Privacy Policy

1. Who we are

Sprault Ltd is responsible for the personal data described in this Privacy Policy.

Sprault Ltd is a company registered in England and Wales under company number 17144988.

Our registered address is:

Sprault Ltd
11 Gilling Court
Belsize Grove
London NW3 4UY
United Kingdom

For privacy questions or requests, contact:

privacy@sprault.com

This Privacy Policy applies to the Sprault mobile app, the Sprault website and related account, support and service communications.

2. What Sprault does

Sprault provides tools that help you organise, view and plan your finances.

The current version of Sprault allows you to:

• manually add financial accounts, assets and liabilities;
• record and update balances;
• track your net worth;
• manually record income, expenses and transfers;
• view spending by category and merchant;
• create and track financial goals;
• create forecasts using information and assumptions you provide;
• manage related settings and notifications; and
• view selected third-party offers and discounts.

The current version does not connect directly to your bank or financial institution and does not receive Open Banking or Open Finance data.

Sprault does not currently provide regulated financial advice, execute investments, make payments, provide credit or insurance, or allow users to apply for financial products through the app.

3. Personal data we collect

A. Account and identity information

We may collect:

• your name;
• email address;
• account identifiers;
• authentication and verification information;
• your date of birth where requested to confirm eligibility;
• login and account-security information; and
• information about your account status.

Passwords, authentication codes and similar credentials are handled using appropriate authentication and security systems.

B. Profile and preference information

We may collect information such as:

• preferred currency;
• app preferences;
• budgeting or planning preferences;
• notification preferences;
• communication preferences; and
• privacy and marketing choices.

C. Financial information you enter

Because Sprault is a financial organisation and planning tool, you may choose to enter information including:

• account names and types;
• account balances;
• assets and estimated values;
• liabilities and outstanding balances;
• interest rates;
• repayment amounts and dates;
• income;
• expenses;
• transfers;
• transaction dates;
• transaction categories;
• merchant names;
• financial notes;
• financial goals;
• target amounts;
• goal deadlines;
• planned contributions;
• forecast assumptions;
• expected growth rates; and
• other information you choose to enter into financial planning tools.

This information is entered manually by you in the current version of Sprault.

We do not currently obtain this information directly from your bank through Open Banking or Open Finance.

D. Information generated by Sprault

Sprault may calculate or generate information from the data you provide, including:

• net worth;
• changes in net worth;
• cashflow figures;
• spending totals;
• category and merchant summaries;
• forecast values and charts;
• projected balances;
• goal progress;
• estimated goal dates;
• recurring schedules; and
• other calculated financial outputs.

These outputs depend on the information and assumptions you provide.

E. Technical and security information

When you use Sprault, our systems and service providers may automatically generate or receive limited technical information necessary to operate, secure and troubleshoot the service.

This may include:

• IP address;
• device type;
• operating system;
• browser or app version;
• user agent;
• authentication-session information;
• timestamps;
• successful and failed request information;
• security events;
• server logs;
• backend-function logs;
• error information; and
• diagnostic information needed to investigate technical problems.

We do not currently use a third-party product analytics service to track how individual users navigate or interact with Sprault.

We do not currently use session replay or screen-recording technology.

We do not use advertising trackers to follow you across unrelated websites or apps.

4. Information from third parties

Most financial information in the current version of Sprault comes directly from you.

We may receive limited information from third parties where you choose to use their services with Sprault.

For example, if you choose Google Sign-In or Sign in with Apple, the relevant provider may provide us with information required to authenticate your account, such as an account identifier, name or email address depending on the information you have chosen to share.

Apple, Google and other third parties process information under their own privacy terms when you interact directly with their services.

5. How we use your personal data

We use personal data where necessary to:

• create and manage your account;
• authenticate you;
• confirm eligibility for the service;
• provide the features you request;
• store and display information you enter;
• calculate net worth and other financial figures;
• produce forecasts based on your assumptions;
• track goals and progress;
• display transactions and spending information;
• save your preferences;
• deliver notifications you enable;
• maintain the security of Sprault;
• prevent fraud, misuse and unauthorised access;
• investigate suspicious activity;
• diagnose technical problems;
• fix errors and maintain reliability;
• respond to support requests;
• process feedback;
• communicate important information about your account or the service;
• send marketing where you have chosen to receive it or where another lawful basis is available;
• comply with legal and regulatory obligations; and
• establish, exercise or defend legal rights.

