Privacy Policy

1. Who we are

DepositScout Ltd, 124 City Road, London EC1V 2NX, United Kingdom, is the data controller for the personal information described in this policy. That means we decide why and how your personal information is used. We are registered with the Information Commissioner's Office (ICO) under registration number ZC025953.

For anything relating to your personal information, contact us at [email protected].

2. Whose information we collect

• Visitors browsing the Website.
• Alert subscribers who sign up for rate alerts, news, or the weekly roundup.
• Account holders who create a DepositScout account and use the dashboard.
• Customers who pay for a DepositScout product by Direct Debit.
• Business contacts who request API access, join a waitlist, or contact us about partnerships or media.

3. What information we collect

Information you give us directly

• Alert subscriptions: email address, optional first and last name, country, and your alert preferences (account types, rate thresholds).
• Account details: email address, name, and an optional profile photo when you create an account.
• Dashboard information you choose to add: your savings accounts (provider, account name, balance, rate, key dates), an estimated salary and tax region if you use the tax features, savings plans, and bank-switch progress.
• Payment sign-up: your email address when you set up a Direct Debit. Your bank details are collected and held by our payment provider, Stripe — we never see or store them.
• Questions you ask Penny, our AI savings assistant.
• Business enquiries: name, email, company, website, and your message when you request API access or join a waitlist.

Information collected automatically

• Technical data: IP address, browser type, device information, and pages visited. Our main analytics tool runs on our own servers and works without cookies; optional Google Analytics only runs if you accept cookies. See our Cookies Policy.
• Provider engagement data: if you accept analytics, we record bank and product page views, products displayed, detail interactions, internal product links, and clicks through to providers using random, rotating identifiers. We do not connect this activity to your account, email address, alert subscription, or bank information.
• Approximate location: we use your IP address to estimate your country (never your precise location) so we can show relevant content.

Information from your bank (only if you connect one)

If you choose to connect a bank account through our open banking partner, we receive the account name, institution, currency, and balance so your dashboard stays up to date. We do not receive or store your transaction history, and we never see your online banking credentials. You can disconnect at any time.

4. Where we get your information from

• Directly from you — forms, account signup, dashboard entries, emails, and questions you ask Penny.
• From your device — technical and usage data collected automatically when you browse.
• From our open banking partner — account details and balances, only after you explicitly connect a bank.
• From Stripe — payment status updates (for example, whether a Direct Debit payment succeeded).

We do not buy personal information from data brokers or collect it from public sources.

5. Why we use your information and our lawful bases

UK data protection law requires us to have a lawful basis for each use of your personal information:

We do not use your personal information for automated decision-making that has legal or similarly significant effects on you, and we never sell it.

6. Who we share information with

We share personal information only with service providers (processors) that help us run DepositScout, each under a contract that restricts what they can do with it:

• Supabase — secure hosting of our database, account login, and file storage (for example, profile photos).
• Brevo — sending our emails (alerts, news, transactional emails) and managing subscriber lists.
• Stripe — processing Direct Debit payments. Stripe holds your bank details; we only hold references to your Stripe customer record.
• Our open banking partner (LunchFlow) — securely connecting to your bank when you choose to link an account.
• Anthropic — the AI provider that powers Penny. Your questions (and a few previous messages for context) are sent to Anthropic to generate an answer; we do not include your name or contact details.
• Google — optional Google Analytics (only with your cookie consent) and YouTube video embeds.
• ipapi.co — converting your IP address into a country estimate.

We may also disclose information if required by law, to protect our legal rights, or as part of a business sale or reorganisation (in which case this policy would continue to apply).

When you click through to a bank or provider (including affiliate links), you leave our Website and their privacy policy applies. We do not pass your personal details to them.

7. International transfers

Some of our service providers (including Anthropic, Stripe, and Google) are based in, or process data in, the United States. Where personal information leaves the UK, we rely on safeguards recognised under UK law — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and, where applicable, the UK–US Data Bridge — so your information keeps an equivalent level of protection.

8. How long we keep your information

• Alert subscriptions: until you unsubscribe. Unsubscribing stops all alert emails immediately; you can ask us to delete your details entirely.
• Account and dashboard data: for as long as your account is open. When your account is deleted, your dashboard data, bank connections, and subscriptions are deleted with it.
• Payment records: kept for 6 years after the transaction, as required by UK accounting and tax rules (with the link to your deleted account removed).
• Enquiries and complaints: up to 6 years, in case of follow-up or dispute.
• Penny conversations: not stored — your question is processed to generate an answer and is not kept in our database.
• Technical logs: kept for short periods for security and troubleshooting, then deleted or anonymised.
• Provider analytics: rotating visitor links are deleted after 30 days, raw click and engagement events after 18 months, and anonymous daily totals may be kept for long-term trend analysis.

9. How we protect your information

All traffic to the Website is encrypted (HTTPS). Personal information is stored in access-controlled databases with row-level security, bank connection tokens are held server-side only, and payment details never touch our systems. Access to personal information within DepositScout is limited to people who need it to do their job.

10. Your rights

Under UK GDPR you have the right to:

• Access — get a copy of the personal information we hold about you.
• Rectification — correct inaccurate or incomplete information.
• Erasure — ask us to delete your information ("right to be forgotten").
• Restriction — ask us to limit how we use your information.
• Portability — receive your information in a machine-readable format.
• Objection — object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent — where we rely on consent (emails, cookies, bank connections), withdraw it at any time without affecting earlier processing.

To exercise any of these rights, email [email protected]. We respond within one month. You can also unsubscribe from emails using the link in any email or at depositscout.com/unsubscribe.

11. Cookies

We keep cookies to a minimum: essential cookies for login and security, and optional analytics cookies that only run if you accept them. Full details, including every cookie we set and how to change your choice, are in our Cookies Policy.

12. DepositScout Chrome Extension

We do not collect, store, or transmit any personal data, browsing history, or user information through our Chrome extension.

What the extension does:

• Reads public text on UK bank savings pages to detect interest rates (e.g. "4.50% AER").
• Compares detected rates against public market benchmarks (fetched from depositscout.com).
• Shows local analysis ("This beats market leaders") without sending page content or URLs anywhere.

Permissions used:

• storage: Save your banner preferences and 24-hour dismissals locally on your device.
• activeTab: Scan only the page you're currently viewing.
• Bank domains: Inject analysis only on listed UK bank sites.

No tracking, no servers, no third parties.

13. Changes to this policy

We may update this policy as our services or the law change. We will post the updated version here with a new effective date, and for significant changes we will tell subscribers by email.

14. Contact us and how to complain

Questions or concerns about this policy or your personal information? Email [email protected] or write to DepositScout Ltd, 124 City Road, London EC1V 2NX, United Kingdom.

If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first.