Privacy Notice

This notice explains how The Financial Playbook (“we”, “us”) handles personal data in the CreditTrack application. For the data you enter into CreditTrack, we act as the data controller. Paddle.com acts as the Merchant of Record for purchases and is the controller for payment data it collects at checkout.

Consent and lawful basis

By creating an account or continuing to use CreditTrack, you acknowledge this Privacy Notice and agree to our Terms & Conditions. We only collect, process, and store personal data where we have a lawful basis to do so:

• Performance of our contract with you — account data, the credit tracking data you enter, your preferences, connected financial account data, and membership status are necessary to provide the Service.
• Legitimate interests — technical and usage data, and support messages, are used to keep the Service secure and to respond to you.
• Legal obligation — billing and tax records are kept as required by law.
• Consent — where we rely on consent for any optional processing (for example, optional marketing communications if offered), you may withdraw it at any time by emailing info@credittrack.co. Withdrawing consent does not affect processing that is required to provide the Service or comply with legal obligations.

If you choose to connect a bank or card account through our connection provider, you consent to the collection of the account identifiers, balances, and metadata needed to keep your CreditTrack records up to date. You can unlink the connection at any time from Settings.

What we collect and why

• Account data — email address, password hash, display name, and sign-in provider. Used to create and secure your account (performance of our contract with you).
• Credit tracking data you enter — card nicknames, issuer names, optional last four digits, credit limits, balances, statement/reporting/due days, minimum payments, APR, planned payments, and reminder dates. Used to calculate utilization and produce your plans and reminders (performance of our contract).
• Connected financial accounts — if you optionally link a bank or card account, our connection provider may collect account identifiers, balances, account metadata, and liability or payment information. Used to update your CreditTrack records automatically (performance of our contract; your explicit authorisation through the link flow).
• Preferences — paycheck amount and next payday, target utilization, alert settings, lesson progress, and habit events. Used to personalize the app (performance of our contract).
• Technical and usage data — IP address, device and browser information, and error logs. Used for security, fraud prevention, and diagnosing faults (legitimate interests).
• Support messages — the content you send us. Used to answer you (legitimate interests).
• Membership status — plan, status, and billing period returned by our payment provider. Used to grant access and manage renewals (contract and legal obligation).

We never ask for and do not store full card numbers, CVV codes, or bank credentials. Card payment details are collected and processed by Paddle, not by us.

Who we share data with

• Service providers / subprocessors — cloud hosting and database providers, authentication providers, and error monitoring tooling that process data on our instructions.
• Merchant of Record — Paddle.com, for the sale of memberships, subscription management, payments, tax compliance, and invoicing.
• Professional advisers — legal and accounting advisers where necessary.
• Authorities — where required by law or to protect our rights.

We do not sell your personal data.

International transfers

Our providers may process data outside your country, including outside the UK/EEA. Where that happens we rely on appropriate safeguards such as Standard Contractual Clauses or an adequacy decision.

Data retention, deletion, and review

We keep your account and credit tracking data for as long as your account is active. If you delete your data or your account, we process the deletion request and remove or anonymise the data within 30 days, except for records we must retain to meet legal, tax, or fraud-prevention obligations. Technical logs are kept for a short period and then deleted. Encrypted backups are retained on a rolling schedule and age out automatically.

You can delete your CreditTrack data at any time from Settings, or by emailing info@credittrack.co. Deletion of your own records is always allowed, even if a membership has lapsed.

This retention and deletion policy is reviewed at least annually and whenever we make a material change to how we process personal data. The last review date is shown at the top of this notice.

Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or port your data, to object to processing based on legitimate interests, and to withdraw consent. If you are in the UK or EEA you also have the right to complain to your supervisory authority, and we aim to respond to requests within one month. You can delete your CreditTrack data at any time from Settings, or email info@credittrack.co.

Security

We use appropriate technical and organisational measures, including encryption in transit, encrypted storage, row-level access controls so each account can only reach its own records, and least-privilege access for our systems.

Cookies and similar technologies

We use essential cookies and local storage to keep you signed in and to remember your theme preference. Our payment provider sets cookies necessary to operate checkout. We do not use advertising cookies. You can clear or block cookies in your browser, though sign-in will not work without the essential ones.

Contact

Privacy questions: info@credittrack.co. See also our Terms & Conditions and Refund Policy.