We do not sell your personal data.

We do not use your financial information for third-party behavioural advertising.

6. Our lawful bases

UK data-protection law requires us to have a lawful basis for processing personal data.

Depending on the processing involved, we may rely on:

Contract

We rely on contract where processing is necessary to provide the Sprault service you have requested under our Terms of Use.

This may include:

• creating and managing your account;
• storing information you ask us to store;
• calculating outputs you request; and
• providing app features.

Legitimate interests

We may rely on our legitimate interests where necessary to operate, secure and improve Sprault in ways that do not override your rights and interests.

These interests may include:

• protecting accounts and systems;
• preventing fraud and misuse;
• maintaining service reliability;
• investigating errors;
• responding to support requests;
• protecting our legal rights; and
• understanding and resolving operational problems.

Consent

We rely on consent where required, including for optional marketing communications where applicable.

Consent is separate from accepting the Terms of Use.

You may withdraw consent at any time.

Legal obligation

We may process information where necessary to comply with a legal or regulatory obligation.

7. AI-powered features

Sprault may introduce AI-powered tools or features in the future.

The current Privacy Policy does not mean that your financial information is currently being sent to or processed by an external AI provider.

If an AI feature is introduced and it uses personal data in a materially different way, including where information needs to be processed by an AI service provider, we will provide appropriate information about that processing and update this Privacy Policy where required.

Where required by law, we will also provide any additional choices or obtain any consent needed before that processing takes place.

8. Forecasts and automated processing

Sprault uses calculation rules to turn information and assumptions you provide into financial displays, forecasts and other outputs.

These calculations may occur automatically.

They do not currently determine whether you receive a financial product, affect your legal rights or make another decision about you that has a legal or similarly significant effect.

Sprault does not currently make solely automated decisions about users that produce legal or similarly significant effects.

9. Who we share information with

We may share personal data with service providers where reasonably necessary to operate Sprault.

These may include:

Supabase

We use Supabase for services including authentication, database storage and backend functionality.

Hosting and infrastructure providers

We may use service providers to host, deliver, maintain and secure the Sprault app, website and supporting infrastructure.

Communications providers

We may use service providers to send:

• authentication messages;
• verification codes or links;
• security messages;
• account communications;
• support communications; and
• marketing communications where permitted.

Apple and Google

Where you interact with Sprault through Apple or Google services, including their app stores or sign-in services, those companies may process information under their own privacy policies.

Professional advisers

We may disclose information where reasonably necessary to lawyers, accountants, auditors, insurers or other professional advisers subject to appropriate confidentiality obligations.

Authorities

We may disclose information to regulators, courts, law-enforcement authorities or other public bodies where required or permitted by law.

We require service providers acting on our behalf to handle personal data subject to appropriate contractual and data-protection obligations.

We do not currently share your manually entered financial information with banks, Open Banking providers, employers or councils as part of the current consumer app.

10. Third-party offers and links

Sprault may display selected offers or links to third-party businesses.

Displaying an offer does not mean that the third party receives your Sprault financial profile.

If you choose to leave Sprault and visit a third-party website or service, that third party may collect information directly from you.

Their collection and use of information is governed by their own privacy policy.

11. International transfers

Some service providers or their sub-processors may process personal data outside the United Kingdom.

Where UK data-protection law treats this as a restricted international transfer, we will use or require an appropriate lawful transfer mechanism.

This may include:

• UK adequacy regulations;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved Standard Contractual Clauses; or
• another transfer mechanism permitted by applicable law.

Additional safeguards may also be applied where required.

You can contact privacy@sprault.com if you would like further information about safeguards relevant to your personal data.

12. How long we keep information

We keep personal data only for as long as reasonably necessary for the purposes for which it is used.

The appropriate period depends on the type of information and why we need it.

