We respect
your privacy.

Because privacy matters to you, it matters to us.

Fae exists to improve your financial wellbeing. To enable us to do that, you have to trust us with some of your data. That's not something we take for granted.

This Privacy Policy explains what personal data we collect, why we collect it, what we do with it, and what rights you have over it. If anything isn't clear, please ask.

We comply with UK General Data Protection Regulation (GDPR) and the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003.

1.Who We Are

The plainspeak summary: These are our formal company details.

The Fae service is operated by Fae Technologies Ltd, a company incorporated in England and Wales (Company Number: 16753505), with its registered address at 20 Station Road, Cambridge, CB1 2JD.

For the purposes of UK data protection law, Fae Technologies Ltd is the data controller for the personal data described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number ZC131995.

If you have any questions about this policy or how we handle your data, please contact us at: hello@askfae.com

2.What Data We Collect

The plainspeak summary: We collect some data that you give us directly (like your name and email), some financial data via open banking, some that you may choose to make available to us (like your emails), and some that we collect automatically (like how you use the app).

Fae connects to more sources of data than most services do; that's how it gives you a genuinely holistic picture. Below is a clear account of everything we collect and where it comes from.

2.1 Data You Give Us Directly

Account registration: your name and email address, and, if you choose to add them, your preferred name, title, pronouns, home address and profile photo. If you sign in with Google, we receive the name, email address and profile picture on your Google account. On the Fae100 website you can also sign in with a password, which we store only in hashed form, so we never see it.

App preferences: your preferences and settings within the Fae app.

Support interactions: messages you send us, feedback, survey responses, and any complaints.

Communications information: your preferences for receiving insights from us and your communication preferences.

Uploaded documents: any documents you choose to share, such as insurance policies or bank statements.

2.2 Financial Data (via Open Banking and Open Finance)

Your bank account data reaches Fae through open banking, provided by Fae as an agent of Moneyhub. If you choose to connect other financial accounts, such as pensions, savings or investments, that data reaches Fae through Moneyhub's open finance service, which is not a regulated open banking service. We never connect directly to your bank or provider and cannot initiate payments or move funds.

The financial data we receive includes:

• Account details: account holder name, account type, masked account number and sort code, currency, and bank name.
• Transaction data: date, amount, merchant name, description, transaction type, category, and balance at time of transaction.
• Account balances: current balance, available balance, and credit limit where applicable.
• Standing orders and direct debits: payee name, amount, frequency, next payment date, and status.
• Historical data: up to 24 months of past transactions, configurable by you.
• Other financial accounts (if you connect them): provider name, product type, current value, contributions, holdings, and policy or plan details.

What we never see: your bank login credentials, PINs, full card numbers, CVV codes, or authentication tokens. These are never exposed through open banking and never reach Fae.

2.3 Email Data (with your permission)

If you connect your email account (for example Gmail), we read emails on a read-only basis to identify categories likely to contain financial information: billing emails, subscription confirmations, insurance documents, and financial correspondence. You can revoke access at any time.

2.4 Data Collected Automatically

Fae has two places you might use, and they collect different things automatically.

In the Fae app (app.askfae.com and the Fae mobile apps):

• Technical data: your IP address, device type, browser, operating system and app version, recorded in our service logs to run Fae and keep your account secure.
• Cookies: essential cookies only (one to keep you signed in, and short-lived ones that protect the sign-in process). The Fae app uses no analytics, advertising or third-party cookies.

On the Fae100 website (fae100.askfae.com):

• Technical data: your IP address and browser information, kept in our hosting provider's logs for up to 7 days to run the site and keep it secure.
• Error reports: if a page fails, technical details of the error, linked to your Fae100 account ID, so we can fix it. They do not include what you typed.
• Usage analytics, only if you agree: the pages you visit, what you click, and how you move through the site, measured with PostHog and Google Analytics. This includes session recordings that replay how you used a page. Recordings hide what you type, but can show other text on the screen. Recordings are kept for about one month.
• Cookies: essential cookies to keep you signed in and remember your cookie choice, and analytics cookies only if you agree. You can change your choice at any time with the Cookies link on the site.

