Effective date: 22 August 2026

Privacy Policy

1. Who We Are

DebtRiot is operated by Monika Pankiewicz, sole trader, registered in England and Wales. Website: debtriot.co.uk Contact: hello@debtriot.co.uk ICO Registration: ZC115123 We comply with UK data protection law (UK GDPR and the Data Protection Act 2018).

2. What This Policy Covers

This policy covers all DebtRiot products and services: debtriot.co.uk (the marketing site and demo calculation engine) coaches.debtriot.co.uk (the professionals platform) app.debtriot.co.uk (the organisations tool) DebtRiot has two products: a professionals platform and an organisations tool. Both are powered by the same calculation engine. Each handles data differently - the sections below explain what applies to each.

3. The Calculation Engine - What We Don't Collect

All debt calculations - balances, interest rates, minimum payments, strategies - run entirely in your browser. We never receive, store, or process the financial figures you enter. This applies to the demo engine at debtriot.co.uk, the professionals platform, and the organisations tool.

4. Professionals Platform (coaches.debtriot.co.uk)

There is no account. There is no password. Access is by a single recovery code, issued once at the point of purchase. What we hold: A one-way hash of your recovery code, stored in your Stripe customer record. The code itself is shown to you once and is never stored by DebtRiot in a readable form. Your billing email address and subscription data, held by Stripe as our payment processor. We never see your card details. Plan data stored on your own device. Plans are saved and reloaded as files you control. They are never sent to us. We do not collect or store your clients' debt data. Plans are generated and saved locally. Payments are processed by Stripe. See stripe.com/privacy for Stripe's privacy policy.

5. Organisations Tool (app.debtriot.co.uk)

The organisations tool is designed to collect no personal data from end users (tenants, employees, or service users). What we do NOT collect from end users: Name, email address, or any personal identifier Debt amounts, interest rates, or any financial data entered into the tool Cookies for tracking or advertising What we DO collect: Anonymous aggregate usage counts only - for example, how many times the tool was opened, how many plans were completed, which strategy was most selected. This data cannot be used to identify any individual. This data is stored in Upstash Redis, UK region (London), and retained for the life of the contract as anonymous aggregates, so six-month trend lines, annual reports and year-on-year comparisons remain meaningful. On contract termination, aggregates relating to that organisation are handled per the Data Processing Agreement (Schedule 2): archived as an audit trail by default, or deleted following written request by the organisation, which may be made at any time after termination. Your IP address is processed transiently for abuse-prevention (rate limiting) only. It is held for up to 15 minutes, is not written to any log, and is never linked to your usage or identity. Organisations access this data via an admin dashboard. DebtRiot also has access for service improvement purposes. The legal basis for this processing is legitimate interests (Article 6(1)(f) UK GDPR). We have assessed that processing anonymous usage counts is proportionate and does not significantly affect end users' rights.

6. Marketing Site (debtriot.co.uk)

No account or sign-up is required to use the demo engine. We may collect basic, anonymised analytics (page views, button clicks) only if you consent via the cookie banner. Analytics are disabled by default until you make a choice. We do not use advertising cookies and we do not sell data.

7. Contact Messages

If you email us, we will have your email address and the content of your message. We use this only to respond to you and for related follow-up. Contact messages are kept for up to 24 months.

8. Cookies

We use cookies to keep the site working. Optional analytics cookies are only activated after you give consent via the cookie banner. We do not use advertising or tracking cookies.

9. Data Sharing

We do not sell your data. We use the following sub-processors. Which apply depends on the product: Squarespace, Inc. - hosting of debtriot.co.uk, the marketing site, and delivery of published documents. Contact form submissions where used. Vercel, Inc. - hosting and serverless compute for the professionals platform and the organisations tool (USA/EU, SCCs in place) Upstash, Inc. - anonymous usage counts, Redis database, organisations tool (UK region, London) Stripe, Inc. - payment processing, professionals subscriptions only Zoho Corporation - business email hosting, used to receive and respond to contact messages (EU data centre) For the organisations tool specifically, the only sub-processors are Vercel and Upstash. No payment processor and no analytics provider are involved. These providers are contractually required to keep data secure and use it only for the purposes described.

10. Database Rights

DebtRiot is the database maker and rights holder of all databases compiled in connection with the operation of this platform, including: Anonymous aggregate usage statistics (event counts, plan completions, strategy selections) collected via the organisations tool Organisation configuration data (slugs, branding settings, access code lists) Professional account metadata held in Stripe and supporting systems Any future aggregate behavioural patterns, debt archetype models, or research datasets derived from anonymous usage data These databases are protected under the Copyright and Rights in Databases Regulations 1997. Extraction or re-utilisation of all or a substantial part of any DebtRiot database is prohibited without the express written consent of DebtRiot. This does not affect any personal data rights set out in Section 12 (Your Rights).

11. Data Retention

Engine inputs: stored only in your browser. Never sent to us. Professionals platform data: a recovery code hash held in Stripe while the subscription is active, deleted on request or after the subscription ends. Organisations anonymous usage data: retained for the life of the contract as anonymous aggregates (no automatic expiry); archived by default on termination, or deleted following written request. Contact messages: retained for up to 24 months. Payment records: retained as required for tax and legal compliance.

12. Your Rights

Under UK GDPR, you may have the right to: access your personal data correct inaccurate data request deletion restrict or object to processing data portability Since engine inputs never leave your browser, most rights apply only to billing data, contact messages, and payment records. To exercise your rights, email hello@debtriot.co.uk.

13. Children

DebtRiot is not intended for use by children under 16. We do not knowingly collect data from children.

14. Security

We use reasonable measures to protect information - secure hosting, access controls, and regular updates. No system is 100% secure, but we take proportionate steps to manage risks. #

15. Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

16. Changes

We may update this policy. When we do, we will update the date at the top. Significant changes will be highlighted on the site.

17. Contact

Questions about privacy? Email hello@debtriot.co.uk DebtRiot | Monika Pankiewicz, sole trader, Cardiff, Wales | ICO Registration: ZC115123