The short version
We know privacy policies can be long. Here are the key things you should know:
- You choose how your data gets into Plutus — enter transactions manually or optionally connect your bank accounts via open banking. We never store your bank login details or banking access tokens.
- We never sell your personal or financial data to anyone.
- Payments are handled by Stripe, our payment processor. We never see or store your full card details.
- Your data is encrypted in transit and at rest, including full-disk encryption on our database server.
- You can export or delete your data at any time.
- We do not use automated decision-making or profiling that produces legal or similarly significant effects.
1. What This Policy Covers
This Privacy Policy explains how Telotek Ltd, trading as Plutus Finance ("Plutus", "we", "us", or "our"), collects, uses, shares, and protects your information when you use our website, web application, and related services (collectively, the "Service").
Telotek Ltd is the data controller responsible for your personal data. Our registered address is 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.
By using Plutus, you agree to the collection and use of information as described in this policy. If you do not agree with any part of this policy, please do not use our Service.
2. Information We Collect
Account Information
When you create an account, we collect your name, email address, and a securely hashed version of your password. If you sign in with Google, we receive your name, email address, and profile picture from your Google account. We never store your Google password. If you enable two-factor authentication, we store the encrypted TOTP secret associated with your authenticator app.
Financial Data
Plutus supports two ways of managing your financial data: manual entry and optional bank account connections.
Manual entry. You can enter all transactions, budgets, categories, and account balances directly. No bank connection is required to use Plutus.
Bank connections (optional). If you choose to connect a bank account, we use FCA-regulated open banking providers to securely retrieve your account balances and transaction history. When you connect an account:
- Your banking credentials are entered directly into your bank's secure authentication flow — Plutus never sees or stores your bank login details
- We receive read-only access to your account balances and transaction data via the open banking provider
- We store the transaction data and balances provided in order to deliver the Service
- You can disconnect a linked account at any time from within Plutus
- Open banking consent is time-limited (typically 90 days) and you will be prompted to re-authorise when it expires
By connecting a bank account, you acknowledge that the open banking provider's privacy policy applies to their handling of your data during the connection process. All financial data — whether entered manually or imported via open banking — is stored securely and is only accessible to you (and any workspace members you choose to share it with).
Workspace Data
If you create or join a workspace, we store membership information, roles, and shared financial data associated with that workspace. All members of a workspace can see the shared budgets and transactions within it.
Usage Data
We collect information about how you interact with Plutus, including the features you use, pages you visit, actions you take, and the time and frequency of your activity. This helps us understand how people use Plutus and where we can improve.
Device & Technical Data
When you access Plutus, we automatically collect certain technical information, such as your IP address, browser type and version, operating system, device type, screen resolution, and referring URL.
Payment Data
Payments for Plutus are processed by Stripe, our payment processor. Stripe handles all payment processing, tax calculation, and invoicing. We receive your subscription status, plan details, and billing country from Stripe, but we never see or store your full credit card number, bank account details, or other sensitive payment information.
Communications
If you contact us for support, send us feedback, or respond to our emails, we collect the content of those communications along with your email address and any other information you choose to provide.
3. Legal Basis for Processing
Under the UK GDPR, we must have a lawful basis for processing your personal data. The legal basis we rely on depends on the type of data and the purpose of processing:
- Contract performance — Processing your account information, financial data, workspace data, and payment data is necessary to provide you with the Plutus service
- Legitimate interests — We process limited device, technical, security, and error-monitoring data to maintain the Service, protect accounts, and fix issues. Our legitimate interests do not override your fundamental rights and freedoms
- Consent — We rely on your consent for optional product analytics, marketing communications, and open banking connections. You may withdraw consent at any time
- Legal obligation — We may process data where necessary to comply with a legal obligation, such as responding to lawful requests from public authorities
4. How We Use Your Information
We use the information we collect to:
- Provide, maintain, and improve the Plutus service
- Process your subscription payments through Stripe
- Send transactional emails such as password resets, billing receipts, and account notifications
- Send marketing and onboarding emails where you have opted in to receive them (you can unsubscribe at any time using the link in any marketing email)
- Provide customer support and respond to your requests
- Send product updates, tips, and in-app notifications (which you can control via notification preferences in your settings). Security alerts and billing notifications are always sent regardless of your preferences.
- Analyse usage patterns to improve features and user experience
- Detect, prevent, and address technical issues and security threats
- Comply with legal obligations and enforce our terms of service
We will not use your financial data — whether entered manually or imported via open banking — for any purpose other than providing you with the Plutus service. We do not use your data to build advertising profiles or serve ads.
6. Data Security
We take the security of your data seriously and implement appropriate technical and organisational measures to protect it:
- All data is encrypted in transit using TLS/SSL
- Database storage is protected by full-disk encryption (LUKS2/AES-XTS)
- Banking connections use consent-based access through FCA-authorised providers — no banking credentials or access tokens are stored by Plutus
- Passwords are securely hashed and never stored in plain text
- Two-factor authentication (2FA) is available for your account, using time-based one-time passwords (TOTP)
- We use secure, HTTP-only cookies for session management
- Access to production systems is restricted and monitored
- We regularly review and update our security practices
While we strive to protect your personal information, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, but we are committed to keeping your data as safe as reasonably possible.
7. Data Retention
We retain your information for as long as your account is active or as needed to provide you with the Service.
If you choose to delete your account, we will remove your personal data and financial records within 30 days. Some information may be retained for longer if necessary to comply with legal obligations, resolve disputes, or enforce our agreements.
Anonymised, aggregated data that cannot be used to identify you may be retained indefinitely for analytical and product improvement purposes.