See Section 10 for more on cookies.

2.5 Google User Data and Limited Use

The plainspeak summary: When you connect a Google service like Gmail, we only use that data to power features you can see and use inside Fae. We never use it to train general-purpose AI, and we never sell it or hand it on.

Fae's use of information received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. You can read that policy at https://developers.google.com/terms/api-services-user-data-policy.

When you choose to connect a Google account, the data we access through Google APIs such as the Gmail data described above is used only to provide and improve the features you experience directly within Fae, such as surfacing relevant correspondence from your inbox. Specifically:

• We only use Google user data to provide or improve user-facing features that are prominent in the Fae app.
• We only transfer Google user data to others to comply with applicable law, or as part of a merger or acquisition.
• We do not use or transfer Google user data for serving advertising of any kind, including personalised, retargeting, or interest-based advertising.
• We do not allow humans to read your Google user data unless you have given specific consent, it is necessary for security purposes (such as investigating abuse), it is required to comply with applicable law, or the data has been aggregated and anonymised so that you can no longer be identified.

Artificial intelligence and machine learning. Fae uses AI to generate insights that are personalised to you and shown only in your own account. We do not use, retain, or transfer data obtained through Google Workspace APIs (including Gmail) to develop, improve, or train generalised or non-personalised artificial intelligence (AI) or machine learning (ML) models. Any AI or ML processing of your Google data is limited to providing the personalised, user-facing features described in this policy, and is never used to build or improve models that serve other users or general purposes.

3.How We Use Your Data

The plainspeak summary: We mainly use your data to run and improve Fae, and to make it useful to you.

The table below sets out every purpose for which we process your personal data, which categories of data are involved, and the lawful basis we rely on under UK GDPR.

Data categories: Identity: name; Contact: email, phone, communication preferences; Financial: bank account, transaction and balance data; Profile: preferred name, title, pronouns, home address and profile photo (Fae100 website, where provided), settings, preferences and in-app choices; Usage data: how you interact with the app.

A note on communications: Fae does not market to you. We do not sell products, earn commissions, or have any interest in promoting things to you. The only emails we send outside of service communications are Fae updates on things like new features and news about our public launch. Every one includes a single-click unsubscribe. We will stop immediately if you ask us to.

A note on automated decisions: Fae uses AI to categorise transactions and generate insights. These outputs are advisory only. You can always override them. We do not make automated decisions that have legal or similarly significant effects on you.

4.Who We Share Your Data With

The plainspeak summary: We only share data with the providers we use to run the service, never with advertisers or data brokers.

We share your data only where necessary to provide the service or where required by law. We never sell it and never share it for third-party marketing.

4.1 We Do Share With

Cloud infrastructure providers: who host our application and store data securely. Primary production data is hosted in UK/EU data centres only, encrypted in transit and at rest. We have Data Processing Agreements in place with all providers.

Analytics providers: The Fae app uses no 3rd party analytics providers. The Fae100 website uses PostHog, hosted in the EU, and Google Analytics, which help us understand how the website is used.

Customer support tools: who handle support requests. They receive only the data relevant to your query, under Data Processing Agreements.

Development and technical service providers: who help us build and maintain the Fae service. Where data is transferred outside the UK, we ensure appropriate safeguards are in place as described in Section 5.

Professional advisers: lawyers, accountants, auditors, and insurers, where necessary for our business operations.

Regulators and authorities: where we are required by law, court order, or regulation (see Section 4.3).

Business transfer recipients: in the event of a merger, acquisition, or sale of the business, under appropriate data protection safeguards and with notice to you.

Fae100 programme participants: where you have consented via the Fae100 Participant Consent Form, recordings, contributions, and feedback made during Fae100 workshops, interviews, or community sessions may be visible to other Fae100 participants. Those participants are not permitted to share your recordings or contributions outside the programme.

