Privacy Policy

Trackr Finance ("Trackr", "we", "us", "our") is a wholly owned subsidiary of Trackr Group. We provide a personal finance app that helps you record and understand your spending by scanning receipts and by letting you enter transactions manually.

Our registered office is 4th Floor, Silverstream House, Fitzroy Street, London, W1T 6EB, United Kingdom.

Trackr does not use Open Banking and does not connect to your bank accounts. You choose what to add, either by photographing a receipt or by typing a transaction in.

We are the controller of the personal data described in this policy. We are registered with the UK Information Commissioner's Office (ICO) under reference ZC112192.

For any privacy matter, contact us at support@trackr-finance.com.

• Account data: your name, email address, and account credentials. Passwords are securely hashed and are never stored in a form we can read.
• Financial data you provide: transactions, amounts, dates, merchants, categories, notes, budgets, and subscription details that you enter or confirm.
• Receipt images: photographs or files of receipts that you choose to upload. Our AI reads these to suggest transaction details, and you must confirm those details before anything is saved.
• Subscription and billing data: your plan (Free, Core, or Plus), billing status, and payment records. Card payments are handled by Stripe. We do not store your full card number.
• Usage and technical data: app interactions, feature usage, log data, device and browser information, and IP address.
• Communications: messages you send to our support team.

Receipts and special category data. A receipt may incidentally reveal information that UK GDPR treats as special category data. For example, a receipt from a pharmacy, a place of worship, or a health clinic can hint at health, religion, or lifestyle.

We do not use this content to profile you. Trackr does not analyse receipts to infer your health, religious beliefs, political views, sexual orientation, or lifestyle, and Atlas AI is not designed to draw those inferences either. Our AI reads a receipt only to extract fields such as merchant name, amount, date, and category, and we treat the receipt image as ordinary financial record-keeping data on your instructions.

A "lawful basis" is the legal reason we are allowed to use your data under UK GDPR. For each activity below we set out the purpose, the data involved, our lawful basis, and how long we keep it.

• Running your account and the core tracking features — account, financial, and receipt data. Lawful basis: performance of our contract with you (Article 6(1)(b) UK GDPR). Kept while your account is active.
• Reading your uploaded receipts and suggesting transaction details — receipt images and extracted fields. Lawful basis: performance of our contract. Extracted fields are kept with the confirmed transaction; the receipt image is kept while the transaction exists or until you delete it.
• Producing Atlas AI observations and answering your questions on eligible plans — financial data and, in Online or Dynamic mode, the text of your question. Lawful basis: performance of our contract.
• Processing payments and managing subscriptions — billing data. Lawful basis: performance of our contract, and legal obligation (Article 6(1)(c)) for tax and accounting records. Billing records are kept for six years, in line with UK tax law.
• Keeping the service secure, preventing fraud and abuse, and maintaining and improving Trackr — account, usage, and technical data. Lawful basis: our legitimate interests in running a safe and reliable service (Article 6(1)(f)). We have carried out the balancing test the ICO expects; you can ask us for a summary.
• Sending service and transactional emails (for example, verification, security alerts, billing) — account and billing data. Lawful basis: performance of our contract.
• Sending optional product updates or marketing — email address. Lawful basis: your consent (Article 6(1)(a)). You can withdraw consent at any time from your account settings or by using the unsubscribe link.
• Meeting legal obligations and responding to lawful requests — whatever data is strictly required. Lawful basis: legal obligation.

We do not rely on the new "recognised legitimate interests" categories in Schedule 4 of the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025). None of them fits Trackr's processing.

Trackr uses artificial intelligence in two ways. First, to read receipts you upload and suggest the fields for a transaction. Second, to power Atlas AI, our observation feature that surfaces patterns in your spending and answers questions on eligible plans.

Atlas AI has three modes. Dynamic is the default and decides, for each message, whether to answer using your Trackr data or using general public knowledge. Local answers only from your Trackr data and sends no account data to any external AI model. Online answers only from general public knowledge and does not send your account data to the AI.

Atlas AI is an observation tool. It is not a financial adviser, and nothing it produces is a personal recommendation or financial, investment, tax, debt, or legal advice.

Automated decision-making. Trackr does not make decisions about you by solely automated means that produce legal effects or that similarly significantly affect you. Atlas AI only surfaces observations for you to read. It does not approve or deny anything, does not restrict, cancel, price, or downgrade any part of your account, does not report you to any third party, and does not act on your data without you. Receipt scanning only ever suggests fields; nothing is saved until you review and confirm it. Because of this, Articles 22A to 22D UK GDPR (which govern significant automated decisions) do not apply to how Atlas AI or the receipt scanner work.

We do not sell your personal data. We use a small number of service providers ("processors") to run Trackr. Each is bound by a written data processing agreement and may only use your data on our instructions.

• Supabase — database, authentication, and backend functions. Data is hosted in AWS eu-west-1 (Ireland).
• Google — large language model processing for receipt extraction and Atlas AI. The specific model version may change over time.
• Lovable — application hosting, and routing of AI requests where still applicable. [FLAG: remove the AI-routing line once the direct-Gemini migration is complete.]
• Cloudflare — DNS, content delivery, and security protection.
• Stripe — payment processing for Core and Plus plans.
• Resend — delivery of transactional emails such as verification codes and billing receipts.

We may also disclose data where we are required to by law, to enforce our Terms of Service, or in connection with a business reorganisation, sale, or transfer of assets within the Trackr Group or to a buyer of the business.

Some of our providers process data outside the United Kingdom. Where they do, we make sure the transfer is protected by an appropriate transfer mechanism recognised under UK GDPR. Depending on the provider and the country, this may be UK adequacy regulations (such as those covering the European Economic Area), the UK–US Data Bridge, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

We keep the mechanism in place for each provider under review, because the status of adequacy decisions and certification schemes can change.

We keep your personal data for as long as your account is active. If you close your account, we delete or anonymise your account and financial data within 30 days.

Some data has to be kept for longer:

• Billing and tax records are kept for six years to meet UK tax law.
• Security and abuse-prevention logs are kept only for as long as needed to detect and investigate misuse, and are then deleted or aggregated.
• Records of a data protection request (for example, a deletion request) are kept for as long as needed to show we handled it properly.

Under UK data protection law you have the right to:

• Ask for a copy of the personal data we hold about you (right of access).
• Ask us to correct data that is wrong or incomplete (rectification).
• Ask us to delete your data in certain circumstances (erasure).
• Ask us to restrict how we use your data in certain circumstances.
• Object to processing we carry out on the basis of legitimate interests.
• Receive certain data in a portable format.
• Withdraw consent for anything we do on the basis of your consent.

How quickly we respond. We aim to respond to a data subject request without undue delay and, in any event, within one month. Under Article 12A UK GDPR (as amended by the Data (Use and Access) Act 2025), that one-month period begins on the day we receive your request (or, if we need it, the day we receive the information we reasonably need to identify you). We may extend the period by up to two further months where the request is complex or where you have made a number of requests, and if we do we will tell you within one month and explain why.

You can read more about these rights, and how to exercise them, on our GDPR Compliance page.

For any privacy question or complaint, please contact us first at support@trackr-finance.com. Under section 164A of the Data Protection Act 2018 (in force since 19 June 2026), we will acknowledge your data protection complaint within 30 days of receiving it, and will keep you informed of progress and the outcome.

You also have the right, at any time, to complain to the Information Commissioner's Office at ico.org.uk. Contacting us first does not remove that right, but we would welcome the chance to put things right.