1. Who We Are
The Life Buddy ("we", "us", "our") operates thelifebuddy.co.uk. We are the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact: hello@thelifebuddy.co.uk
2. What Data We Collect
- Account information: your email address and an encrypted password when you sign up.
- Financial data you enter: income, bills, budgets, credit accounts, savings goals, and household member names. We never connect to your bank — all data is manually entered by you.
- Payment information: processed securely by Stripe. We never see or store your full card details. We may receive your card's last four digits, expiry date, and billing country from Stripe for your records.
- Usage data: anonymous analytics via Google Analytics (page views, session duration, device type). No personally identifiable information is collected through analytics.
- Technical data: IP address, browser type, and device information collected automatically for security and service delivery.
3. Lawful Basis for Processing
We process your personal data under the following legal bases:
- Contract: to provide and maintain your account and the service you've subscribed to.
- Legitimate interest: to improve our product, prevent fraud, and ensure security.
- Consent: for analytics cookies and optional marketing communications (if any).
- Legal obligation: to comply with applicable laws and regulations.
4. How We Use Your Data
- To provide and maintain your account and the service.
- To process your subscription payments via Stripe.
- To send important service-related communications (e.g. security alerts, billing confirmations).
- To improve the product based on anonymised usage patterns.
- To respond to your enquiries and support requests.
We will never sell, rent, or share your personal data with third parties for marketing purposes.
5. Data Sharing & Third Parties
We share data only with the following third-party processors, each of whom is bound by data processing agreements:
- Supabase (database & authentication): stores your account and financial data with encryption at rest and in transit. Hosted in the EU/UK.
- Stripe (payments): processes subscription payments. Subject to Stripe's Privacy Policy.
- Google Analytics: collects anonymous usage statistics. Subject to Google's Privacy Policy.
We do not share your data with any other third parties.
6. Data Storage & Security
We take the security of your data seriously:
- All data is encrypted in transit (TLS/HTTPS) and at rest (AES-256).
- Access is restricted by row-level security policies — only you (and your household members, if applicable) can see your financial data.
- Passwords are hashed using bcrypt and are never stored in plain text.
- We implement compromised password detection (HIBP checks) to protect your account.
- All infrastructure uses enterprise-grade security controls.
7. Data Retention
We retain your personal data for as long as your account is active. If you delete your account:
- Your financial data (income, bills, budgets, credit accounts, savings goals) will be permanently deleted.
- Your account information will be permanently deleted.
- Payment records may be retained for up to 7 years as required by UK tax and accounting regulations.
- Anonymised analytics data (which cannot identify you) may be retained indefinitely.
8. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
- Right of access: request a copy of the personal data we hold about you.
- Right to rectification: request correction of inaccurate data.
- Right to erasure: request deletion of your account and all associated data.
- Right to data portability: request your data in a machine-readable format.
- Right to restrict processing: request that we limit how we use your data.
- Right to object: object to processing based on legitimate interest.
- Right to withdraw consent: where processing is based on consent, you can withdraw at any time.
To exercise any of these rights, please contact us at hello@thelifebuddy.co.uk. We will respond within 30 days.
9. International Transfers
Your data may be processed in countries outside the UK. Where this happens, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses or adequacy decisions) to protect your data to the same standard required by UK GDPR.
10. Children's Privacy
The Life Buddy is not intended for use by children under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.
11. Cookies
We use essential and analytics cookies. For full details on what cookies we use and how to manage them, please see our Cookie Policy.
12. Changes to This Policy
We may update this policy from time to time. We'll notify you of significant changes via email or an in-app notice. Continued use of the service after changes constitutes acceptance.
13. Complaints
If you're unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We'd always appreciate the opportunity to resolve your concern directly first — please email hello@thelifebuddy.co.uk.