Draft only — not legal advice
This is a starting-point privacy policy, structured around UK GDPR and the Data Protection Act 2018. It must be reviewed and approved by a qualified solicitor or compliance advisor before publishing — especially because Comb describes investment products and will eventually process real financial data, which raises the stakes well above a typical marketing site. Every bracketed placeholder below is a fact only Comb can supply. Do not publish with placeholders still visible.
Privacy Policy
Last updated: [DATE]
1. Who we are
Comb ("we", "us", "our") provides financial insights for UK professionals. This policy explains what personal data we collect, why, and what rights you have over it.
- Data controller: [COMB LEGAL ENTITY NAME]
- Company registration number: [COMPANIES HOUSE NUMBER]
- Registered address: [ADDRESS]
- ICO registration number: [ICO REGISTRATION NUMBER]
- Contact for privacy questions: [PRIVACY EMAIL ADDRESS]
If we appoint a Data Protection Officer, their contact details will appear here: [DPO NAME AND CONTACT, IF APPLICABLE]
2. What we collect today (pre-launch waitlist)
At this stage, Comb's product has not yet launched. The only personal data we collect through comb.money is:
- Email address, when you join our waitlist.
- Marketing consent status (whether you agreed to receive launch updates), recorded at the point you submit the waitlist form.
We do not collect financial data, bank statements, or transaction data at this stage, because the product itself is not yet live.
3. What we will collect once Comb launches
This section describes data we intend to process once the product is live. It will be expanded and re-reviewed before launch — do not treat this as final.
- Account information: name, email address, and authentication credentials when you create an account.
- Financial statement data: transaction data from bank/card statements you choose to upload (CSV import). Comb does not request or store your banking login credentials.
- Derived insights: spending categorisations, anomaly flags, and projections we generate from your uploaded data.
- Wealth/investing data: if you use Comb's investing feature, data related to your portfolio, fund selections, and transaction history with our investment partner(s): [NAME OF BROKER/CUSTODIAN PARTNER, ONCE CONFIRMED].
- Tax-related data, if the tax insights feature is used: information relevant to potential reliefs or allowances, derived from your uploaded transaction data.
4. Why we process your data (legal basis)
| Purpose | Legal basis |
|---|---|
| Sending waitlist/launch update emails | Consent (Art. 6(1)(a) UK GDPR) — you can withdraw this at any time |
| Providing the core product once launched (insights, cashflow view) | Performance of a contract (Art. 6(1)(b)) |
| Improving and securing the product | Legitimate interests (Art. 6(1)(f)) — balanced against your rights |
| Meeting legal/regulatory obligations (e.g. financial promotion rules, tax record-keeping) | Legal obligation (Art. 6(1)(c)) |
We do not sell personal data to third parties, and we do not use your financial data to serve you advertising.
5. Who we share data with
We use the following third-party processors. This list will grow as the product develops — each new processor must be added here before it starts handling any personal data.
| Processor | Purpose | Data shared |
|---|---|---|
| Loops (loops.so) | Waitlist and email communications | Email address, consent status |
| [HOSTING PROVIDER] | Application hosting | [DATA CATEGORIES] |
| [AI/INSIGHTS PROVIDER, IF APPLICABLE] | Generating plain-English insights from your data | [DATA CATEGORIES — CONFIRM WHAT IS SENT] |
| [INVESTMENT BROKER/CUSTODIAN, ONCE CONFIRMED] | Executing and holding investments | [DATA CATEGORIES] |
Each processor is required to protect your data under a data processing agreement. We do not permit processors to use your data for their own purposes.
6. International data transfers
[STATE WHETHER DATA IS HOSTED SOLELY IN THE UK/EEA, OR WHETHER ANY PROCESSOR TRANSFERS DATA OUTSIDE THE UK/EEA. IF TRANSFERS OCCUR, DESCRIBE THE SAFEGUARD USED — e.g. UK International Data Transfer Agreement, adequacy decision, or Standard Contractual Clauses.]
7. How long we keep your data
- Waitlist emails: retained until launch, or until you unsubscribe, whichever is sooner. You can ask us to delete your waitlist entry at any time.
- Account and financial data (post-launch): [RETENTION PERIOD — DEFINE BEFORE LAUNCH, INCLUDING WHAT HAPPENS ON ACCOUNT DELETION AND WHETHER BACKUPS ARE PURGED ON THE SAME TIMELINE].
- Tax and investment records: may be subject to longer statutory retention periods under HMRC or FCA rules. [CONFIRM SPECIFIC PERIODS WITH A COMPLIANCE ADVISOR.]
8. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you.
- Rectify inaccurate data.
- Erase your data (“right to be forgotten”), subject to any legal retention obligations described above.
- Restrict or object to certain processing.
- Data portability — receive your data in a portable format.
- Withdraw consent at any time, where processing is based on consent (e.g. marketing emails).
To exercise any of these rights, contact us at [PRIVACY EMAIL ADDRESS]. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data.
9. Security
We take reasonable technical and organisational measures to protect your data, including [DESCRIBE ACTUAL MEASURES ONCE CONFIRMED — e.g. encryption in transit and at rest, access controls, staff training]. No system is completely secure, and we cannot guarantee absolute security.
10. Cookies
[DESCRIBE ACTUAL COOKIE/TRACKING USAGE ON THE WEBSITE ONCE CONFIRMED — e.g. analytics tools, session cookies for the waitlist form. If no non-essential cookies are used, state that explicitly. A separate cookie banner/consent mechanism is required under PECR if any non-essential cookies are set.]
11. Children
Comb is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect data from children.
12. Changes to this policy
We may update this policy as Comb's product develops. We will update the "Last updated" date above and, where changes are significant, notify waitlist members and users by email.
13. Contact us
Questions about this policy or your data: [PRIVACY EMAIL ADDRESS]
This document is a draft prepared to accelerate legal review — it is not itself a substitute for advice from a qualified solicitor or data protection professional, and must not be published with placeholders unresolved.