Plain English first.
Legal language second.

1 - What this policy covers

This policy explains how MBKR Limited (we / us), trading as Sonuswealth, collects, uses, shares, retains, and protects personal data, in compliance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

It applies to data we hold about: visitors to the Sonuswealth website; people who join the waitlist; users of the Sonuswealth product once live; professional and employer customers; and people who contact us via email or social media.

2 - What personal data we hold

Information you give us directly

• Account data: your email address, name, password (hashed), preferences.
• Financial data you upload: account balances, transactions, asset positions, pension statements, ISA / SIPP / GIA records, mortgage detail, life-cover policies, Indian financial assets (for NRI users), business interests, property valuations.
• Demographic data you choose to share: age, marital status, dependents, household structure, jurisdiction - only so the engine can apply the right rules to you.
• Profession verification: for NHS / public-sector / IFA pricing, your work email address for one-time domain verification.
• Communications: support emails, feedback, journal-comment replies.

Information we collect automatically

• Technical data: IP address (last octet only after 30 days), browser type, referring URL, pages visited, time on page.
• Cookies (see Section 9).
• Crash and error reports (no payload data).

What we do NOT collect

• Bank login credentials. Phase 1 has no live bank connection - only your uploads. Phase 2 Open Banking will use an FCA-authorised AISP that uses the bank's own consent flow; we never see your password.
• Card details (no payment data - we use Stripe; Stripe holds the card).
• Browsing data outside Sonuswealth.
• Location data beyond country-level.

3 - Why we hold each piece of data (lawful basis)

Under UK GDPR we must identify a lawful basis for every category of processing. Ours are:

• Contract (Article 6(1)(b)): to provide the Sonuswealth service you signed up for. Covers all account data, financial data, modelling outputs.
• Legitimate interest (Article 6(1)(f)): security (rate-limits, anomaly detection); product analytics in aggregate; founder updates to existing users on product changes. You can object at any time.
• Consent (Article 6(1)(a)): marketing emails (unsubscribe in one click); non-essential cookies (opt-in via banner).
• Legal obligation (Article 6(1)(c)): tax records, anti-fraud, court orders.

4 - Who we share data with

Sub-processors (essential to running the service)

• Supabase: your account, your financial records and any documents you upload. Hosted on Amazon Web Services, in the region named at the top of section 5.
• Render: serves the application's files from a content-delivery network. Your financial data never passes through it - your browser talks to Supabase directly. Render sees the request for the page and the technical data that comes with it, such as your IP address.
• Anthropic: AI processing for Ask Sonu. What you type, and a structured summary of your position, is sent to Claude to produce the answer. Anthropic does not train on it. This is the one processor outside the UK and EU - see section 5.
• Stripe: payment processing. They hold your card; we never do.
• Resend: email delivery - sign-in links, verification and service notices. Email address and name only.
• HubSpot: enquiries and the waitlist. The name and email you give us when you get in touch. Nothing from your financial records reaches HubSpot.
• Sentry: error monitoring. Technical error reports; no message content.
• PostHog: product analytics. Anonymous events, no pound amounts. Hosted on PostHog's EU cloud.
• Phase 2: FCA-authorised AISP partner (TrueLayer, Yapily, or Plaid UK - to be confirmed). Only activated if you opt in to Open Banking live-connect.
• OCR vendor for statement-scan path. Document images processed via API; we delete the source image within 24 hours after extraction.

Things we do NOT share

• We do not sell, rent, or barter your data.
• We do not share your data with advertisers, data brokers, credit bureaux, or political parties.
• No AI training, no AI retention. Where we use a third-party AI provider for Sonu / Ask, we will operate under a contractual zero-training and zero-retention agreement — your data is used only to compute the answer to your specific query, is never used to train any model, and is not retained by the provider beyond that single inference. We will name the selected provider on this page before launch. If we move to self-hosted inference at any point, we will update this section.
• We do not share your data with your employer, even if your employer is a Sonuswealth B2B Employer customer (the consumer subscription you take out is yours alone).

Disclosure under legal obligation

We will disclose data only if compelled by a UK court order, valid request from HMRC, the police, or another competent authority. We will notify you of the request where lawful to do so. We will resist over-broad requests through proper legal channels.

