Privacy notice

Draft for the minimum viable product. Last updated: 28 October 2026. To be reviewed by a data protection specialist before wider launch.

Who we are

Vecta is operated by [COMPANY NAME] Ltd, registered in England and Wales, company number [NUMBER], [REGISTERED ADDRESS] ("we"). We are the data controller for the limited personal data described here. ICO registration number: [ICO NUMBER]. Contact: [privacy@yourdomain].

What stays on your device

The figures you enter or confirm (income, savings, pensions, tax payments, dates and your update history) are stored in your own browser's local storage. We do not receive or keep them on our servers. If you clear your browser data or use another device, they are not available; use "Export my data" to keep a copy.

What we process when you use the assistant

When you press "Fill in the form for me" or "Work out changes", the text you typed, any documents you attached, and the current field values are sent over an encrypted connection to our server function and on to our AI provider, Anthropic, to propose field values. We do not store this content. Our provider processes it under its commercial terms, which do not permit using it to train models, and may keep it for a limited period for safety and abuse monitoring.

• Lawful basis: performance of a contract (providing the service you asked for), Article 6(1)(b) UK GDPR.
• International transfer: Anthropic is based in the United States. Transfers rely on the UK–US data bridge or the UK International Data Transfer Addendum, as applicable.
• Please do not upload documents containing other people's information unless they're happy for you to do so, and avoid documents showing full account numbers where possible.

Early-access list and feedback

If you join the early-access list we keep your email address, the situation you chose and your answer about paying, to email you about Vecta (consent, Article 6(1)(a) UK GDPR). If you send feedback we keep your message and, if you give it, your email so we can reply (legitimate interests). These are stored by our hosting provider, Netlify, and kept until you ask us to delete them or we close the list. You can withdraw consent at any time by replying to any email or emailing us.

Usage counts and error reports

To see which features are used and to fix problems, the site counts page views and actions (for example "dashboard built" or "assistant used") and records error messages from the page. These counts contain no names, figures, cookies or device identifiers, and are not linked to you. Numbers and email addresses in error messages are removed before storage. To enforce daily assistant limits we keep a one-way scrambled form of your IP address that changes every day and cannot be turned back into the address. If your browser sends "Do Not Track", no counts are sent. Lawful basis: legitimate interests in running a reliable service.

Technical data

Our hosting provider, Netlify, processes IP addresses and request logs to deliver the site and keep it secure (legitimate interests). We use no cookies at all, including no advertising or tracking cookies.

Your rights

You can access, correct, export or delete your figures yourself at any time in the app ("Your data" menu). For anything we hold, you can ask for access, correction or deletion by emailing us. You can complain to the Information Commissioner's Office at ico.org.uk.

Security

All traffic uses HTTPS. The site sends strict security headers and loads code only from approved sources. Because your figures are held in your browser, anyone with access to your device and browser profile can see them.