4.2 We Do Not Share With

• Advertisers or data brokers. Ever.
• Other users (except within the Fae100 programme, where you have separately consented to your recordings and contributions being visible to other participants). Your data is private to you.
• Your bank. We only receive data through open banking; we never send data back to your bank.
• Credit reference agencies, unless you explicitly request this as a feature in future.
• Third parties for their own purposes. We share your data only to run the Fae service, nothing else.

4.3 Legal Disclosures

We may be required to share data with law enforcement or other authorities in response to a court order, legal process, or regulatory requirement. When this happens, we will: verify the legal basis for the request before complying; share only the minimum data necessary; and notify you unless we are legally prohibited from doing so.

5.International Data Transfers

The plainspeak summary: When we need to transfer your data outside the UK, we put safeguards in place to protect it.

Some of our service providers are located outside the United Kingdom, including development partners in South Africa. Where we transfer your personal data outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR. This includes using the UK International Data Transfer Agreement (IDTA) or other approved transfer mechanisms.

If you would like more information about the specific safeguards we use for any transfer, please contact us at hello@askfae.com.

6.How Long We Keep Your Data

The plainspeak summary: We only keep your data for as long as it's needed for business, regulatory or legal reasons.

We keep your personal data only for as long as we need it. As a guide:

• Account and profile data: retained for the duration of your account, then deleted within 30 days of account closure.
• Transaction, email and financial data: retained for the duration of your account plus any period required by law.
• Support and complaint records: retained for up to 6 years from resolution, as required for legal purposes.
• Security logs: retained for a short period for fraud detection and security purposes.

We may retain anonymised and aggregated data, from which you cannot be identified, indefinitely for statistical and analytical purposes. When data is no longer needed, we delete it securely.

7.Your Rights

The plainspeak summary: You can access, correct, delete, or export your data, and stop us from processing it.

You have rights over your personal data under UK GDPR, and we want it to be easy to use them.

Access. You can request a copy of all the personal data we hold about you (account information, transaction data, AI insights, and activity history) in a machine-readable format (JSON or CSV).

Rectification. If anything we hold about you is inaccurate or incomplete, you can ask us to correct it. Most profile information can be updated directly in Settings.

Erasure. You can ask us to delete your data. We'll delete your account, all personal information, financial data, and AI insights within 30 days. The only exceptions are complaint records (kept for up to 6 years) and anonymised analytics data that can no longer identify you.

Restriction. You can ask us to pause processing of your data in certain circumstances, for example, if you've disputed its accuracy. You can also disconnect any data source at any time, which immediately stops new data from that source being processed.

Portability. You can ask for your data in a structured, machine-readable format to take elsewhere.

Objection. You can object to processing based on our legitimate interests. You can also object to communications at any time; we'll stop immediately.

Withdrawing consent. Where we process your data based on your consent, including open banking and email, you can withdraw that consent at any time through your account settings. Withdrawing consent doesn't affect anything we did lawfully before you withdrew it.

Automated decisions. Fae's AI categorises your transactions and generates insights, but all outputs are advisory and you can override any of them. We don't make automated decisions that have legal or significant effects on you.

To exercise any of these rights, email us at hello@askfae.com with the subject line "Privacy Rights Request." We'll respond within 30 days, free of charge. We may ask you to verify your identity to protect against fraudulent requests.

If you're not satisfied, we'd like the chance to put things right first; please contact us. If you're still not happy, you can complain to the ICO: ico.org.uk, 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

8.How We Keep Your Data Safe

The plainspeak summary: We take various technical and organisational measures to protect your data, including encryption, access controls, and security testing.

We take security seriously. Given the nature of the data Fae handles, that's the least you should expect.

8.1 Technical Measures

• All data is encrypted in transit (TLS 1.3) and at rest (AES-256).
• Encryption keys are securely managed.
• Firewalls, intrusion detection, and DDoS protection are in place.
• Regular security testing and vulnerability scanning.
• Secure development practices throughout our engineering process.