5 - International data transfers

Where your data is held today: Ireland (AWS eu-west-1).

Your account, your financial records and your documents are held by Supabase, on Amazon Web Services, in the region named on the line above. That region is inside the European Economic Area, and moves to London (AWS eu-west-2) before general availability; the line above is updated on the day it moves, and is checked against the running service on every release. The application's own files are served from a content-delivery network with no fixed location, but they are only files - no financial data passes through it. Three things do leave that region: Ask Sonu sends what you type, and a summary of your position, to Anthropic in the United States; product analytics go to PostHog in the EU; and email may transit EU or US infrastructure for delivery. Each is covered by the UK International Data Transfer Agreement, or by Standard Contractual Clauses with the UK Addendum. Ask Sonu is optional - the rest of the service works without it.

For NRI users who upload Indian financial data: this data is held in the region named in section 5, not in India. India is currently not an "adequate" jurisdiction under UK GDPR for personal-data export, so we don't export there. Phase 2 changes to this will be flagged at least 90 days in advance.

6 - How long we keep data

• If you delete your account: everything goes immediately - your profile, every figure you have recorded, every document you uploaded, and your sign-in. There is no restore window and no way for us to bring it back. Deleted data can persist in the encrypted backups below until those roll off.
• Active account data: as long as your account is in use.
• Financial uploads: as above. We do not retain copies after you've deleted them from your account.
• Backups: encrypted, retained 30 days, then cryptographically destroyed.
• Email correspondence: 3 years (legitimate-interest basis for service continuity).
• Marketing-list emails: until you unsubscribe, plus 30 days for suppression-list integrity.
• Financial transaction records (Stripe): 7 years (UK HMRC tax-record requirements).

7 - Your rights under UK GDPR

You have the following rights, exercisable at any time by emailing privacy@sonuswealth.com:

• Right of access: ask for a copy of all your personal data we hold. We respond within 30 days, usually within 5.
• Right to rectification: correct anything wrong.
• Right to erasure ("right to be forgotten"): delete your data. Available in-app under Settings - Data & documents. Deletion happens when you confirm it, not on a schedule: your profile, every figure you have recorded, every document you have uploaded and your sign-in are removed there and then, and there is no restore window. Encrypted backups can still hold a copy until they roll off, within 30 days.
• Right to restriction: ask us to pause processing of your data while you raise a concern.
• Right to data portability: export your data in a machine-readable format (JSON + CSV). Available in-app under Settings - Data & documents.
• Right to object: object to legitimate-interest processing (e.g. analytics).
• Right to withdraw consent: for anything we do under consent basis.
• Right to complain: to the UK Information Commissioner's Office (ICO) at ico.org.uk/concerns.

8 - Security

• All data encrypted at rest (AES-256).
• All data encrypted in transit (TLS 1.3).
• Per-user keys for highly sensitive fields.
• Your records and documents are held in Ireland (AWS eu-west-1, via Supabase), moving to London before general availability - see section 5.
• Multi-factor authentication on all employee accounts.
• Quarterly external penetration testing (planned from 2026 H2).
• ISO 27001 audit target: 2026 H2.
• Incident response: any data breach affecting your personal data will be reported to the ICO within 72 hours of discovery and to you without undue delay.

9 - Cookies

We use a minimal set of cookies. The site shows a cookie banner on first visit; you can change your preference at any time via the cookie settings link in the footer.

• Strictly necessary: session, CSRF protection, theme preference. No opt-out (the site doesn't work without them).
• Analytics (consent): Posthog (self-hosted in UK). Opt-in only.
• Marketing (consent): we don't currently use any. If we add any, we'll list them here and update the banner.

10 - Children

Sonuswealth is not directed at, and we do not knowingly collect data from, children under 18. UK financial planning is an adult activity; the product is designed for adult households. If we discover a sub-18 account, we close it and delete the data.

11 - Changes to this policy

We update this policy when our practices change. Material changes (anything that affects what data we collect, how we use it, or who we share it with) will be emailed to all active users at least 30 days in advance. The full version history is available on request.

12 - Contact

Questions, concerns, or data-rights requests: privacy@sonuswealth.com. Founder direct: mihir@sonuswealth.com.

UK postal: MBKR Limited, 32 Oakfield Avenue, Birstall, Leicester LE4 3DQ.