Privacy Policy

1. Who is responsible?

ARTHUR FINANCIAL TECHNOLOGIES LTD (“Arthur”, “we”, “us”) is the controller for the information we use to run Arthur. Our company number is 17026792, our registered office is 20 Wenlock Road, London, England, N1 7GU, and our ICO registration number is ZC093334.

For privacy questions or requests, email privacy@arthur-app.com. Finexer and your bank have separate responsibilities for some information, explained below.

2. Information we use

Your account and choices

We use your email, account identifier, sign-in provider and account-security records. Google sign-in, if chosen, supplies profile details such as your name, email and profile image. We store your budgets, envelope allocations, category changes, recurring-bill selections, pay-cycle preferences and planning settings. These choices organise or analyse imported information.

Connected financial information

Depending on your bank and permission, this includes account names and identifiers, account type, currency, balances, transactions, merchant or payee descriptions, dates, amounts, payment status and other account or card details supplied by the provider. Arthur also derives categories, recurring-bill suggestions, spending summaries and estimates from that information.

Transaction descriptions may include information about other people or reveal sensitive matters. We use financial information for the services you request, rather than to infer your health, beliefs or other sensitive characteristics. Please avoid sending unnecessary sensitive information to support.

Technical information and messages

We process IP addresses, device or browser details, authentication events, connection status, consent records and error information. App refresh and notifications use device messaging identifiers and preferences. If you contact us, we receive your message, contact details and any diagnostics or attachments you choose to share. Diagnostic files kept on your device are distinct from information you send to support.

3. Why we use information and our lawful bases

• Account and app features — contract. Account information, connected financial data and your settings are used where necessary to provide the services you request, including spending views, budgets, bills and planning tools.
• Enquiries and support — legitimate interests. Our interest is in answering questions, resolving reported problems and keeping an appropriate record of the response.
• Security and service reliability — legitimate interests. We use proportionate technical information to protect accounts, prevent abuse, investigate faults and improve service reliability, taking account of your privacy and limiting the information used.
• Optional financial-summary notifications — consent. You can turn these off in Arthur or iOS settings. Background refresh needed to maintain the account views you request is part of providing the service.
• Applicable legal duties — legal obligation. This includes valid legal requests and applicable data-protection and complaint-handling requirements.
• Necessary complaint, security and legal-claim records — legitimate interests or a specific legal obligation. Only records needed for the particular purpose are retained, using the criteria in section 10.

Open Banking permission is separate from the lawful basis for processing personal information under data-protection law. Permission to access a bank account is not consent to unrelated advertising or unrelated uses of your information.

4. Connected accounts and Finexer

ARTHUR FINANCIAL TECHNOLOGIES LTD is registered on the Financial Conduct Authority Register as an agent of Finexer Ltd for the provision of Account Information Services under the Payment Services Regulations 2017. Finexer Ltd is authorised by the Financial Conduct Authority under the Payment Services Regulations 2017 as an Authorised Payment Institution (Firm Reference Number 925695).

Before connecting, you are shown the requested accounts, information and access, together with the applicable Finexer End User Terms. You authenticate through your bank's authorisation process. Arthur does not ask for or store your online banking password.

Authorised ongoing access may include background updates. It remains subject to your permission, provider availability and the reconfirmation or expiry requirements shown in the connection journey. Access may pause if reconfirmation is needed.

Arthur controls how information received into Arthur is used for our app. Finexer is a separate controller for purposes it determines, such as its regulated consent and audit records, security and complaints. Where it processes information on Arthur's documented instructions, it acts as our processor for that activity. Its Privacy Policy explains those roles and its own retention. Your bank is separately responsible for its records.

Arthur does not hold your money, initiate payments or transfer funds.

5. Categories, insights and estimates

Software organises transactions, suggests recurring bills and produces spending summaries, budgets and forecasts. These support your own choices. You can review and change categories, budgets and recurring-bill selections. These tools do not determine your eligibility for lending or credit, or make decisions about you with legal or similarly significant effects.

6. Notifications, storage and security

Firebase Cloud Messaging and Apple Push Notification service support app refresh. Routine background messages tell the app to refresh. Optional financial summaries are prepared on your device from information available to the app and may appear on your lock screen. Review your Arthur notification choices and iOS preview settings if you want to keep financial details out of previews.

Information is processed on your device and through the cloud services used to operate Arthur. We use access controls, encrypted network connections and device protections. App information may also be cached on your device.

Optional Face ID or device authentication uses iOS security features to protect a saved app credential. Arthur does not receive your Face ID biometric template. No system can guarantee complete security.

7. Who receives information

• Finexer: financial-account connectivity and the regulated account-information service.
• Google Firebase: authentication, cloud storage, database services and device messaging. Google also handles Google sign-in if you choose it.
• Apple: iOS notification delivery and device security features.
• Vercel: hosting our website and backend, including technical network and security information.
• Frankfurter: public exchange-rate requests. It receives network information needed to answer requests, such as an IP address; we do not send balances or transactions to obtain rates.
• Email and support providers: messages and attachments you send. If you use a website contact form, Formspree processes the submitted name, email and message.

