Privacy

Last updated: 4 July 2026

This policy explains what information Waffol collects, why, and what you can do about it. It covers the Waffol website (waffol.com), the early-access list, and, as it becomes available to you, the Waffol app and services (together, “Waffol”). Waffol is built for people in the UK and EU. Any questions, email hello@waffol.com.

Who we are

Waffol (“we”, “us”) provides tools that help you organise and keep track of your everyday money. We are based in the United Kingdom and are the controller of the personal data described here. For anything about your data, contact hello@waffol.com.

What we collect

When you join early access, we collect:

• your email address;
• which part of the site you signed up from;
• if you choose to answer them, your responses to a few optional questions; and
• basic technical context (browser type, the page that referred you, and any campaign tags) so we understand where interest comes from.

When you use the Waffol app, we collect the information you add or choose to connect so the product can work, such as transactions, receipts, notes, categories, splits, settlements, and any contacts you add. Some of this is personal or financial information. We also collect limited, privacy-friendly analytics about how Waffol is used. Our website analytics are cookieless and aggregated, and we do not use them to track you across the web. We do not ask for or store card numbers, and Waffol does not connect to your bank without your explicit action.

How we use it

We use your information to:

• provide, operate, secure, personalise, improve, and develop Waffol and our services;
• send your early-access invite and communicate with you about Waffol;
• understand what people want so we build the right things first;
• provide support and keep the service safe from abuse; and
• meet our legal obligations.

Our lawful bases are your consent (for the early-access list and the optional survey), our legitimate interests (in running, securing, and improving Waffol), performance of our agreement with you (to provide the service you ask for), and legal obligation where one applies. You can withdraw consent at any time. We do not sell your personal data, and we will not use your information for unrelated new purposes without telling you first and, where the law requires it, asking your consent.

AI features and providers

Waffol uses trusted third-party AI providers to power features such as reading receipts and answering questions about your money. When a feature you are using needs it, we send only the relevant information to these providers. They act as our processors under contract: they hold recognised, independently audited security certifications (such as SOC 2 Type II), they use your data only to provide the feature back to us, and, under their terms, they do not use your data to train their models. For security and commercial reasons we do not publicly name which providers we use. Waffol’s AI is there to help you understand and review your money; it does not make consequential financial decisions for you.

Sharing and subprocessors

We share information only with service providers who help us run Waffol, for example cloud hosting and databases, the AI providers above, privacy-friendly analytics, and, where you choose to use them, optional integrations such as exporting to your own spreadsheet. These providers act on our instructions under contract. We may also share information if the law requires it, to protect Waffol or its users, or as part of a business transfer such as a merger or acquisition. We do not sell your data or share it for other companies’ advertising. A current list of the providers we use is available on request.

Where your data is processed

We are UK and EU first, and we host with reputable infrastructure providers. Some of our providers, including AI providers, may process data outside the UK and EU. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses.

How we protect it

We protect your information with encryption in transit (HTTPS/TLS), strict access controls that keep each person’s data isolated from everyone else’s, careful management of our secrets and credentials, and redaction of personal and financial details from our operational logs. No system is ever perfectly secure, but we take security seriously and build for it from the start.

How long we keep it

We keep your information for as long as we need it to provide Waffol and for the purposes above. If you ask us to delete your account or to leave the early-access list, we remove the information we hold about you, except for limited records we are required to keep by law.

Your rights

Depending on where you live, you have rights over your data, including to access it, correct it, delete it, receive a copy, object to or restrict how we use it, and withdraw consent. To exercise any of these, email hello@waffol.com and we will help. If you are in the UK or EU, you can also complain to your data-protection authority; in the UK that is the Information Commissioner’s Office (ICO). Because Waffol uses AI, you also have the right not to be subject to decisions that significantly affect you made solely by automated means; Waffol’s AI is assistive and does not make such decisions, and you can always ask a person to review.

Children

Waffol is for adults. It is not intended for anyone under 18, and we do not knowingly collect their data.

Changes

We will update this policy as Waffol grows. If we make a material change, we will take reasonable steps to let you know. The date at the top shows the current version.

Contact

Questions or requests about your data: hello@waffol.com.