Privacy Policy

1. Data Controller Identity

The data controller — the person responsible for deciding how and why your personal data is processed — is:

FinLitPath is currently operated as an individual project. A formal Data Protection Officer (DPO) has not been appointed, as the scale of processing does not require one under Article 37 UK GDPR. All data protection queries should be directed to the email address above.

We are registered with and subject to the oversight of the Information Commissioner's Office (ICO), the UK's independent authority for data protection law. You can contact the ICO at ico.org.uk or on 0303 123 1113.

2. What Personal Data We Collect

Based on a full audit of the FinLitPath codebase, we collect and process the following categories of personal data:

2.1 Account & Identity Data

2.2 Financial Information

2.3 Learning & Engagement Data

2.4 Referral Data

2.5 Technical & Usage Data

3. How We Collect Data

3.1 Directly From You

We collect data that you actively provide to us when you:

• Create an account (username, email, date of birth, password);
• Use the budget, goal, or financial scoring tools (income, expenses, savings, goals);
• Add items to your investment watchlist;
• Complete quizzes or daily tasks;
• Participate in the leaderboard or referral programme.

3.2 Automatically

When you use the Platform, certain data is collected automatically:

• Authentication tokens — Supabase issues a JWT access token and refresh token when you log in. These are stored in your browser's localStorage under the key finlitpath-auth;
• IP address and request metadata — collected by our hosting infrastructure (Netlify, Supabase, Neon) as part of normal server operation. We do not run our own server-side analytics or tracking scripts;
• Session data — Supabase manages session cookies to keep you logged in across browser sessions.

3.3 From Third Parties

• Supabase — acts as our authentication provider. When you sign up or log in, Supabase processes your email and password and returns a user identifier and session token to us;
• Referral links — if you arrive at the Platform via a referral link (containing a ?ref= parameter), we record the referral code to associate you with the referring user if you register.

3.4 What We Do NOT Collect

• We do not use Google Analytics, Meta Pixel, or any third-party behavioural analytics or advertising tracking;
• We do not collect payment card details — we do not charge for the Service and have no payment processing integration;
• We do not collect precise account numbers, sort codes, or National Insurance numbers;
• Fonts are self-hosted via Next.js — no font requests are made to Google's servers.

4. Legal Basis for Processing (Article 6, UK GDPR)

UK GDPR requires us to have a lawful basis for every type of processing. The table below sets out the basis for each category of data we process.

5. How We Use Your Data

• Account management — creating, maintaining, and securing your account; verifying your identity when you log in;
• Delivering the Services — calculating budget splits, financial health scores, literacy scores, and goal projections from the data you input;
• Displaying personalised content — showing you your saved goals, budget plans, watchlist quotes, and leaderboard ranking;
• Gamification and engagement — tracking streaks, awarding points, and updating the leaderboard;
• Referral programme — crediting your account with bonus points when someone you referred registers;
• Transactional communications — sending you a welcome email when you register (via Resend). We do not send marketing emails. Every transactional email contains information on how to contact us;
• Security and fraud prevention — rate-limiting API requests, detecting and preventing abuse, and maintaining audit logs;
• Service improvement — understanding which features are used to prioritise development (using aggregated, non-identifiable patterns from API access logs);
• Legal compliance — complying with applicable UK law, court orders, or regulatory requests.

We will not sell your personal data to third parties. We will not use your Financial Information for credit scoring, underwriting, or any purpose other than delivering the educational tools you requested.

6. Data Sharing & Third-Party Processors

We do not sell your data. We share personal data only with the sub-processors listed below, each of whom processes data strictly on our behalf and under a Data Processing Agreement (DPA).

6.1 Disclosure to Authorities

We may disclose your personal data to law enforcement, regulators, or courts where we are legally obliged to do so, or where necessary to protect the rights, property, or safety of FinLitPath, its users, or the public.

6.2 Business Transfers

In the event that FinLitPath is transferred to, or merged with, another entity, your personal data may be transferred as part of that transaction. We will notify you before any such transfer takes effect and give you the opportunity to delete your account.

7. International Data Transfers

The UK has left the EU. Under UK GDPR, transfers of personal data outside the UK require an appropriate safeguard.

Several of our sub-processors (Supabase, Neon, Netlify, Resend, Currents API) are incorporated in the United States. The UK Government has not issued an adequacy regulation covering the US in general. We therefore rely on UK International Data Transfer Agreements (IDTAs) or the equivalent EU Standard Contractual Clauses (SCCs) (approved for UK use under the IDTA transitional provision) with each US-based processor.

In practice, however:

• Neon — your application data is stored in the eu-west-2 AWS region (EU West). Data at rest does not leave EU/UK territory;
• Supabase — our project is configured to use EU-region infrastructure;
• Netlify — serves static content from CDN edge nodes globally, including UK nodes, but US-based infrastructure handles build and deployment operations.

You may request a copy of the relevant transfer safeguards by emailing enquiriesFLP@outlook.com.

8. Data Retention

We do not retain your data for longer than necessary. Account deletion is permanent and irreversible — we do not operate a "soft delete" or grace period. If you wish to export your data before deleting, see Section 9 (Right to Portability).

