Privacy Policy

Effective date: 27 April 2026

allocatewise.com, allocatewise.co.uk, and the web app at app.allocatewise.com (together, the "Service") are operated by Allocatewise Ltd, a company registered in England and Wales (company number 16870388) whose registered office is at 124 City Road, London EC1V 2NX ("we", "us", "our"). We are the data controller for personal data processed through the Service. Contact us at info@allocatewise.com.

1. Scope and Purpose

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We do not meet the criteria under Article 37 UK GDPR for mandatory appointment of a Data Protection Officer, but you may direct any data-protection enquiry to info@allocatewise.com.

2. Data We Collect

We collect only the minimum data needed to provide the Service:

• Account data – first name, last name, email address, hashed password (managed by Firebase Authentication)
• Investment profile data – age, retirement age, income, savings rate, asset holdings, property details, and financial goals that you enter into the app
• Usage data – date of registration, date of last login, record of terms/privacy acceptance
• Saved results – portfolio optimisation outputs you choose to save
• Support data – messages you send via the in-app feedback form

We do not collect government identifiers, payment card numbers, sensitive categories of data (Article 9 UK GDPR), or data about children (our Service is for users aged 18 and over only).

3. Legal Basis for Processing

We rely on the following lawful bases under Article 6 UK GDPR:

• Contract performance (Art. 6(1)(b)) – to provide the Service you have requested, including creating your account, running portfolio simulations, and storing your profiles.
• Legitimate interests (Art. 6(1)(f)) – to maintain security of the Service, investigate misuse, improve our platform, and communicate service-related updates. We have balanced these interests against your rights and concluded they are not overridden.
• Legal obligation (Art. 6(1)(c)) – where processing is required to comply with applicable law.

4. Automated Decision-Making and Portfolio Generation (Article 22 UK GDPR)

The Service uses automated algorithms – including statistical simulation (Monte Carlo / Hidden Markov Models) and numerical optimisation – to generate portfolios and goal success rate estimates. These outputs are produced entirely by software without human review of individual cases.

What the automation does: it processes the investment profile data you supply (age, income, assets, goals) against historical market data to estimate how different portfolio allocations may perform over your chosen time horizon.

Significance and consequences: the outputs are presented as illustrative projections only. They do not constitute regulated financial advice and should not be the sole basis for any investment decision. You remain entirely free to disregard, modify, or seek independent advice on any recommendation produced.

Your rights: under Article 22 UK GDPR you have the right to request human review of any automated output that you believe has significantly affected you, to contest such outputs, and to express your point of view. To exercise this right, contact us at info@allocatewise.com.

5. Data Processors and Third-Party Recipients

We use the following third-party processors who act on our instructions under data processing agreements:

Your data is never sold to or shared with any other third party, except where required by law or legal proceedings.

6. International Transfers

Some of our processors (notably Google Firebase Authentication and OpenAI) may process data outside the UK or EEA. Where this occurs, we rely on one or more of the following transfer mechanisms: (a) the UK Secretary of State's adequacy regulations; (b) Standard Contractual Clauses approved under UK GDPR; or (c) the UK–US Data Bridge (where applicable). You may request a copy of the relevant safeguards by contacting us at info@allocatewise.com.

7. Data Retention

We retain personal data for the following periods:

• Account and profile data – for the life of your account, plus 30 days after deletion to allow recovery from accidental deletion. Accounts inactive for more than 3 years may be deleted after prior email notice.
• Saved results and investment profiles – until you delete them or your account is closed.
• Admin audit logs – 12 months.
• Support and feedback submissions – 24 months.

You may request deletion of your data at any time via the "Delete Account" option in Account Settings or by emailing info@allocatewise.com.

8. Security

We implement appropriate technical and organisational measures to protect your data, including TLS encryption in transit, server-side encryption at rest (Google Cloud), token-based authentication with revocable sessions, strict Firestore security rules that prevent cross-user data access, and HTTP security headers (HSTS, CSP, X-Frame-Options).

While we take all reasonable precautions, no internet transmission is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with UK GDPR Article 33–34.

9. Your Rights

Under UK GDPR you have the following rights. To exercise any of them, email info@allocatewise.com. We will respond within one month.

• Right to be informed – this Policy fulfils that obligation.
• Right of access – obtain a copy of your personal data.
• Right of rectification – correct inaccurate data; you can update most data directly in Account Settings.
• Right to erasure – request deletion of your data. You can delete your account and all associated data directly from Account Settings.
• Right to restrict processing – ask us to pause processing while a dispute is resolved.
• Right to data portability – receive your data in a structured, machine-readable format.
• Right to object – object to processing based on legitimate interests.
• Rights related to automated decision-making – see Section 4 above.

10. Children

The Service is for users aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a minor has registered, please contact us immediately and we will delete the account.

11. Cookie Policy

We use the following types of browser storage:

• Essential local storage – Firebase Authentication stores your encrypted session token in browser local storage to keep you signed in across page loads. Without this you cannot use the Service.
• Preference storage – we store your cookie consent acknowledgement and UI preferences (e.g. theme) in local storage.

We do not use advertising, tracking, or third-party analytics cookies. You may clear local storage at any time via your browser settings, but doing so will sign you out.

12. Modifications

We may update this Policy to reflect changes in law or our practices. We will update the effective date at the top of the page. For material changes we will notify registered users by email at least 14 days before they take effect.

13. Complaints

If you have a concern about how we handle your data, please contact us first at info@allocatewise.com. If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office: ico.org.uk/make-a-complaint.

14. Contact

Allocatewise Ltd, 124 City Road, London EC1V 2NX
Email: info@allocatewise.com