Privacy Policy

Savvy Technologies Ltd, registered in England and Wales (company no. 00000000), registered office [PLACEHOLDER: registered office address], United Kingdom, is the data controller for personal data processed through Savvy. We are registered with the Information Commissioner's Office under registration number [PLACEHOLDER: ICO registration number]. For privacy questions or to exercise your rights, contact privacy@savvypay.uk.

• Identity and contact data — name, email address, mobile phone number, date of birth, and delivery address.
• Plan and transaction data — the items you are saving for, your instalment schedule, payments made, refunds, and plan history.
• Payment data — handled by our payment processor (Stripe). Savvy never stores your full card number.
• Security data — one-time passcodes sent by SMS, passkey public keys, and authentication logs used to protect your account.
• Technical data — IP address, device and browser information, and usage data collected when you use our site.

• To perform our contract with you — operating your savings plan, collecting instalments, ordering your item, and arranging refunds.
• Legal obligations — record keeping, safeguarding reconciliation, fraud prevention, and responding to lawful requests.
• Legitimate interests — securing our platform, preventing abuse (including rate limiting), and improving our service.
• Consent — optional marketing communications and non-essential cookies, which you can withdraw at any time.

We share personal data only where necessary to run the service: payment processing (Stripe), SMS delivery (Twilio), email delivery (Resend), cloud hosting providers, and the merchant fulfilling your order (name, order details, and delivery address only). We never sell your personal data.

We keep account and transaction records for as long as your account is active and afterwards for the periods required by UK tax, accounting, and financial-services record-keeping rules (typically six years). Audit and compliance records relating to payments are retained on an immutable ledger for the same period.

Under UK GDPR you have the right to access, rectify, erase, restrict, or object to our processing of your personal data, the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk). To exercise any right, email privacy@savvypay.uk and we will respond within one month.

We protect your data with encryption in transit, hashed credentials and one-time passcodes, passkey support, rate limiting, and access controls. Payment card data is processed by Stripe, a PCI-DSS Level 1 certified provider.

See our cookie policy for details of the cookies we use and how to control them.

This policy contains placeholder company details pending final legal review before public launch.