Privacy Policy
1. Who we are
Faria is provided by Faria Holdings Ltd ("Faria", "we", "us", "our"), a private limited company registered in England and Wales.
- Company number: 17440506
- Registered office: Flat 21 New Priestgate House, 57 Priestgate, Peterborough PE1 1JX
- ICO registration number: ZC249279
- Email for all privacy matters, requests and complaints: info@fariaapp.com
We are the data controller for the personal data described in this policy. We have not appointed a Data Protection Officer because we are not legally required to; the email above is the correct route for all data protection questions.
This policy covers the Faria mobile app and the website at fariaapp.com, including the waitlist sign-up form.
2. What data we collect and where it comes from
2.1 Data you give us directly
| Data | When | Required? |
|---|---|---|
| Full name | Onboarding | Yes |
| Email address | Registration | Yes |
| Password (stored only as a cryptographic hash — we cannot see it) | Registration | Yes |
| Date of birth | Onboarding, for age verification | Yes |
| Mobile number | Profile screen | Optional |
| Profile photo | Profile screen | Optional |
| Wishlist items (name, price, optional category) | When you add them | Optional |
| Waitlist email address | Website sign-up form | Optional |
| Anything you write to us | Emails, support requests, complaints | — |
2.2 Data we receive from your bank
When you connect a bank account, we receive the following from your bank through our Open Banking provider:
- Account details: the account's display name, type and currency, the name of your bank, and an internal reference identifier assigned by our Open Banking provider. We store only a masked account identifier — the last four digits of your account number, as shown to you in the app. Your full account number is briefly held in memory during the connection process solely to derive this masked value, and is never logged, stored or persisted anywhere. Your sort code is never received, used or stored by us in any form.
- Balances: current and available balances.
- Transactions: date, amount, merchant name or description, transaction type, and any category codes supplied by your bank.
Source of this data: your bank or building society, accessed on our behalf by our Open Banking provider under the authorisation you give (see section 4.1). We do not collect this data ourselves and never receive your online banking username or password.
2.3 Data we generate about you
- Spending categories we assign to your transactions using merchant-name keyword matching (e.g. groceries, eating out, transport, subscriptions, rent, utilities, miscellaneous)
- Spending patterns, comparisons against your own history, and the ranked guidance shown in the app
- Your subscription status (e.g. free, active, expired, and which tier)
2.4 Technical data
- Account security events, such as login timestamps and failed login attempts, recorded by our authentication provider
- When you visit fariaapp.com, our web host may record standard server logs including your IP address, browser type and pages requested, for security and to serve the site
We do not use analytics tools, crash-reporting tools, advertising trackers or push notifications. If we introduce any of these, we will update this policy before they go live and, where the law requires it (including under the Privacy and Electronic Communications Regulations for push notifications and non-essential cookies), ask for your consent first.
2.5 Special category data
Faria does not seek out or process "special category" data (information about health, religious beliefs, trade union membership, sexual orientation, ethnicity, political opinions, genetic or biometric data). Our categorisation looks only at merchant names and amounts to sort transactions into everyday spending categories. A merchant name in your raw transaction data could incidentally relate to something sensitive (for example a pharmacy or a religious donation), but we do not identify, label, infer anything from, or treat such transactions any differently from any other purchase — if it does not match an ordinary category rule it is simply categorised as "miscellaneous". We do not rely on any Article 9 condition because we do not process special category data for any purpose.
