Email: support@multiwallet.uk

Company number: 17280320