Privacy Policy

Luura Finance Ltd

1. Who we are

Luura Finance Ltd is a UK-based finance app that helps you manage money with less effort. You can upload your bank statements, or add transactions, bills and notes manually. There is no direct connection to your bank.

• Registered in England and Wales, company number 16777741
• Registered address: 167-169 Great Portland Street, London, England, W1W 5PF
• ICO registration reference: ZC081876
• Contact: support@luurafinance.app

Luura Finance Ltd is the data controller for the personal data described in this policy.

2. Who can use Luura

Luura is for people aged 18 and over who live in the United Kingdom. We do not knowingly collect data from anyone under 18. If we find that someone under 18 has created an account, we will close it and delete their data.

3. What data we collect

We only collect what we need to run the service and support you.

• Account information: name, email address, password and subscription status. Payments are processed by Apple (App Store) or Google (Google Play). Luura never collects or stores your payment card details.
• Sign in with Google or Apple: if you choose to sign in with your Google or Apple account, we receive your name and email address from them. Apple may give us a private relay email address instead of your real one. We never receive your Google or Apple password.
• Notification token: if you allow notifications, a device token that lets us send reminders to your phone.
• Bank statements you upload: the transactions in them, such as dates, descriptions and amounts. Luura adds only the transactions it does not already hold and categorises them.
• Bills and letters you scan: the photo or screenshot you take and the details read from it, such as the amount, sender, deadline and any early-payment discount.
• Manual financial entries: transactions, bills, goals, categories and notes that you choose to add.
• Mood entries: moods you choose to log alongside your spending. See section 5 for how we treat this data.
• App usage data: device type, IP address, pages or screens visited and error logs so we can fix issues and improve performance.
• Support interactions: messages you send to our support inbox.

Luura does not connect to your bank. Transactions only reach Luura when you upload a statement or add them yourself.

4. How and why we use your data

UK GDPR requires us to have a lawful basis for everything we do with your data. Here is each purpose alongside the basis we rely on.

We do not sell your data to advertisers.

How we use artificial intelligence

Luura uses Claude, an artificial intelligence model provided by Anthropic PBC, for three features:

• Reading PDF bank statements you upload, to extract the transactions in them. CSV files are read directly, without AI.
• Categorising transactions from the bank statements you upload, whether CSV or PDF, so your spending is sorted into categories. Luura sends the transaction description, amount and date. It does not send your name, account number or sort code, although a description can sometimes include a name, for example a bank transfer to a person. Transactions you add manually are not sent.
• Reading bills, fines and letters you photograph or screenshot, to pick out details such as the amount, sender, deadline and any early-payment discount.

Anthropic processes this information only on our behalf, as our data processor, under a data processing agreement. Anthropic does not use it to train its AI models, and automatically deletes it within 30 days, unless the law requires it to be kept for longer or it is needed to investigate misuse of Anthropic's services, in which case it may be kept for up to 2 years.

Mood entries are never sent to Anthropic. These features help you organise your own information. They do not make decisions about you that have legal or similarly significant effects. AI can make mistakes, so you can review and edit anything Luura extracts. Our Transaction Import Policy explains statement imports in more detail.

5. Mood data

Mood entries can reveal information about your wellbeing, so we treat them with extra care. We only process mood data with your explicit consent, which we ask for in the app before you log your first mood. You can withdraw consent at any time in settings, and you can delete individual mood entries whenever you like. Mood data is never shared with third parties and is never used for marketing.

6. Who we share your data with

We share data with trusted providers who help us run Luura. They only receive what is necessary for their service.

If laws require it, we may share data with authorities to protect users and comply with legal obligations.

7. Where your data is stored

Luura runs on Amazon Web Services (AWS) via the Bubble platform. Data may be processed in the UK, EU or US, depending on the provider. Where data leaves the UK, we rely on UK adequacy decisions or put in place the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses to keep it protected.

Information processed by Anthropic is stored in the US and may be processed in other countries where Anthropic operates, protected by the safeguards in Anthropic's data processing agreement.

8. How long we keep your data

Retention periods are set out in full in our Data Retention Policy. In summary:

Residual copies in automated platform backups expire within 14 days and are never restored except for disaster recovery.

You can request deletion at any time. Some records, such as payment and accounting records, must be kept for 6 years to meet legal obligations even after your account closes. See section 9 for your rights.

9. Your rights under UK GDPR

You can:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your data (the right to be forgotten)
• Restrict or object to certain processing
• Withdraw consent at any time, where consent is the basis we rely on
• Port your data in a commonly used format
• Complain to the Information Commissioner's Office (ICO) at ico.org.uk if you are unhappy with how we handle your data

Email support@luurafinance.app to make a request. We will respond within one month, as required by law.

10. Cookies

We use cookies and similar technologies to keep you signed in, remember preferences and measure performance. You can manage cookies in your browser or device settings, or through the cookie preferences tool on our website, though some features may not work correctly if cookies are disabled.

Typical cookies we use

• Authentication cookies: keep your session secure.
• Preference cookies: remember settings you choose.
• Analytics cookies (Google Analytics): help us understand usage in aggregate. These are only set if you accept them in the cookie banner.

11. Data security

We use encryption in transit (HTTPS), modern authentication, role-based access and audit logging. Passwords are stored using industry-standard hashing. Only authorised personnel and providers can access the minimum data needed to operate the service. You can read more in our Security Policy.

No system is perfectly secure, so please use a strong, unique password and keep your login details private.

12. Changes to this policy

We may update this policy as Luura evolves. If we make significant changes, we will notify you in the app or by email and update the date at the top of this page.

13. Contact us

Questions or requests about your data?

• Email: support@luurafinance.app
• Post: Luura Finance Ltd, 167-169 Great Portland Street, London, England, W1W 5PF

Approved by

Kiesha Okeowo
Director
Luura Finance Ltd