3. Why we use your data and our lawful basis
UK GDPR requires us to have a lawful basis for each thing we do with your data. Here they are:
| Purpose | Data used | Lawful basis (Article 6) |
|---|---|---|
| Creating and running your account, logging you in, keeping it secure | Name, email, password hash, security events | Contract (Art. 6(1)(b)) — necessary to provide the service you signed up for |
| Verifying you are 18 or over | Date of birth | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) — we must not offer an Open Banking–connected financial service to children and need to be able to demonstrate that we check |
| Connecting to your bank and retrieving balances and transactions | Bank account data | Contract (Art. 6(1)(b)) — the core service cannot work without it |
| Categorising transactions and calculating your spending patterns | Bank account data, generated categories | Contract (Art. 6(1)(b)) |
| Generating personalised guidance through our AI provider | Balances, spending patterns, transaction summaries | Contract (Art. 6(1)(b)) — this is how the guidance is produced |
| Tracking wishlist items against your spending | Wishlist data, bank account data | Contract (Art. 6(1)(b)) |
| Managing your subscription and unlocking paid features | Subscription status | Contract (Art. 6(1)(b)) |
| Contacting you about your account, service changes and this policy | Email, name | Contract (Art. 6(1)(b)), and legal obligation (Art. 6(1)(c)) for legally required notices |
| Managing the waitlist and telling you when Faria launches | Waitlist email | Consent (Art. 6(1)(a)) — you can unsubscribe at any time |
| Keeping the service secure, preventing fraud and abuse, and investigating security incidents | Account data, security events, IP addresses | Legitimate interests (Art. 6(1)(f)) — see 3.1 |
| Responding to your requests, questions and complaints | Whatever you send us | Legal obligation (Art. 6(1)(c)) for rights requests and complaints; legitimate interests (Art. 6(1)(f)) for general support |
| Establishing, exercising or defending legal claims; complying with the law, regulators or court orders | Any relevant data | Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) |
A note on Open Banking authorisation. When you connect your bank you give an explicit authorisation, under the Payment Services Regulations 2017, for our Open Banking provider to access your account information. That authorisation is a separate regulatory requirement and is not the same as UK GDPR consent. Our lawful basis under UK GDPR for using the data we receive is contract, because the guidance service cannot be delivered without it. You can withdraw the bank authorisation at any time (see section 6.2), which stops all further access.
3.1 Our legitimate interests, specifically
Where we rely on legitimate interests we have weighed our interests against your rights and concluded that the processing is necessary and does not override your interests. Specifically:
- Security and fraud prevention. We hold financial data, so we have a strong interest — and you have a strong interest — in detecting unauthorised access, credential-stuffing and misuse. This uses only the minimum technical and account data needed to detect and respond to threats.
- Age assurance. We have a legitimate interest in being able to demonstrate that users are adults, because the service involves live financial data and a paid subscription.
- Support and correspondence. We have a legitimate interest in keeping a record of what we have told you and what you have told us, so we can help you consistently and resolve any issues.
- Legal claims and compliance. We may need to keep or use limited data to respond to a regulator, defend a claim, or comply with the law.
You have the right to object to any processing based on legitimate interests (see section 7).
3.2 No automated decision-making with legal effects
Faria's engine calculates and ranks suggestions (for example, "ease off this category this week" or "cover this payment before it's due"). You review that guidance and decide what, if anything, to do — outside the app, through your own bank. Faria never executes transactions, moves money, changes your account settings, or takes any action on your behalf. Nothing Faria does is a solely automated decision producing legal or similarly significant effects within the meaning of Article 22 UK GDPR.
4. Who we share your data with
We use a small number of specialist companies to run Faria. Each acts as our processor (they only handle data on our instructions, under a written Data Processing Addendum) unless stated otherwise. We do not sell personal data and do not share it with advertisers or data brokers.
We describe each provider by its role. The named company may change in future (see section 4.7).
4.1 Our Open Banking provider
We access your bank data through an Account Information Service Provider authorised and regulated by the Financial Conduct Authority (currently TrueLayer Limited). Faria connects to your bank under that provider's regulatory authorisation rather than holding its own.
Direction of data flow: our Open Banking provider does not receive your personal data from Faria. It accesses your bank on your authorisation and passes your balances and transactions to us. To connect, you will be taken to the provider's consent screen and then to your own bank's login. The provider handles that authorisation step under its own privacy policy, and we never see your banking credentials.
4.2 Our AI provider — currently Anthropic, PBC
This is the disclosure we most want you to read.
