Effective date: 18 October 2026

Privacy Policy

1. Who We Are

DebtRiot is operated by DebtRiot Ltd, a company registered in Wales (company no. 17499198), registered office 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. DebtRiot Ltd is the data controller for the personal data described in this policy.

Website: debtriot.co.uk

Contact: hello@debtriot.co.uk

ICO registration: ZC267106

We comply with UK data protection law (UK GDPR and the Data Protection Act 2018).

2. What This Policy Covers

This policy covers all DebtRiot products and services:

debtriot.co.uk (the marketing site and demo calculation engine)

coaches.debtriot.co.uk (the professionals platform)

app.debtriot.co.uk (the organisations tool)

DebtRiot is one product, built on one calculation engine, available two ways: as a seat for professionals and as a licence for organisations. Each handles data differently - the sections below explain what applies to each.

3. The Calculation Engine - What We Don't Collect

All debt calculations - balances, interest rates, minimum payments, strategies - run entirely in your browser. We never receive or store the exact financial figures you enter, creditor names, or your plan. This applies to the demo engine at debtriot.co.uk, the professionals platform, and the organisations tool.

In the organisations tool only, anonymous counts are sent so that organisations can see how the tool is used. These include broad bands rather than amounts. Section 5 sets out exactly what is counted.

4. Professionals Platform (coaches.debtriot.co.uk)

There is no account. There is no password. Access is by a single access code, issued at the point of purchase.

What we hold:

A one-way hash of your access code, stored in your Stripe customer record and in our database (Upstash, UK region, London), together with your Stripe customer reference, the number of seats, and identifiers for the devices you use, so that the device limit can be applied.

Immediately after checkout, your code is held in our database in readable form for up to 24 hours so that it can be shown to you once. It is deleted when it is shown, or after 24 hours.

Your billing email address and subscription data, held by Stripe as our payment processor. We never see your card details.

On your own device: your access code, so that you stay signed in, and your saved client plans and notes. Plans are saved and reloaded as files you control. They are never sent to us.

We do not collect or store your clients' debt data. Plans are generated and saved locally.

Payments are processed by Stripe. See stripe.com/privacy for Stripe's privacy policy.

5. Organisations Tool (app.debtriot.co.uk)

The organisations tool is designed to collect no personal data from end users (tenants, employees, or service users).

What we do NOT collect from end users:

Name, email address, or any personal identifier

Exact debt amounts, income, spending, interest rates, creditor names, or plan content

Cookies for tracking or advertising

What we DO collect: anonymous aggregate counts only, per organisation per month. These include:

how many times the tool was opened, plans completed, plans re-opened and monthly check-ins

which strategy was chosen, and steps completed in the journey

debt types, and total owed in one of five broad bands

what-if amounts, in one of four broad bands

clicks on free help organisations

answers to an optional short survey, chosen from fixed options, with no free text

Small counts are rounded or held back on the dashboard so that a result cannot point to one person. This data cannot be used to identify any individual.

This data is stored in Upstash Redis, UK region (London), and retained for the life of the contract as anonymous aggregates, so six-month trend lines, annual reports and year-on-year comparisons remain meaningful. Generated reports are stored in a private, access-controlled Vercel Blob store. On contract termination, aggregates relating to that organisation are handled per the Data Processing Agreement (Schedule 2): archived as an audit trail by default, or deleted following written request by the organisation, which may be made at any time after termination.

Your IP address is processed transiently for abuse-prevention (rate limiting) only. It is held as a one-way hashed tag for up to 15 minutes. The raw address is never stored or written to a log, and it is never linked to your usage or identity.

Organisations access the anonymous counts via an admin dashboard. DebtRiot also has access for service improvement purposes.

Organisation administrators: we hold a recovery contact (an email address or phone number) for each organisation's admin account, used to verify access recovery requests and for account correspondence, and a one-way hash of the admin access code. These are deleted within 30 days of contract end, or within 5 business days of a written request.

The legal basis for processing anonymous usage counts and transient IP addresses is legitimate interests (Article 6(1)(f) UK GDPR). We have assessed that this processing is proportionate and does not significantly affect end users' rights. The legal basis for holding organisation administrators' recovery contacts is performance of the contract with the organisation (Article 6(1)(b) UK GDPR).

