Privacy Policy

Effective date: 14 May 2026

This Privacy Policy explains how Portfolio Pilot Ltd ("we", "us", "our") collects, uses, stores, and shares your personal data when you use the Portfolio Pilot platform. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1.1 Who We Are

Portfolio Pilot Ltd is the data controller. Contact us at privacy@portfoliopilot.co.uk, London, United Kingdom.

1.2 Data We Collect

• Account data
  • Name, email address, and hashed password
  • Billing name and address
  • Subscription status and plan details
• Portfolio and tenancy data
  • Property addresses, purchase prices, mortgage details, and valuations
  • Tenancy agreements, tenant names, and rent schedules
  • Compliance certificates and associated dates
  • Maintenance records and costs
  • Income, expenses, and cash flow data
• Open Banking data (where connected)
  • Bank account details and balances via TrueLayer (FCA-authorised AISP)
  • Transaction history for rent and expense reconciliation
  • Standing orders and direct debits
• Usage data
  • Log data: IP address, browser type, pages visited
  • Feature usage for product improvement
  • Device identifiers for push notification delivery

1.3 Legal Bases for Processing

• Contract performance — to provide the Service you have subscribed to
• Legitimate interests — product improvement, security, fraud prevention
• Legal obligation — tax and regulatory compliance
• Consent — push notifications and non-essential cookies (withdrawable at any time)

1.4 How We Use Your Data

• Operating the platform and generating portfolio insights
• Processing payments via Stripe
• Connecting to bank accounts via TrueLayer where authorised
• Sending weekly digests and compliance notifications
• Enabling accountant access via share tokens you generate
• Improving the Service through anonymised analytics

1.5 Open Banking and TrueLayer

Bank data is retrieved via TrueLayer Ltd, an FCA-authorised AISP acting as our data processor. We retrieve read-only transaction data only. We do not store your bank credentials. You may disconnect your bank at any time from account settings.

1.6 Accountant Portal Data Sharing

Where you generate a share token, your accountant receives read-only access to your portfolio data. You control access and may revoke it at any time. Accountants must agree to our Data Processing Agreement (Document 5) before accessing your data.

1.7 Data Retention

• Account data — duration of subscription plus 7 years (UK tax requirements)
• Portfolio and tenancy data — until you delete it or close your account
• Open Banking transaction data — 13 months from retrieval
• Usage logs — 90 days
• Billing records — 7 years (legal obligation)

1.8 Your Rights Under UK GDPR

• Access — request a copy of your data
• Rectification — correct inaccurate data
• Erasure — request deletion (subject to legal retention obligations)
• Restriction — limit how we process your data
• Portability — receive your data in machine-readable format
• Object — object to processing based on legitimate interests
• Withdraw consent — for push notifications and non-essential cookies

To exercise your rights, contact privacy@portfoliopilot.co.uk. We respond within 30 days. You may also complain to the ICO at ico.org.uk.

1.9 International Transfers

Primary data storage is in the UK/EEA via Supabase. Where data is processed elsewhere (e.g. Stripe, OpenAI), we rely on UK adequacy decisions or Standard Contractual Clauses.

1.10 Security

We implement encryption at rest and in transit, role-level access controls, and regular security reviews. Data breaches posing risk to your rights will be reported to the ICO within 72 hours and to affected users without undue delay.

1.11 Changes

Material changes will be notified by email. Continued use after the effective date constitutes acceptance.