Faria's in-app companion generates its guidance using Claude, a large language model provided by Anthropic. To produce guidance that is specific to you, we send your financial data to Anthropic's API: your account balances, your spending totals and patterns by category, and summaries of your transactions. We do not send your name, email address, bank account identifiers or any other direct identifier alongside this data.
Anthropic processes this data in the United States. This is an international transfer of your personal data outside the UK. It is protected by:
- Anthropic's Data Processing Addendum, under which Anthropic acts as our processor and may use the data only to provide the service we request;
- the EU Standard Contractual Clauses (Module Two, controller to processor) together with the UK ICO-approved International Data Transfer Addendum, issued under section 119A of the Data Protection Act 2018, which give you enforceable rights and put Anthropic under UK-standard obligations even though it is a US company;
- a commitment that data sent through the API is not used to train Anthropic's models.
Retention at Anthropic. Under the Data Processing Addendum, Anthropic may retain data we send it only for the term of our agreement, and must delete all copies (including any held by its sub-processors) within 30 days of that agreement ending, except where retention is required by law, is necessary to resolve a dispute between us, or is necessary to combat harmful use of the service. In practice, Anthropic's API is used by Faria on a request-and-response basis: your data is sent to generate one piece of guidance and the response is returned to us. Our own testing of the service confirms that the content of individual requests is not stored by Anthropic in a way that is linked to you; only aggregate, non-identifiable usage metrics (such as total volume processed) are recorded. Anthropic's sub-processors are listed at anthropic.com/subprocessors.
Because Anthropic is a processor acting only on our instructions, you exercise all your rights over this data through us, not through Anthropic.
4.3 Our database and authentication provider — currently Supabase, Inc.
Supabase stores your account data (name, email, password hash, date of birth, optional mobile number and photo), your wishlist, your synced bank data, generated categories and guidance, and subscription status. It also handles authentication and login.
Our Supabase project is hosted in the eu-west-2 (London, United Kingdom) region, so your data is stored in the UK. Supabase, Inc. is a US company; any access by its personnel for support or maintenance is governed by its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
4.4 Our hosting provider — currently Railway Corporation
Railway hosts the servers that run Faria's backend — the systems that receive your bank data from our Open Banking provider, categorise it, calculate guidance and call our AI provider. Our services run in Railway's Netherlands (EU West) region, so data processed by our backend is processed within the European Economic Area. The UK Government recognises the EEA as providing adequate data protection, so no additional transfer safeguards are required for UK-to-EEA processing. Railway is a US company; any access by its personnel is governed by its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
4.5 Our subscription management provider — currently RevenueCat, Inc.
Faria's paid subscription is purchased entirely through Apple's In-App Purchase system (and Google Play's equivalent, if an Android version launches). Faria never collects, receives, transmits or stores your payment card details. Apple or Google handle payment entirely, as independent controllers under their own privacy policies.
RevenueCat receives the purchase receipt and transaction identifiers from Apple/Google and tells us your subscription status (for example: active, expired, which tier) so we can unlock or restrict features. We provide RevenueCat with an internal app user identifier to link the subscription to your account. RevenueCat is a US company; the transfer is governed by its Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.
4.6 Our website provider — currently Netlify, Inc.
Netlify hosts fariaapp.com and processes waitlist sign-ups through Netlify Forms, a built-in feature of the same platform. Netlify therefore receives the email address you enter on the waitlist form, and may process standard server logs including your IP address when you visit the site. Netlify is a US company; transfers are governed by its Data Processing Addendum, which provides for the EU Standard Contractual Clauses together with the UK's International Data Transfer Addendum issued by the Information Commissioner's Office under section 119A of the Data Protection Act 2018.
4.7 If we change a provider
We may replace any of the providers above with another company performing the same role — for example, a different Open Banking provider, AI provider or hosting provider. If we do, we will update the name in this policy before the change takes effect and, where the change is material — for example, if your data would be processed in a new country or used in a new way — we will notify you in advance as described in section 9.