6. Marketing Site (debtriot.co.uk)

No account or sign-up is required to use the demo engine.

We may collect basic, anonymised analytics (page views, button clicks) only if you consent via the cookie banner. Analytics are disabled by default until you make a choice. We do not use advertising cookies and we do not sell data.

7. Contact Messages

If you email us or use the contact form, we will have your email address and the content of your message. We use this only to respond to you and for related follow-up. Contact messages are kept for up to 24 months.

8. Cookies and Device Storage

We use cookies and device storage only to keep the services working: for example, to keep an organisation's session open, to keep a professional signed in, and to save a plan on the user's own device when they choose to. Optional analytics cookies on debtriot.co.uk are only activated after you give consent via the cookie banner. We do not use advertising or tracking cookies.

9. Data Sharing

We do not sell your data.

We use the following sub-processors. Which apply depends on the product:

Squarespace, Inc. - hosting of debtriot.co.uk, the marketing site, delivery of published documents, and contact form submissions.

Vercel, Inc. - hosting and serverless compute for the professionals platform and the organisations tool, and private storage of organisation reports (USA/EU, SCCs in place).

Upstash, Inc. - Redis database (UK region, London): anonymous usage counts and admin account records for the organisations tool; access code hashes, seat and device records for the professionals platform; short-lived rate-limiting tags for both.

Stripe, Inc. - payment processing, professionals subscriptions only.

Zoho Corporation - business email hosting, used to receive and respond to contact messages (EU data centre).

For the organisations tool specifically, the only sub-processors are Vercel and Upstash. No payment processor and no analytics provider are involved.

These providers are contractually required to keep data secure and use it only for the purposes described.

10. Database Rights

DebtRiot Ltd is the database maker and rights holder of all databases compiled in connection with the operation of this platform, including:

Anonymous aggregate usage statistics (event counts, plan completions, strategy selections) collected via the organisations tool

Organisation configuration data (slugs, branding settings, access code lists)

Professional account metadata held in Stripe and supporting systems

Any future aggregate behavioural patterns, debt archetype models, or research datasets derived from anonymous usage data

These databases are protected under the Copyright and Rights in Databases Regulations 1997. Extraction or re-utilisation of all or a substantial part of any DebtRiot database is prohibited without the express written consent of DebtRiot Ltd. This does not affect any personal data rights set out in Section 12 (Your Rights).

11. Data Retention

Engine inputs: stored only in your browser or on your own device. Never sent to us.

Professionals platform: the access code in readable form for up to 24 hours after checkout; the access code hash, seat and device records while the subscription is active, deleted on request or after the subscription ends.

Organisations anonymous usage data: retained for the life of the contract as anonymous aggregates (no automatic expiry); archived by default on termination, or deleted following written request.

Organisation administrators' recovery contacts: deleted within 30 days of contract end, or within 5 business days of a written request.

Rate-limiting tags: up to 15 minutes.

Contact messages: retained for up to 24 months.

Payment records: retained as required for tax and legal compliance.

12. Your Rights

Under UK GDPR, you may have the right to:

access your personal data

correct inaccurate data

request deletion

restrict or object to processing

data portability

Since engine inputs never leave your browser or device, most rights apply only to billing data, access code records, organisation administrator contacts, contact messages, and payment records. To exercise your rights, email hello@debtriot.co.uk.

13. Children

DebtRiot is not intended for use by children under 16. We do not knowingly collect data from children.

14. Security

We use reasonable measures to protect information - secure hosting, access controls, one-way hashing of access codes, and regular updates. No system is 100% secure, but we take proportionate steps to manage risks.

15. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

16. Changes

We may update this policy. When we do, we will update the date at the top. Significant changes will be highlighted on the site.

17. Contact

Questions about privacy? Email hello@debtriot.co.uk

DebtRiot Ltd, registered in Wales, company no. 17499198. Registered office: 15 Neptune Court, Vanguard Way, Cardiff CF24 5PJ. ICO registration: ZC267106.