Privacy Policy

Wealth Camera Limited ("Wealth Camera", "we", "us", "our") operates the Wealth Camera platform at wealthcamera.com. We are the data controller for personal data processed through this service.

Contact: privacy@wealthcamera.com. Registered office: Unit 701 Stonehouse Park, Sperry Way, Stonehouse, Gloucestershire GL10 3UT, United Kingdom.

Wealth Camera Limited is registered in England and Wales, company number 17346676. We are registered with the Information Commissioner’s Office as a data controller (registration pending; application reference C2006461).

We collect the following categories of personal data:

When you connect your HMRC account, we request the following OAuth scope:

• read:national-insurance — to retrieve your National Insurance contribution record (annual Class 1 and Class 2 contributions by tax year). We do not receive a state pension forecast from HMRC; any pension figure shown is a labelled estimate.

We do not request write access to HMRC systems, access to your tax return data, or payment or refund capabilities. We never store your Government Gateway username or password — authentication is handled entirely by HMRC's OAuth service.

You can revoke this access at any time via your HMRC online account or from Settings within Wealth Camera.

Open Banking connections are established via TrueLayer, an FCA-authorised Account Information Service Provider (AISP). We access read-only transaction and balance data only. We never initiate payments on your behalf.

TrueLayer's privacy policy is available at truelayer.com/privacy.

• All data is encrypted in transit using TLS 1.2+.
• Sensitive fields — Open Banking and HMRC OAuth tokens, two-factor secrets, and the original documents you upload — are encrypted at rest using AES-256-GCM.
• Access to production systems is restricted to named operators using key-based authentication, and security-relevant events (logins, exports, connections) are audit-logged.
• We do not store raw bank credentials or Government Gateway passwords at any point.

In the event of a personal data breach affecting your data, we will notify the ICO within 72 hours and, where the breach is likely to result in a risk to your rights and freedoms, notify you directly without undue delay. To report a security concern: privacy@wealthcamera.com.

We do not sell your data. We share data only with the following sub-processors, under appropriate data processing agreements:

International transfers. Your data is stored and processed in the United Kingdom, and AI processing takes place in the United Kingdom or the European Union inside our own AWS account. The only transfer outside the UK and EU is transactional email via Resend (USA), for which we are putting the UK-approved safeguards in place (the UK International Data Transfer Addendum to the Standard Contractual Clauses, with a transfer risk assessment). If you would prefer not to use the AI feature at all, contact us and we will disable it on your account.

When you use Ask AI or run an analysis, we send a minimised summary of your financial data to an AI model (Anthropic's Claude, running on Amazon Bedrock inside our own AWS account in the UK or EU) to generate the answer.

What is sent. Aggregated figures only: totals, percentages, allowances, fee estimates, spending category totals and recognised merchant brand names — plus the text of your question and, for follow-ups, the earlier turns of your conversation. Before anything is sent, an automated boundary removes direct identifiers — names, account numbers, sort codes, addresses, National Insurance numbers and dates of birth — and refuses any data field it does not recognise.

What we keep. We do not store the text sent to or received from the model. We keep a metadata record of each request — when, which model, which data fields were included, how many identifiers were removed, and a cryptographic fingerprint — for 90 days, the same period as our other security logs. Results of analyses you run are stored in your account until you delete them or your account. Your data is never used to train anyone's AI model.

AI answers are general information and analysis based on the data you've entered — not regulated financial advice or a personal recommendation.

Under UK GDPR you have the right to:

• Access — request a copy of all personal data we hold about you
• Rectification — correct inaccurate or incomplete data
• Erasure — request deletion of your account and all associated data
• Restriction — ask us to pause processing while a complaint is resolved
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — for any consent-based processing (Open Banking, HMRC, marketing) at any time

To exercise any right, email privacy@wealthcamera.com. We will respond within 30 days. You also have the right to lodge a complaint with the ICO.

We use only strictly necessary cookies (session authentication) across the app. We do not use advertising, analytics, or tracking cookies. One exception: if you click one of our partner comparison links, a first-party cookie ("wc_ref_aid", 12 months, sent only to our referral endpoint) records that the click came from us so the partner sign-up can be attributed. It contains a random identifier only and does not track your browsing.

We will notify you by email of material changes at least 14 days before they take effect. Continued use of the service after that date constitutes acceptance.