AskFreddie← Back to home

Privacy Policy

Last updated: 16 June 2026

AskFreddie (“we”, “us”, “our”) is committed to protecting your personal data. This policy explains what we collect, why we collect it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

AskFreddie is operated as a UK-based service. For data protection enquiries, contact us at privacy@askfreddie.co.uk.

2. What data we collect

We collect the following personal data when you use AskFreddie:

  • Account data: your name and WhatsApp phone number, provided when you sign up.
  • Financial data: expense and income records you send to Freddie via WhatsApp. These are stored as structured transaction records (amount, category, date) — not as raw message text.
  • Payment data: billing information processed by Stripe. We do not store card details directly; Stripe handles all payment processing as a separate data controller.
  • Usage metadata: timestamps, intent type (e.g. “expense logged”), and whether a response was served from cache. We do not store the content of your WhatsApp messages in production logs.
  • Technical data: IP address and browser information if you access the web dashboard.

3. Legal basis for processing

We process your personal data under the following legal bases:

  • Contract: to provide the AskFreddie service you have subscribed to (UK GDPR Article 6(1)(b)).
  • Legitimate interests: to improve the service, detect abuse, and maintain security (UK GDPR Article 6(1)(f)).
  • Legal obligation: where required by law, including HMRC and fraud prevention purposes (UK GDPR Article 6(1)(c)).

4. How we use your data

  • To process your financial entries and send replies via WhatsApp.
  • To deliver weekly and monthly spending summaries.
  • To fire reminders you have set.
  • To manage your subscription and process payments via Stripe.
  • To provide access to your personal finance dashboard.
  • To detect and prevent fraudulent use of the service.

5. Who we share your data with

We use the following third-party processors:

  • Twilio: to send and receive WhatsApp messages on your behalf. Twilio acts as a data processor under our instruction.
  • Stripe: to process subscription payments. Stripe is an independent data controller for payment information.
  • Supabase: to store your account and transaction data in a hosted PostgreSQL database.
  • Anthropic: the AI model that processes your message text to extract financial intent. Messages are processed transiently and are not used to train Anthropic’s models under our API agreement.

We do not sell your data to third parties. We do not share your financial data with advertisers or data brokers.

6. Data retention

We retain your account and transaction data for as long as your subscription is active, plus 6 months after cancellation to allow for account recovery. After that period, your data is permanently deleted.

Payment records are retained for 7 years as required by UK tax law.

7. Your rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Rectify inaccurate data.
  • Erase your data (“right to be forgotten”), subject to legal retention obligations.
  • Restrict processing in certain circumstances.
  • Data portability — receive your data in a machine-readable format.
  • Object to processing based on legitimate interests.
  • Withdraw consent where processing is based on consent.

To exercise any of these rights, email privacy@askfreddie.co.uk. We will respond within one month.

8. Cookies

The AskFreddie web dashboard uses only functional cookies necessary for authentication. We use analytics (Google Analytics) on the marketing site to understand visitor behaviour. No advertising cookies are set.

9. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Access to your data is restricted by row-level security policies; our team cannot read individual transaction records without explicit audit logging.

10. International transfers

Some of our processors (Stripe, Anthropic, Supabase) operate infrastructure in the United States. Transfers are governed by UK International Data Transfer Agreements (IDTAs) or adequacy decisions where applicable.

11. Changes to this policy

We may update this policy from time to time. If changes are material, we will notify you via WhatsApp before they take effect. The “Last updated” date at the top of this page reflects the most recent revision.

12. Contact and complaints

For any data protection query, contact us at privacy@askfreddie.co.uk.

You also have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.