9. Your Rights Under UK GDPR

Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data. To exercise any of these rights, email enquiriesFLP@outlook.com. We will respond within one calendar month (extendable by a further two months for complex requests, with notice).

• 1
  Right of Access (Subject Access Request) You can request a copy of all personal data we hold about you, along with information about how and why we process it. Submit a request to our email above.
• 2
  Right to Rectification If any personal data we hold about you is inaccurate or incomplete, you can correct it. Most account data (email, username) can be updated directly in Account Settings.
• 3
  Right to Erasure ("Right to be Forgotten") You can request deletion of your personal data. For FinLitPath, the easiest way to exercise this right is to use the Delete Account button in Account Settings, which immediately and permanently erases all your data. You may also contact us by email.
• 4
  Right to Restriction of Processing You can ask us to pause processing of your data in certain circumstances (e.g. while accuracy is contested, or while an objection is considered).
• 5
  Right to Data Portability Where processing is based on contract or consent, you can request your data in a structured, commonly used, machine-readable format (JSON). Contact us to request a data export.
• 6
  Right to Object You can object to processing based on legitimate interests (e.g. leaderboard participation, server logs). We will stop the processing unless we can demonstrate compelling legitimate grounds that override your interests.
• 7
  Rights Re Automated Decision-Making We do not make any automated decisions about you that produce legal or similarly significant effects. Financial scores and literacy scores are educational indicators only, with no automated decision-making consequences.
• 8
  Right to Withdraw Consent Where we rely on your consent for processing, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• 9
  Right to Lodge a Complaint with the ICO If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office at ico.org.uk/make-a-complaint/ or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concern first.

10. Cookies & Local Storage

FinLitPath uses a combination of browser cookies (managed by Supabase) and browser localStorage to deliver its Services. We do not use advertising cookies, third-party tracking cookies, or analytics cookies.

10.1 Cookie Categories

✓ Strictly Necessary These cookies are essential for the Platform to work. You cannot opt out of these without losing core functionality.

○ Functional These localStorage entries store your preferences and in-progress state. They do not leave your device.

10.2 Managing Cookies & localStorage

You can control and manage cookies and localStorage through your browser settings:

• Chrome: Settings → Privacy and security → Cookies and other site data / Site settings
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions

Clearing your localStorage will log you out and reset your locally stored preferences. It will not delete any data stored on our servers — use the Delete Account feature for that.

10.3 No Third-Party Tracking

We do not load any third-party advertising, tracking, or analytics scripts. Google Fonts are self-hosted via Next.js and no font requests are sent to Google's servers.

11. Children's Data

Under UK GDPR Article 8, the age of consent for information society services in the UK is 13 years. Our Platform requires users to be at least 13 years old to register.

Users aged 13–17: The Platform deals with financial topics aimed at building literacy skills. Users under 18 should be aware that the financial tools, savings rate information, and market news on this Platform relate to adult financial products. We recommend that users under 18 discuss any financial decisions with a parent or guardian.

If you believe a child under 13 has created an account on our Platform, please contact us at enquiriesFLP@outlook.com. We will promptly delete the account and all associated data.

We do not direct targeted marketing at children, and we do not create profiles of children's online behaviour for commercial purposes.

12. Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

12.1 Technical Measures

• Transport encryption — all data in transit between your browser and our services is encrypted using TLS (HTTPS). We enforce HTTPS across all endpoints;
• Password security — passwords are never stored in plain text. Supabase hashes all passwords using bcrypt with a unique salt per user. We never have access to your plain-text password;
• JWT authentication — API requests are authenticated using short-lived JSON Web Tokens (JWTs) issued by Supabase. Access tokens expire and are refreshed via secure refresh tokens;
• Rate limiting — all data-submission API endpoints are rate-limited (5–30 requests/minute depending on sensitivity) to prevent brute-force and abuse;
• Database encryption — data at rest in our Neon PostgreSQL database is encrypted using AES-256 (provided by AWS infrastructure);
• Least-privilege access — the backend API uses a database user with only the permissions required for application operations;
• No plaintext credentials — API keys and secrets are stored as environment variables and never committed to source control.

12.2 Organisational Measures

• Access to production systems is restricted to the operator (Godwin Saiju Dominic) only;
• Third-party processors are subject to Data Processing Agreements (DPAs);
• This Privacy Policy is reviewed and updated when significant changes occur to data processing practices.

12.3 Data Breach Procedure

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of the breach, as required by Article 33 UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

12.4 Your Responsibility

No security system is impenetrable. You also have a role to play: use a strong, unique password; do not share your login credentials; log out when using shared devices; and notify us immediately if you suspect your account has been compromised.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our data processing practices, legal requirements, or the features of the Platform. When we make changes:

• We will update the "Last updated" date and version number at the top of this page;
• We will display a notice within the Platform;
• For material changes (e.g. new categories of data, new third-party processors, changes to legal basis), we will email registered users at least 14 days before the change takes effect.

Version History

14. Contact & Complaints

14.1 Contact Us

For any questions, requests, or complaints about this Privacy Policy or our data practices, please contact:

14.2 Right to Complain to the ICO

If you are unhappy with our response, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

We would always appreciate the opportunity to address your concerns before you approach the ICO, but you are entitled to contact the ICO at any time.