Privacy Policy

We collect and process the following categories of personal data:

• Account data: your full name, email address and an encrypted password when you register for an account.
• Financial details you enter: creditors, debts (balances, arrears, minimum payments), assets and their values, income and expense entries, monthly surplus, and any notes you add to your records.
• Creditor contact logs: notes you choose to make about phone calls, letters or emails exchanged with your creditors.
• Documents you upload: PDFs, photographs or text you choose to attach to your records (payslips, statements, letters). Files are stored so tools such as the insolvency report generator can use them.
• Profile data: phone, jurisdiction and any description on your profile.
• Communications: the content of support or feedback messages you send us.
• Payment data: when you subscribe to a paid plan we send your email and selected plan to our payment processor, Stripe. We never see or store full card numbers.
• Usage data: aggregate events such as which tools you used, captured via analytics to improve the product. Analytics cookies are set only after you accept them via the cookie banner.

We rely on the following UK GDPR legal bases to process your personal data:

• Performance of a contract — to provide the Debtrupt tools you asked for (the calculator, letter drafter, document generator, filing tracker and email reminders).
• Legal obligation — to keep accounting records and any tax-related records tied to paid subscriptions for the period required by UK tax law.
• Legitimate interest — to send you filing-deadline reminders and a monthly summary of your progress, and to monitor product performance to improve the tools.
• Consent — for non-essential cookies and analytics, and for any optional marketing messages you opt into. You can withdraw consent at any time.

We do not sell your data. We share it only as follows:

• Stripe — our payment processor for paid subscriptions.
• Hosting and infrastructure providers — hosting, file storage and email delivery providers we use to operate the service.
• Free debt charities and regulated advisers — only when you explicitly ask us to, or when you reach out to them yourself using links we provide.
• Legal compliance — where required by UK law, court order, or to protect someone's safety (for example, overrides triggered by our safeguarding process for self-harm risk).

We store your data on infrastructure located in the UK and the European Economic Area. International transfers outside the UK/EEA are not made unless suitable safeguards (such as a UK International Data Transfer Agreement) are in place.

Your data is kept for as long as your account is active. If you close your account, we delete the personal data tied to it within 30 days, except for records we must keep for legal reasons (for example, payment records retained for up to six years for UK tax/accounting purposes).

We use cookies only for two purposes:

• Essential cookies — to keep you logged in and to remember that you have dismissed the cookie banner. These are set automatically and do not require consent.
• Non-essential / analytics cookies — to understand which tools are used so we can improve them. These are set only after you accept them via the cookie banner, in line with the Privacy and Electronic Communications Regulations (PECR).

You can change your cookie preferences at any time by clearing the consent flag in your browser and reloading the page.

Under UK GDPR you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data, subject to legal-retention exceptions.
• Restriction — limit how we use your data while a request is being handled.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent at any time for processing that relied on your consent.

To exercise any of these rights, contact us via the Contact page. The Information Commissioner's Office (ICO) is the UK supervisory authority for data protection; you can complain to them at ico.org.uk if you are not happy with our response.