Privacy Policy

1. Introduction

Treapy Ltd ("Treapy", "we", "us", "our") is committed to protecting your personal data. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Please read this policy carefully before using Treapy. By creating an account, you confirm that you have read and understood how we process your personal data.

2. Who We Are

Treapy Ltd is the data controller responsible for your personal data.

3. What Personal Data We Collect

3.1 Account and Identity Data

• Full name
• Email address
• Account preferences and settings

3.2 Financial Data

• Read-only account balances, holdings, and transaction records from a connection explicitly approved for your account and region

3.3 Device and Technical Data

• Device identifiers
• Push notification tokens
• IP address
• App version, operating system, and device type
• Crash reports and anonymised error logs

3.4 Usage Data

• App usage patterns and feature interactions
• Session data

3.5 Communications Data

• Messages you send to our support team
• Content you explicitly type in the Tripp AI chat interface

Website cookies, browser storage and privacy choices

Treapy remembers a referral code to attribute your waitlist signup, using Supabase as its backend provider. The code is sent only when you submit the signup form. This optional attribution uses your consent.

The public website uses first-party localStorage, rather than an analytics cookie. The necessary treapy_privacy_preference entry records only your accept/reject choice, disclosure version and time. The choice expires after 180 days; expired or invalid records are removed when you next use the site. We ask again after expiry or a change to the disclosed purposes or providers. Clearing browser storage also clears your choice. If storage is blocked, the choice lasts only for the current page.

The optional treapy_referral_code entry is neither read nor written before acceptance. It remembers the referral link code and is sent to Treapy via Supabase only when you submit the waitlist form. It is removed when you reject, withdraw, or next use the site after consent expires or becomes outdated. Browser storage is not shared across devices.

Use Privacy choices on every website page to accept, reject or withdraw by choosing Reject optional analytics. Both choices leave signup, authentication and other core features available. We do not prompt again during a valid rejection. Withdrawal stops future attribution and clears the optional browser entry; it does not recall a signup already submitted. Contact support@treapy.co about data already sent.

Necessary authentication and security storage remain separate. Privacy-restricted Sentry error/crash reporting remains available to diagnose failures. Website reports contain a generic error category and build stack locations, excluding user identity, request bodies, headers, cookies, query parameters and free-text error messages. Network providers necessarily receive connection metadata such as an IP address to deliver requests; we do not attach it as a Sentry user identity.

Website Sentry performance tracing, session analytics, Replay, profiling and screenshots are disabled even after acceptance. Acceptance covers only the referral purpose above, not future analytics providers. These browser choices apply to the public website; the native app does not display a web cookie banner.

4. Legal Bases for Processing (UK GDPR)

We process your personal data on the following legal bases under UK GDPR Article 6:

5. How We Use Your Data

We use the personal data we collect to:

• Create and manage your account
• Display read-only portfolio context from an approved connection
• Provide read-only explanations of approved plan and review facts
• Detect and prevent fraud or unauthorised access to your account
• Diagnose and fix technical problems in the app
• Respond to your support requests
• Comply with our legal and regulatory obligations

6. Third-Party Data Processors

The processors and service providers below receive only the data needed for the selected feature. Availability is limited to reviewed providers and regions. We do not sell personal data.

7. Connection Security

A read-only connection is offered only when its configuration is approved for your account and region. The consent screen identifies the processor and data involved before you connect.

• Connection credentials are encrypted at rest
• Credentials are not written to application or error logs
• Access is limited to the read-only scope you authorise
• Unsupported or stale configurations remain unavailable

8. Data Retention

Account deletion is not described as instantaneous or universal. A minimal non-identifying completion record may be retained, and restricted backups, provider copies, support records, fraud evidence, or legal-hold records follow the applicable disclosed retention schedule.

9. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

To exercise any of these rights, email us at support@treapy.co. We will respond within one calendar month. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

10. Children

Treapy is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact support@treapy.co and we will delete it promptly.

11. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include:

• Encryption in transit using TLS 1.2 and above for all data
• AES-256 encryption at rest for sensitive credentials (exchange API keys)
• Role-based access controls limiting internal access to personal data
• Regular security reviews
• Supabase Row-Level Security enforcing that users can only access their own data

No method of data transmission or storage is 100% secure. If you have reason to believe your Treapy account has been compromised, contact support@treapy.co immediately.

12. No Advertising or Data Sales

Treapy does not sell personal data and does not operate an advertising-funded service. As a result:

• We do not sell your personal data to any third party, ever
• We do not use your data for advertising or marketing profiling
• We do not use advertising networks, tracking pixels, retargeting scripts, or ad exchanges
• We do not share your data with data brokers
• We do not use behavioural analytics platforms beyond what is described in Section 6

13. AI (Tripp) and Anthropic

The Tripp AI assistant is powered by Anthropic's Claude API. When you interact with Tripp, the following applies:

• Your portfolio context (composition, asset classes, general metrics) may be sent to Anthropic's API to generate contextually relevant responses
• The text of messages you type in the Tripp chat interface is sent to Anthropic
• We do not include your name, email address, or linked account identifiers in prompts sent to Anthropic unless you type them yourself
• Provider retention and training treatment follows the reviewed contract and configuration for the active release
• Tripp does not have access to your linked account credentials, encryption keys, or your full transaction history

14. International Data Transfers

Treapy records the active hosting region and every international data flow in its release processing inventory. Some providers operate infrastructure outside the United Kingdom.

A provider or region is not enabled until the applicable transfer mechanism and contractual safeguards have been reviewed and recorded. Contact support for the current mechanism applicable to a particular provider or request a copy of the relevant information.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements. If we make material changes, we will notify you by email at least 30 days before the changes take effect, and we will update the "Last updated" date at the top of this page.

This notice explains our processing; continued use does not grant consent to optional website analytics. New optional purposes or providers require an updated disclosure and a new choice before collection starts. You can withdraw optional consent using Privacy choices without closing your account.

16. Contact Us

For any questions about this Privacy Policy, or to exercise your data subject rights, please contact us:

You also have the right to contact the Information Commissioner's Office directly if you have a complaint about how we handle your personal data: ico.org.uk or 0303 123 1113.