Privacy Policy

Wealth Camera Limited ("Wealth Camera", "we", "us", "our") operates the Wealth Camera platform at wealthcamera.com. We are the data controller for personal data processed through this service.

Contact: privacy@wealthcamera.com. Registered office: Unit 701 Stonehouse Park, Sperry Way, Stonehouse, Gloucestershire GL10 3UT, United Kingdom.

Wealth Camera Limited is registered in England and Wales, company number 17346676. We are registered with the Information Commissioner’s Office as a data controller (registration pending; application reference C2006461).

We collect the following categories of personal data:

When you connect your HMRC account, we request the following OAuth scope:

• read:national-insurance — to retrieve your National Insurance contribution record (annual Class 1 and Class 2 contributions by tax year). We do not receive a state pension forecast from HMRC; any pension figure shown is a labelled estimate.

We do not request write access to HMRC systems, access to your tax return data, or payment or refund capabilities. We never store your Government Gateway username or password — authentication is handled entirely by HMRC's OAuth service.

You can revoke this access at any time via your HMRC online account or from Settings within Wealth Camera.

Account connections are established via Moneyhub (Moneyhub Financial Technology Ltd), an FCA-authorised Account Information Service Provider (AISP), under whose agent permissions we operate. Wealth Camera Limited is registered with the FCA as an agent of Moneyhub (FCA reference number 1062106). We access read-only balance, holding and transaction data only. We never initiate payments on your behalf.

Two connection methods exist, and they differ in how you log in. Moneyhub's provider list tells you which applies before you connect.

Open Banking API connections (all major UK banks and card providers, and a small number of investment and pension providers). You are sent to your bank's own website or app to log in and choose which accounts to share. Your login details are entered only with your bank. Neither Wealth Camera nor Moneyhub sees, receives or stores them. Access lasts up to 90 days before the bank asks you to reconfirm.

Screen-scraping connections (most investment platforms and pension providers, for example Hargreaves Lansdown, AJ Bell, Vanguard, Interactive Investor and workplace pension schemes, which do not yet offer an Open Banking API). You enter your username and password for that platform on a page hosted by Moneyhub, and Moneyhub logs in to the platform on your behalf to read your balances and holdings, usually asking you for a one-time code each time it refreshes. Moneyhub stores those login details in encrypted form under its own security controls so that it can refresh the connection; Wealth Camera never sees, receives or stores them. This method depends on the platform's website and can stop working when a platform changes it, and some platforms' terms discourage sharing login details with third parties, so check yours if you are unsure. You can disconnect at any time from the Balance sheet page, which asks Moneyhub to delete the connection and the stored credentials.

Moneyhub's privacy policy is available at moneyhub.com/privacy-policy, and our entry on the FCA register at register.fca.org.uk.

• All data is encrypted in transit using TLS 1.2+.
• Sensitive fields — Open Banking and HMRC OAuth tokens, sort codes and account numbers shared by your bank, two-factor secrets, and the original documents you upload — are encrypted at rest using AES-256-GCM.
• Access to production systems is restricted to named operators using key-based authentication, and security-relevant events (logins, exports, connections) are audit-logged.
• We do not store raw bank credentials or Government Gateway passwords at any point.

In the event of a personal data breach affecting your data, we will notify the ICO within 72 hours and, where the breach is likely to result in a risk to your rights and freedoms, notify you directly without undue delay. To report a security concern: privacy@wealthcamera.com.

We do not sell your data. We share data only with the following sub-processors, under appropriate data processing agreements:

International transfers. Your data is stored and processed in the United Kingdom, and AI processing takes place in the United Kingdom or the European Union inside our own AWS account. The only transfer outside the UK and EU is transactional email via Resend (USA), for which we are putting the UK-approved safeguards in place (the UK International Data Transfer Addendum to the Standard Contractual Clauses, with a transfer risk assessment). If you would prefer not to use the AI feature at all, contact us and we will disable it on your account.

When you use Ask AI or run an analysis, we send a minimised summary of your financial data to an AI model (Anthropic's Claude, running on Amazon Bedrock inside our own AWS account in the UK or EU) to generate the answer.

What is sent. Aggregated figures: totals, percentages, allowances, fee estimates, spending category totals and recognised merchant brand names — plus the text of your question and, for follow-ups, the earlier turns of your conversation. When you ask about specific payments ("have I paid a removal company?"), the model can run a search over your transactions; it then also receives the matching rows as date, amount, category and a normalised payee name. It never receives the raw statement line, references, balances or account identifiers. Before anything is sent, an automated boundary removes direct identifiers — names, account numbers, sort codes, addresses, National Insurance numbers and dates of birth — and refuses any data field it does not recognise.

What we keep. We do not store the text sent to or received from the model. We keep a metadata record of each request — when, which model, which data fields were included, how many identifiers were removed, and a cryptographic fingerprint — for 90 days, the same period as our other security logs. Results of analyses you run are stored in your account until you delete them or your account. Your data is never used to train anyone's AI model.

AI answers are general information and analysis based on the data you've entered — not regulated financial advice or a personal recommendation.

Under UK GDPR you have the right to:

• Access — request a copy of all personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account and all associated data
• Restriction — ask us to pause processing while a complaint is resolved
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for any consent-based processing (Open Banking, HMRC, marketing) at any time

To exercise any right, email privacy@wealthcamera.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO.

We use only strictly necessary cookies (session authentication) across the app. We do not use advertising, analytics, or tracking cookies. One exception: if you click one of our partner comparison links, a first-party cookie ("wc_ref_aid", 12 months, sent only to our referral endpoint) records that the click came from us so the partner sign-up can be attributed. It contains a random identifier only and does not track your browsing.

We will notify you by email of material changes at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.