Privacy Notice
Last updated: June 2026
Your Future Compass is committed to protecting your personal information and being transparent about how we use it. This notice explains what data we collect, why, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).
1. Who we are
Your Future Compass Ltd, trading as Your Future Compass, is the data controller for the personal information you provide when using this service.
| Trading name | Your Future Compass |
| Controller | Your Future Compass Ltd |
| Company registration number | 17276217 (registered in England and Wales) |
| Registered office | 71-75 Shelton Street, Covent Garden, London WC2H 9JQ |
| privacy@yourfuturecompass.co.uk | |
| ICO registration | ZC178073 |
2. What personal data we collect
| Data | Why we need it |
|---|---|
| Email address | Account creation, authentication, and account management communications |
| Password (hashed) | Secure authentication, stored as a one-way hash, never in plain text |
| First name, last name | Personalising plan output and reports |
| Date of birth | Calculating retirement ages, State Pension eligibility, and plan projections |
| Financial planning inputs | Pension pot values, ISA balances, defined benefit details, State Pension amounts, spending targets, property values, entered voluntarily to generate your projections |
| Usage & analytics data | Which features you open and key milestones (sign-up, first plan built, purchase), tied only to your account ID. Never financial figures, names, email or date of birth |
| Email address & marketing preference (free calculator) | If you ask us to email you your calculator result, we use your address to send it, and, only if you tick the separate box, to send occasional updates you can unsubscribe from anytime |
| “Finish on a computer” handoff | If you ask us to email a link so you can carry on from a phone to a laptop, we briefly hold the numbers you entered (pot, spending, ages) with your email so your plan opens ready-filled on the bigger screen. We delete them as soon as your computer picks them up, and in any case within 72 hours |
We do not collect bank account numbers, National Insurance numbers, payment card details, biometric data, or any real-time financial account data. All financial figures are entered manually by you.
3. How we collect your data
- Directly from you: when you create an account and enter information into the planning tool.
- Automatically: basic technical logs (IP address, browser type) generated by our hosting provider.
- Product analytics: anonymous-by-design usage events sent to our analytics provider (section 5). Cookieless, honours "Do Not Track", carries no financial figures or contact details.
- When you ask us to email your result: on the free calculator, you can send your result to your own inbox; we use the email address you enter to do that, and to send occasional updates only if you separately opt in.
4. How we use your data and our lawful basis
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing the service, running projections, storing your saved plans | Performance of a contract (Art. 6(1)(b)) |
| Account security, fraud prevention, audit logs | Legitimate interests (Art. 6(1)(f)) |
| Understanding how the service is used (privacy-first product analytics) to improve it | Legitimate interests (Art. 6(1)(f)): cookieless, no financial or contact data |
| Service-related communications (e.g. password resets, and renewal / licence-expiry reminders) | Performance of a contract (Art. 6(1)(b)) |
| Emailing you your own calculator result, when you ask us to | Legitimate interests (Art. 6(1)(f)): fulfilling your request; your own data, sent to your own address |
| Carrying the numbers you entered on your phone over to your computer session, when you ask us to (“finish on a computer”) | Legitimate interests (Art. 6(1)(f)) and steps taken at your request prior to a contract (Art. 6(1)(b)): your own figures, held briefly to deliver the continuity you asked for; deleted on use, at most 72 hours |
| Sending occasional tips and product updates to subscribers who opted in | Consent (Art. 6(1)(a)): a separate, unticked box; withdraw anytime |
| Complying with legal obligations | Legal obligation (Art. 6(1)(c)) |
We do not use your data for marketing without your separate, explicit consent. We do not sell your data to third parties. Ever.
5. Where your data is processed
All retirement projections are calculated within your browser: the number-crunching never leaves your device. The inputs you enter are saved to your private account with our database provider so you can return to them. You can export or delete this data at any time.
