Legal
Privacy Policy
Last updated: 23 June 2026
1. Who we are
Wealth Camera Ltd ("Wealth Camera", "we", "us", "our") operates the Wealth Camera platform at wealthcamera.com. We are the data controller for personal data processed through this service.
Contact: privacy@wealthcamera.com. Address: London, United Kingdom.
2. What data we collect
We collect the following categories of personal data:
| Account data | Name, email address, password hash, registration date |
| Financial profile | Income, assets, liabilities, investment holdings, pension values, property valuations entered by you or imported via Open Banking |
| Open Banking data | Bank account balances and transactions retrieved via TrueLayer (FCA-regulated). We store access tokens in encrypted form only. |
| HMRC data | National Insurance contribution record retrieved via HMRC APIs with your explicit Government Gateway consent. Includes qualifying years, gaps, and state pension projection. |
| Uploaded documents | PDF and CSV statements you upload (e.g. investment platform statements, bank statements). Stored encrypted at rest. |
| Usage data | Pages visited, features used, error logs. No advertising trackers. No third-party analytics sold. |
| Device / technical data | IP address, browser type, operating system — retained for security and fraud prevention only. |
3. Legal basis for processing (UK GDPR)
| Account management and service delivery | Performance of contract (Article 6(1)(b)) |
| Open Banking connections | Your explicit consent (Article 6(1)(a)) — withdrawn at any time by disconnecting the connection in Settings |
| HMRC NI Record access | Your explicit consent (Article 6(1)(a)) — granted via Government Gateway OAuth and revocable at any time |
| Financial data you enter manually | Performance of contract (Article 6(1)(b)) |
| Security, fraud prevention, legal compliance | Legitimate interests (Article 6(1)(f)) and legal obligation (Article 6(1)(c)) |
| Marketing communications (if opted in) | Consent (Article 6(1)(a)) — unsubscribe at any time |
4. HMRC API access — what we request and why
When you connect your HMRC account, we request the following OAuth scope:
read:national-insurance-record— to retrieve your NI qualifying years, contribution gaps, and projected state pension entitlement.
We do not request write access to HMRC systems, access to your tax return data, or payment or refund capabilities. We never store your Government Gateway username or password — authentication is handled entirely by HMRC's OAuth service.
You can revoke this access at any time via your HMRC online account or from Settings within Wealth Camera.
5. Open Banking data
Open Banking connections are established via TrueLayer, an FCA-authorised Account Information Service Provider (AISP). We access read-only transaction and balance data only. We never initiate payments on your behalf.
TrueLayer's privacy policy is available at truelayer.com/privacy.
6. How we store and protect your data
- All data is encrypted in transit using TLS 1.2+.
- Sensitive fields (OAuth tokens, document content) are encrypted at rest using AES-256.
- Access to production data is restricted by role-based access control and audit-logged.
- We do not store raw bank credentials or Government Gateway passwords at any point.
- Penetration testing is conducted at least annually by an independent provider.
7. Security incidents
In the event of a personal data breach affecting your data, we will notify the ICO within 72 hours and, where the breach is likely to result in a risk to your rights and freedoms, notify you directly without undue delay. To report a security concern: privacy@wealthcamera.com.
8. Data retention
| Account and financial data | Retained while your account is active, then deleted within 30 days of account closure |
| Open Banking tokens | Deleted immediately on disconnection; transaction history retained for 13 months for trend analysis |
| HMRC NI Record data | Cached for 24 hours; deleted on revocation of consent |
| Uploaded documents | Retained until you delete them, or 12 months after last access |
| Usage and security logs | 90 days |
9. Who we share data with
We do not sell your data. We share data only with the following sub-processors, under appropriate data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| TrueLayer | Open Banking connectivity | UK / EEA |
| AWS / Lightsail | Cloud infrastructure and hosting | UK / EEA |
| Anthropic (Claude) | AI-powered summaries (anonymised prompts only) | USA — Standard Contractual Clauses |
10. Your rights
Under UK GDPR you have the right to:
- Access — request a copy of all personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure — request deletion of your account and all associated data
- Restriction — ask us to pause processing while a complaint is resolved
- Portability — receive your data in a machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — for any consent-based processing (Open Banking, HMRC, marketing) at any time
To exercise any right, email privacy@wealthcamera.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO.
11. Cookies
We use only strictly necessary cookies (session authentication). We do not use advertising, analytics, or tracking cookies. No cookie consent banner is required under PECR for strictly necessary cookies.
12. Changes to this policy
We will notify you by email of material changes at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.
© 2026 Wealth Camera Ltd. Questions? privacy@wealthcamera.com