8.2 Organisational Measures

• Access to your data is limited to those who need it, on a least-privilege basis.
• All team members with data access are subject to confidentiality obligations and receive security training.
• We have a documented data breach response plan.
• We conduct regular internal security reviews.
• We are working towards ISO 27001 certification.

8.3 If a Breach Occurs

If we experience a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, as required by UK GDPR. Where the breach is likely to result in a high risk to you, we will also notify you directly as quickly as possible, tell you what happened and what we are doing about it.

9.Children

The plainspeak summary: Fae is intended for adults. Data belonging to children will be deleted as soon as we're aware that we have it.

Fae is not intended for anyone under 18. We do not knowingly collect personal data from children. If we discover that we have, we will delete it immediately and notify the relevant parties. If you believe a child has used the service, please contact us at hello@askfae.com.

10.Cookies

The plainspeak summary: We use essential cookies, which Fae needs to work. On the Fae100 website we also use analytics cookies, but only if you agree.

We use cookies and similar technologies on our website and in the app. Here's what we use and why:

Essential cookies (you cannot opt out; these are needed for the service to work): session management to keep you logged in; security cookies to prevent attacks; load balancing.

Analytics cookies (Fae100 website only, and only if you agree): set by PostHog and Google Analytics to show us how the website is used. The Fae app sets no analytics cookies.

Preference cookies: the Fae100 website remembers your cookie choice for 12 months.

On the Fae100 website, you can change your cookie choice at any time with the Cookies link. You can also manage cookies in your browser settings, but disabling essential cookies will stop Fae from working.

11.Links to Other Services

The plainspeak summary: If we link to third-party sites (like your bank), we aren't responsible for their privacy practices.

Our website and app may contain links to third-party services (for example, your bank's website). We are not responsible for the privacy practices of those services. We recommend you read their privacy policies before sharing information with them.

12.Changes to This Policy

The plainspeak summary: If we make meaningful changes to how we use your data, we'll notify you in advance.

We may update this policy from time to time. Where changes are material (meaning they affect how we use your data in a way that matters to you), we will notify you by email before they take effect. The updated policy will always show its effective date at the top.

If you don't agree with changes to the policy, please stop using the service and close your account. We will delete your data in accordance with Section 7.

13.Contact Us

If you have questions about this policy, want to exercise your rights, or have a concern about how we've handled your data, please get in touch. We're building this with you; that starts with being available.

Fae Technologies Ltd  ·  20 Station Road, Cambridge, CB1 2JD
hello@askfae.com
ICO registration number: ZC131995

Glossary

A handful of terms in this policy are technical. Here's what they mean in plain English.

AES-256

Advanced Encryption Standard, 256-bit. A strong method for scrambling data when it's stored. Even if someone got hold of the underlying files, they couldn't read them without the key.

API

Application Programming Interface. The plumbing that lets two software systems talk to each other. When your bank shares data with Fae via open banking, it does so through an API.

CSV

Comma-Separated Values. A simple file format for tabular data that opens in Excel, Numbers, Google Sheets, or any text editor. One of the formats we'll use if you ask for a copy of your data.

DDoS

Distributed Denial of Service. A type of cyber attack that floods a website or app with so much fake traffic that real users can't get through. Like deliberately jamming a phone line.

ICO

Information Commissioner's Office. The UK's data protection regulator. They oversee how organisations handle your data, and you can complain to them if you think we've got it wrong.

ISO 27001

An international standard for managing information security. Organisations that meet it have to prove how they protect data, not just say they do. Fae is working towards certification.

JSON

JavaScript Object Notation. A structured file format readable by both humans and machines. The other format we'll use if you ask for a copy of your data.

Open banking

A secure, regulated way for apps to read your bank data, with your explicit permission. You authorise it. You can revoke it. We can only read the data, we can't influence it.

PECR

Privacy and Electronic Communications Regulations. UK rules covering marketing emails, cookies, and other electronic communications. Sits alongside GDPR.

TLS 1.3

Transport Layer Security, version 1.3. The technology that encrypts data while it's travelling across the internet. It's why your browser shows a padlock on a secure site. We use it everywhere.