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Supabase | Database, authentication, Row Level Security | AWS eu-central-1 (Frankfurt) | DPA in place; SOC 2 Type II; encrypted at rest (AES-256) and in transit (TLS 1.2+) |
| Vercel | Hosting (static files only) | Global CDN edge; no user personal data stored | DPA in place; SOC 2 Type II |
| PostHog | Privacy-first product analytics (cookieless; no session recording; honours DNT) | EU Cloud. Frankfurt (AWS eu-central-1) | DPA in place; encrypted in transit and at rest; no advertising or cross-site tracking; no financial figures, names or contact details |
| Resend | Email delivery: account verification, password resets and service notices; the calculator result you ask us to email you; and occasional updates to subscribers who opted in | EU region: Ireland (AWS eu-west-1) | DPA in place; SOC 2 Type II; encrypted in transit and at rest |
| Stripe | Taking payment for a licence. You are taken to Stripe's own secure checkout page to pay; we never see or hold your card details. Stripe receives your email address and the payment details you give it, and tells us only that the payment succeeded and which licence it was for. Stripe also uses this data as its own controller to prevent fraud and meet its legal obligations | USA, with UK/EU processing for European customers | DPA in place; PCI DSS Level 1; UK International Data Transfer Addendum / EU Standard Contractual Clauses for transfers |
| Sentry | Crash reporting. If something in the app breaks unexpectedly, Sentry tells us what the error was and where in the code it happened, so we find out without waiting for someone to report it. It receives the error message, the technical stack trace, your browser and operating-system version, and the page you were on. It does not receive your name, email, account, IP address or any of your financial figures, and it does not record your screen | EU region (Germany) | DPA in place; error reports are stripped of identifying information before they are sent, and IP addresses are not stored |
Your account and plan data are stored in the EEA (Frankfurt), which the UK recognises as providing adequate protection. Where personal data is transferred outside the UK or EEA (for example, via Vercel's global edge infrastructure), transfers are made under the UK International Data Transfer Agreement (IDTA) or equivalent approved safeguards.
6. How long we keep your data
| Account information (email, name, DOB) | While your account is active, plus 30 days after deletion for recovery |
| Saved plans and financial inputs | While your account is active; deleted on account deletion or on request |
| Authentication logs | 90 days (rolling), for security |
| Technical server logs | 30 days, as managed by our hosting providers |
| Marketing subscription (email + consent record) | Until you unsubscribe or withdraw consent; a minimal record of consent is then kept as proof (up to 24 months) |
| “Finish on a computer” handoff figures | Deleted as soon as your computer picks them up; in any case within 72 hours |
| Email send rate-limit log (salted hashes of email/IP, not the raw values) | 2 days (rolling), abuse prevention only |
| Crash reports (error message and technical stack trace; nothing identifying you) | 30 days |
7. Data security
- Encryption at rest (AES-256) and in transit (TLS 1.2+, HTTPS only).
- Access controls: Row Level Security is enforced at the database level. One user's data cannot be accessed by another's account, even in the event of an application bug.
- Passwords hashed with bcrypt. We cannot see your password, only verify it.
- Two-factor authentication available via Security settings.
8. Your rights
Under UK GDPR you have the rights of access, rectification, erasure, data portability, restriction, and to object. To exercise any of them, contact privacy@yourfuturecompass.co.uk. We will respond within one calendar month and may need to verify your identity first.
9. Cookies
We use no cookies at all. Your login session and interface preferences are stored in your browser's own local storage (which is not a cookie and is never sent to us or any third party), and our product analytics (PostHog) are cookieless: so there is no cookie banner, and nothing tracks you across other websites. We use no advertising, analytics or tracking cookies of any kind, and PostHog honours "Do Not Track". This stays true when you buy a licence: paying takes you to Stripe's own checkout page, so any cookies Stripe needs to take a payment securely and prevent fraud are set on Stripe's website rather than ours, and are governed by Stripe's privacy policy. Such cookies are in any case strictly necessary and exempt from consent. If we ever introduce non-essential cookies, we will update this notice and ask for your consent first.
10. Complaints
If you are unhappy with how we have handled your data, contact us first at privacy@yourfuturecompass.co.uk. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/concerns · 0303 123 1113 · Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
11. Changes to this notice
We may update this notice from time to time and will notify you of material changes by email or in-app at least 14 days beforehand. The "Last updated" date above reflects the most recent version.
Important: Your Future Compass provides illustrative projections and is not regulated by the Financial Conduct Authority (FCA). The tool does not constitute financial advice. Always consult a qualified financial adviser before making investment or pension decisions.