In general:

• account, profile and manually entered financial information is retained while your account is active;
• support and feedback records are retained for as long as reasonably necessary to resolve issues and maintain appropriate records;
• technical, error and security records are retained for a limited period appropriate to maintaining and protecting the service;
• marketing consent and withdrawal records may be retained so that we can demonstrate your choice and continue to respect an opt-out; and
• information needed for legal, regulatory, tax, accounting, security, fraud-prevention or claims purposes may be retained for the applicable period.

Where information has been anonymised so that it can no longer reasonably identify you, we may retain the anonymised information for longer.

13. Account deletion

You can request deletion of your Sprault account through the app's settings.

You can also contact privacy@sprault.com.

When an account is deleted, we delete or anonymise associated account and financial information from active systems, subject to limited retention where necessary for legal obligations, security, fraud prevention, disputes or legal claims.

Information collected independently by a third party is controlled by that third party and is not deleted merely because you delete your Sprault account.

14. Cookies, app storage and similar technologies

Sprault may use cookies, local storage, session storage, authentication tokens, secure app storage and similar technologies where necessary to:

• keep you signed in;
• authenticate your account;
• protect account security;
• remember essential settings;
• remember privacy choices;
• maintain onboarding or application state; and
• provide features you request.

The mobile app may use application or device storage rather than traditional browser cookies.

We do not currently use non-essential product analytics, advertising trackers or session-replay technologies.

Where you choose to use a third-party feature such as Google Sign-In or Sign in with Apple, the relevant provider may use its own technologies in accordance with its privacy terms.

15. Data security

We use technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unauthorised disclosure;
• alteration;
• misuse;
• loss; and
• destruction.

These measures may include authentication controls, access restrictions, protected communications, security monitoring and other appropriate safeguards.

No online system can guarantee absolute security.

You should protect your device and login information and contact us promptly if you believe your account has been accessed without permission.

16. Your data-protection rights

Depending on the circumstances, you may have the right to:

• request access to personal data we hold about you;
• ask us to correct inaccurate or incomplete information;
• request deletion of your personal data;
• request restriction of certain processing;
• object to certain processing;
• receive certain information in a portable format; and
• withdraw consent where processing is based on consent.

These rights are subject to conditions and exemptions under applicable law.

We may need to verify your identity before responding to a request.

To exercise a right, contact:

privacy@sprault.com

Your right to object

Where we process personal data on the basis of legitimate interests, you may have the right to object to that processing.

You also have the right to object to the use of your personal data for direct marketing at any time.

17. Marketing communications

Marketing communications from Sprault are optional.

Where consent is required, we will ask you separately whether you want to receive marketing communications.

Marketing consent is not a condition of creating or using a Sprault account.

You can opt out at any time by:

• using the unsubscribe option in a marketing email;
• changing relevant communication preferences where available; or
• contacting us.

We may keep a limited suppression record after you opt out so that we continue to respect your choice.

Account, security, authentication and other necessary service communications are not marketing and may still be sent where required to operate your account or service.

18. Children

Sprault is intended for people aged 18 or over.

We do not knowingly offer Sprault accounts to children.

If you believe someone under 18 has provided personal data to Sprault, contact privacy@sprault.com so that we can investigate and take appropriate action.

19. Complaints

If you have a privacy concern, please contact us at privacy@sprault.com.

You also have the right to complain to the Information Commissioner's Office, the UK's data-protection regulator.

You can find information about the ICO and how to make a complaint at ico.org.uk.

20. Changes to this Privacy Policy

We may update this Privacy Policy when:

• Sprault's features change;
• our service providers change;
• the way we process personal data changes; or
• applicable law or regulatory guidance changes.

We will update the date at the top of this Policy when changes are made.

Where a change materially affects how we use personal data, we will provide appropriate notice where required.

We will update our privacy information where required before introducing materially different processing, including Open Banking, materially different AI processing, financial-product functionality, employer services or council services.

21. Contact

Sprault Ltd
Company number 17144988
11 Gilling Court
Belsize Grove
London NW3 4UY
United Kingdom

privacy@sprault.com
sprault.com