4.8 Other disclosures
We may also share personal data:
- with professional advisers (lawyers, accountants, auditors) under confidentiality obligations, where necessary;
- with regulators, law enforcement, courts or other authorities where we are legally required to, or to protect the rights, property or safety of Faria, our users or others;
- with a buyer or successor if Faria Holdings Ltd is sold, merges or transfers its business — in which case your data would remain subject to this policy and we would notify you.
5. International transfers — summary
| Where your data goes | Why | Safeguard |
|---|---|---|
| United Kingdom (Supabase, London) | Storage and authentication | No transfer — UK |
| Netherlands / EEA (Railway) | Backend processing | UK adequacy regulations for the EEA — no additional safeguard required |
| United States (Anthropic) | AI guidance generation | EU SCCs + UK International Data Transfer Addendum, in Anthropic's DPA |
| United States (RevenueCat, Netlify; Supabase and Railway support access) | Subscription status, website hosting and waitlist, provider support | EU SCCs + UK International Data Transfer Addendum, in each provider's DPA |
You can ask us for more information about these safeguards at info@fariaapp.com.
6. How long we keep your data
6.1 While your account is active
We keep your account data and your full synced transaction history for as long as your account remains open. Faria's guidance works by comparing your current spending against your own past patterns, so the service becomes less accurate with less history. For that reason we do not apply an automatic deletion period to transaction data while you continue to use the app.
6.2 If you disconnect a bank account
Disconnecting a bank account in the app immediately stops Faria syncing any new data from that account and permanently revokes our Open Banking provider's access to it. Transactions already synced before you disconnected are not automatically deleted: they remain stored, but the account is marked inactive, so that data no longer feeds into your current balance or ongoing guidance.
We do not currently offer a way to erase specific transaction history while keeping your account open. Because our system regularly re-syncs recent transactions from connected banks, manually removing individual transactions from an active account cannot be guaranteed to be permanent. To erase your transaction history, delete your account (below) — this immediately and permanently disconnects your bank and erases all data, with no risk of anything being re-added.
6.3 If you delete your account
When you delete your account:
- Your bank connection is revoked immediately and permanently, as the very first step. This cannot be undone or recovered, whatever happens next.
- All other account data is soft-deleted for a 30-day recovery window. During this time you can recover your account and all of its data — except the bank connection, which you would need to set up again — simply by logging back in with your original email and password.
- After 30 days, everything is permanently and irreversibly erased from our database: account details, transaction history, categories, guidance, wishlist and subscription status. No records survive beyond this point.
Because our AI provider does not retain data linked to you (section 4.2), there is nothing to delete there.
Subscriptions purchased through Apple or Google are managed in your Apple/Google account and are not cancelled by deleting your Faria account; Apple/Google retain their own transaction records under their own policies.
6.4 Other retention periods
- Waitlist email addresses: 12 months from sign-up, or sooner if you unsubscribe.
- Emails, support and complaint correspondence: 12 months from the last message in the exchange, so that we can demonstrate how a matter was handled.
- Records needed for legal claims or regulatory requests: for as long as the matter is live plus the applicable limitation period (generally six years in England and Wales).
- Website server logs: as per our web host's standard retention.
7. Your rights
Under UK GDPR you have the following rights. They are free to exercise. Email info@fariaapp.com from the address on your account (we may ask you to confirm your identity so we don't give your financial data to the wrong person).
- Access — a copy of the personal data we hold about you and an explanation of how we use it.
- Rectification — correction of inaccurate or incomplete data. You can update your name, mobile number and photo in the Profile screen yourself.
- Erasure — deletion of your data where there is no longer a good reason to keep it. Deleting your account in the app does this for everything (see section 6.3 for why we cannot erase individual transactions while your account stays connected).
- Restriction — asking us to stop using your data (while keeping it) in certain situations, for example while we check its accuracy.
- Portability — a copy of the data you provided or that was collected from your bank, in a structured, commonly used, machine-readable format, which you can take to another service. We do not currently offer self-service export; if you ask, we will provide it within one month.
- Objection — objecting to any processing we base on legitimate interests (section 3.1). We will stop unless we can show compelling legitimate grounds that override your interests.
