Privacy Policy

Last updated: 1 March 2026

1. Who we are

FloatUp is a UK-based financial technology service that helps you find savings across your household bills and subscriptions. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, FloatUp is the data controller responsible for your personal data. If you have questions about how we handle your data, you can reach us at privacy@floatup.app.

2. What data we collect and why

We only collect what we need to provide the FloatUp service. Here is a breakdown of the data we collect, why we collect it, and the legal basis under UK GDPR.

Account information

Your name, email address, and optionally your phone number. Collected when you sign up via Clerk.

Legal basis: Contract: we need this to create and manage your account.

Bank transaction data

Transaction history from your connected bank accounts, accessed read-only through Plaid Open Banking. We never have access to your bank login credentials and we cannot move your money.

Legal basis: Consent: you explicitly authorise access through your bank when connecting your account.

Billing information

Payment card details and billing address, handled entirely by Stripe. We never see or store your full card number.

Legal basis: Contract: necessary to process payments for your subscription.

AI-generated savings insights

We use Anthropic's AI to analyse your transaction data and generate personalised savings recommendations. Your spending data is sent to Anthropic for processing but is never used to train their AI models.

Legal basis: Legitimate interest: providing the core savings insights that make FloatUp useful to you.

Email communications

Your email address is used to send transactional emails (account confirmations, savings alerts, billing receipts) via Resend.

Legal basis: Contract and legitimate interest: keeping you informed about your account and the savings we find.

3. How we use Open Banking data

FloatUp accesses your bank transaction data through Plaid, an FCA-regulated Open Banking provider. This is important to understand:

We only have read-only access. We can see your transactions but can never initiate payments, transfers, or make any changes to your accounts.
Your bank login credentials are never shared with us. You authorise access directly through your bank's own authentication.
We use your transaction data solely to identify savings opportunities: unused subscriptions, better deals on bills, and overpayments.
We never sell your transaction data to third parties. We never use it for advertising or profiling beyond providing you with savings insights.
You can revoke Open Banking access at any time through your bank's app or by disconnecting your account in FloatUp.

4. Third-party processors

We share your data with the following service providers, each of whom acts as a data processor on our behalf. We have data processing agreements in place with each.

Provider	Purpose	Location
Plaid	Open Banking: read-only bank transaction access (FCA regulated)	UK / EU
Stripe	Payment processing and billing	US (with UK entity)
Clerk	Authentication, user accounts, and session management	US
Anthropic	AI analysis of transaction data to generate savings insights	US
Resend	Transactional and notification emails	US
Supabase (PostgreSQL)	Database storage for account and app data	EU
Vercel	Application hosting and deployment	US / Global edge

5. Data retention

We keep your data only as long as necessary to provide the service:

Account data: retained while your account is active. Deleted within 30 days of account deletion.
Bank transaction data: retained while your bank connection is active. Deleted within 30 days of disconnecting your bank or deleting your account.
Savings insights: retained while your account is active. Deleted with your account.
Billing records: retained for 7 years after your last payment to comply with UK tax and accounting obligations.
Server logs: retained for up to 30 days for debugging and security purposes, then automatically deleted.

6. Your rights under UK GDPR

You have the following rights regarding your personal data. You can exercise any of these by emailing privacy@floatup.app or, where applicable, through your account settings.

Right of access: request a copy of the personal data we hold about you.
Right to rectification: ask us to correct any inaccurate or incomplete data.
Right to erasure: request deletion of your personal data. You can delete your entire account from your account settings.
Right to data portability: receive your data in a structured, commonly used, machine-readable format.
Right to object: object to processing based on legitimate interest.
Right to restrict processing: ask us to temporarily limit how we use your data.
Right to withdraw consent: where processing is based on consent (such as Open Banking access), you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
Right to lodge a complaint: if you believe we have not handled your data properly, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

We aim to respond to all rights requests within one calendar month.

7. International data transfers

Some of our third-party processors are based in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner, and confirming that processors maintain adequate data protection standards. We only transfer data where it is necessary to provide the service.

8. Cookies

FloatUp uses only essential cookies required for the service to function. These are authentication cookies set by Clerk to keep you logged in. We do not use analytics cookies, advertising cookies, or any form of tracking cookies. Because we only use strictly necessary cookies, we do not require a cookie consent banner under UK law.

9. Children's data

FloatUp is not intended for anyone under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us at privacy@floatup.app and we will delete it promptly.

10. Contact us

If you have any questions about this privacy policy or how we handle your personal data, please email us at privacy@floatup.app.

11. Changes to this policy

We may update this privacy policy from time to time to reflect changes to our practices or for legal, regulatory, or operational reasons. When we make material changes, we will notify you by email or through a notice within the app. The “last updated” date at the top of this page shows when the policy was most recently revised.

Back to home