Providers processing information for us must follow our instructions and applicable data-protection requirements. Providers acting for their own purposes explain those activities in their notices. Necessary information may also be disclosed to meet a binding legal requirement, protect security, handle a complaint or legal claim, or support a business transfer with appropriate confidentiality and data-protection safeguards.

8. Processing outside the UK

Some providers operate internationally, so information may be processed outside the UK. A restricted transfer must be covered by UK adequacy regulations or another permitted safeguard, such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, with any additional protection required. Contact privacy@arthur-app.com for details relevant to your information and how to obtain a copy of applicable safeguards, with confidential information removed where appropriate.

9. Stop access, remove history or delete your account

Stop future bank updates

Use the bank-access controls in Arthur or your bank's Open Banking controls to withdraw access. This stops future updates under that permission. Disconnecting alone does not delete history already saved in Arthur. That history can continue to support your spending and budgeting views, subject to the retention criteria below. Disconnecting Arthur does not close your bank account.

Ask us to remove saved bank information

You can request removal of saved information from a disconnected bank account without closing your whole Arthur account. Email privacy@arthur-app.com and identify the connection; do not send passwords or full card details. We will verify your request and explain any information that must be retained and why. Removal from Arthur does not erase records independently held by your bank or Finexer.

Delete your Arthur account

To request account deletion, use Settings → Your account → Delete Arthur account and complete identity verification. You can also email privacy@arthur-app.com, including if you cannot access this option or sign in. Deletion stops the service for that account and removes operational account information, financial history and settings, subject to the limited retention below. Associated bank connections are withdrawn and device messaging registrations removed as part of the process.

We handle deletion requests without undue delay and explain any exception or lawful extension. Section 12 sets out the response deadline for data-rights requests. Section 10 explains any continuing retention and how backup copies are handled. Your bank and Finexer remain responsible for their own records.

10. How long information is kept

• Account, financial history and settings: while your account is open and needed for the history and features you request, including disconnected-account history. Removal and deletion requests are handled as above.
• Bank-access credentials and connection records: while needed for authorised access, withdrawal and reconciliation. Consent and audit evidence may need to be kept separately after access ends.
• Support and complaints: while handling the issue, then only as needed to evidence its resolution, meet an applicable record-keeping requirement or deal with a legal claim.
• Security and diagnostics: for the investigation or prevention purpose for which the record is held. An unresolved incident or suspected abuse can require longer retention than routine troubleshooting.
• Limited deletion evidence: identifiers and status records needed to evidence deletion and prevent delayed background work recreating a deleted account. These are separate from operational transaction history and are not used for normal app features or marketing.
• Legal duties and claims: only the relevant information for the applicable statutory period, complaint requirement or period needed to establish, exercise or defend the particular claim. This does not justify keeping the entire financial history after deletion.

Backup copies, where used, may expire separately from live records under the provider's backup cycle. Information awaiting expiry must remain protected and restricted from ordinary use. Finexer and your bank may keep their own records under their respective notices. Contact us for retention arrangements relevant to a particular request.

11. Website cookies and analytics

Our website does not use optional analytics or advertising tracking. Hosting and security services may still process technical connection information. Our Cookie Policy explains website storage and browser choices. App storage, permissions and notifications are covered by this policy rather than by a website cookie banner.

12. Your rights

Depending on the information and lawful basis, you can ask to access, correct or erase personal information, restrict its use, or receive a portable copy. Where we rely on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal.

Your right to object

You can object to processing based on legitimate interests for reasons relating to your circumstances. We will consider the objection and stop unless we have a lawful overriding reason to continue.

Send requests to privacy@arthur-app.com. We may ask for proportionate information to verify identity. We normally respond free of charge within one month. We will explain any lawful extension or exception. If information is necessary for a feature and you do not provide it or ask us to remove it, that feature may no longer work.

13. Privacy complaints

Email privacy@arthur-app.com or write to our registered office with a privacy complaint. We will acknowledge it within 30 days, investigate without undue delay, keep you informed and explain the outcome and any action taken.

You also have the right to complain to the Information Commissioner's Office. Contacting us first does not remove that right. Complaints about Finexer's regulated service follow the separate route in our Terms & Conditions.

14. Eligibility and policy changes

Arthur is intended for people aged 18 or over. Contact our privacy address if you believe a child has provided information to us, so we can investigate.

We update this policy when practices change and show the revised date below. We will bring material changes to affected users' attention and provide relevant privacy information before starting a new use of their information. An update does not replace consent where consent is required.

Related documents: Terms & Conditions, Cookie Policy and Data Protection & ICO.

Last updated 16 October 2026