- Withdrawing consent — where we rely on consent (currently only the waitlist), you can withdraw it at any time; this does not affect processing that happened before you withdrew.
- Rights around automated decisions — as explained in section 3.2, Faria makes no solely automated decisions with legal or similarly significant effects, so these rights are not engaged; if that ever changes we will update this policy first.
How quickly we respond. We will respond to any rights request within one month of receiving it. If a request is unusually complex or you have made several, we may extend this by up to two further months, and we will tell you within the first month if so. We can refuse or charge for requests that are clearly unfounded or excessive, and we will explain why.
You do not need to use any particular form. Contacting us via the email above is enough, but please say clearly which right you are exercising so we can act quickly.
8. Complaints
8.1 Complain to us first
If you think we have handled your personal data unlawfully or unfairly, you have the right to complain directly to us, and we would ask you to do so first. The Data (Use and Access) Act 2025 requires us to provide this route and to handle your complaint properly.
How to complain: email info@fariaapp.com with "Data protection complaint" in the subject line, telling us what happened and what you would like us to do. You can raise it in the same email as a rights request.
What we will do:
- Acknowledge your complaint in writing within 5 working days (the law requires acknowledgement within 30 days; we aim to be much faster).
- Investigate it, taking appropriate steps to look into what happened and, where something has gone wrong, put it right.
- Give you a substantive written response — our findings, what we have done or will do, and your onward options — within 30 days of receiving the complaint. If we genuinely need longer, we will tell you why and when to expect a full reply.
We will not treat you any differently for having complained.
8.2 Complain to the ICO
You also have the right to complain to the UK's data protection regulator at any time, though the ICO will generally expect you to have raised the matter with us first.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: https://ico.org.uk/make-a-complaint/
You may also have the right to seek a judicial remedy through the courts, including compensation for damage or distress caused by a breach of data protection law.
9. Changes to this policy
This version was last updated on 15 September 2026. We keep a version history and can provide previous versions on request.
We will update this policy when our data practices change — for example, if we change a provider, add a new feature that uses your data, or introduce analytics or notifications. Minor changes (clarifications, contact detail updates, or a provider name change where the new provider performs the same role in the same country) will be reflected here with a new date.
For material changes — anything that changes what data we collect, why we use it, who receives it, or where it is processed — we will notify you by email to your registered address and by a notice in the app at least 14 days before the change takes effect. Where a change requires your consent under the law, we will not proceed without it.
10. Age requirements
Faria is for adults only. You must be 18 or over to create an account. We ask for your date of birth during onboarding to check this.
We do not knowingly collect personal data from anyone under 18. If we discover that an account belongs to someone under 18 — whether because the date of birth was entered incorrectly, because a parent or guardian tells us, or for any other reason — we will revoke any bank connection immediately, close the account, and delete its data straight away, without the 30-day recovery window. If you believe someone under 18 has an account, please tell us at info@fariaapp.com.
11. Security
We take the security of your financial data seriously. Specifically:
- All data is encrypted in transit between the app, our servers and our providers (TLS).
- Sensitive bank access tokens are encrypted before storage.
- Passwords are stored only as salted cryptographic hashes; we cannot see them.
- Bank access is via regulated Open Banking, never by storing your banking credentials.
- Row-level access controls in our database mean each user can only reach their own data.
- Your full bank account number and sort code are never stored by us or transmitted to any third party.
- Faria is currently a founder-run company; access to the systems holding your data is limited to the founder.
No system is perfectly secure. If a personal data breach occurs that is likely to result in a high risk to you, we will tell you without undue delay, and we will report notifiable breaches to the ICO within 72 hours as the law requires.
12. Cookies and the website
fariaapp.com does not use analytics, advertising or tracking cookies. Any cookies set are strictly necessary for the site to function, so no cookie consent banner is required.
13. Contact us
Faria Holdings Ltd
Flat 21 New Priestgate House, 57 Priestgate, Peterborough PE1 1JX
Company number 17440506
ICO registration number ZC249279
info@fariaapp.com