8. Cookies & Tracking
Essential Cookies
We use essential cookies to keep you signed in and to maintain your session. These cookies are strictly necessary for Plutus to function and cannot be disabled:
- plutus.session_token — Stores your authentication session token. HTTP-only, secure, same-site. Expires when you sign out or after 7 days of inactivity.
- plutus.session_data — Caches session data to reduce database lookups. HTTP-only, secure, same-site. Refreshed every 5 minutes, cleared on sign out.
Additional cookies may be set temporarily during two-factor authentication flows.
Error & Performance Monitoring
We use Sentry solely for error and performance monitoring — not for advertising or behavioural analytics. Sentry collects technical information about errors you may encounter (such as stack traces, browser type, and the page URL) to help us identify and fix issues. To help us diagnose issues, Sentry also receives your account identifiers (user ID, email, and name) and your IP address. Automatically collected monitoring data does not include your financial information. If you choose to attach a screenshot to feedback, it may include information visible on screen; you can hide sensitive areas before submitting. Sentry data is stored in the EU.
Website Analytics
On our marketing website (plutusfinance.app), we use Umami for privacy-friendly website analytics. Umami measures aggregate traffic such as page views, referral sources, browser and device information, and coarse location. We configure the marketing tracker not to collect URL query strings or fragments. It does not use cookies, create persistent identifiers, receive Plutus account identifiers, or track you across sites or devices. An IP address may be used transiently to derive location and anonymous session information, but is not stored by Umami. The service and its analytics data are hosted on our Hetzner infrastructure in Germany. Because this analytics is cookie-free and designed not to identify individuals, no cookie consent banner is required to browse our marketing website.
Product Analytics
Within the Plutus app, we use PostHog for product analytics to understand how people use the product and to improve it. PostHog collects usage data such as page views, feature interactions, and clicks. PostHog sets cookies to track analytics sessions, which is why we ask for your consent before enabling product analytics in the app. When you accept analytics consent, PostHog also receives account identifiers such as your user ID, email, and name to attribute usage to your account. PostHog data is stored in the EU.
After you accept analytics consent in the Plutus app, we use the same Umami service for anonymous product analytics, including aggregate page views, feature adoption, funnels, and short-term retention. Umami does not set cookies or receive account identifiers. We send general page paths with resource identifiers removed, and limited event information such as the feature used, a coarse free-or-paid plan category, and the time of the event. We do not send names, email addresses, account names, payees, notes, balances, transaction or budget amounts, URL query strings, URL fragments, or referrer values.
Umami uses a rotating, cookie-free session identifier derived from technical request information to calculate aggregate visits and short-term retention. An IP address may be used transiently to derive location and session information but is not stored by Umami. We do not use Umami data to identify a Plutus account or track a person across devices.
Live Chat Support
We use Crisp for in-app live chat support. When you use the chat widget, Crisp sets a session cookie to maintain your conversation. This cookie is functional (not used for analytics or advertising) and expires after 6 months, renewed on each visit. If you do not start a conversation, the session expires after 30 minutes. Crisp data is stored in the EU (Netherlands and Germany). Your IP address is stored server-side for active conversations as required by applicable law.
What We Do Not Use
We do not use cookies for advertising purposes. We do not use third-party advertising or cross-site behavioural analytics services (such as Google Analytics). We do not allow third-party advertising networks to set cookies through our Service. Sentry, PostHog, and Umami are used exclusively for the technical monitoring, website analytics, and product analytics described above.
Managing Cookies
You can control and manage cookies through your browser settings. Most browsers allow you to refuse cookies or delete existing ones. Please note that disabling essential cookies may prevent you from using certain features of Plutus.
9. Your Rights
Under the UK GDPR and the Data Protection Act 2018, you have the following rights regarding your personal data:
- Access — Request a copy of the personal data we hold about you
- Correction — Ask us to correct any inaccurate or incomplete data
- Deletion — Request that we delete your account and personal data
- Export — Download your data in a portable format (CSV export is available within the app)
- Withdraw consent — Where processing is based on consent (such as bank connections or marketing emails), you may withdraw consent at any time without affecting the lawfulness of prior processing
- Restrict processing — Ask us to limit how we use your data in certain circumstances
- Object — Object to our processing of your data where we rely on legitimate interests
- Data portability — Receive your personal data in a structured, commonly used, and machine-readable format
Right to Complain
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:
For EEA Residents
If you are located in the European Economic Area, you have equivalent rights under the EU GDPR and may lodge a complaint with your local data protection authority.
For Other Jurisdictions
If you are located in another jurisdiction with data protection laws, you may have similar rights under your local laws. This includes, but is not limited to, residents of California (CCPA/CPRA), Canada (PIPEDA), Australia (Privacy Act 1988), and Brazil (LGPD). We are committed to honouring those rights. Please contact us at privacy@plutusfinance.app if you have questions about how your local laws apply to your use of Plutus.
To exercise any of these rights, please contact us at privacy@plutusfinance.app. We will respond to your request within 30 days.
10. Data Breach Notification
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours of becoming aware of the breach, as required by Article 33 of the UK GDPR.
If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, providing details of the breach, its likely consequences, and the measures we have taken or propose to take to address it.
11. Children's Privacy
Plutus is not intended for use by anyone under the age of 18. We do not knowingly collect personal information from children. If we become aware that we have inadvertently collected data from a child under 18, we will take steps to delete that information as quickly as possible. If you believe a child has provided us with their data, please contact us at privacy@plutusfinance.app.
12. International Data Transfers
Plutus is operated from the United Kingdom. Our primary database and application server are hosted by Hetzner in Nuremberg, Germany. Data at rest for error monitoring (Sentry), product analytics (PostHog), anonymous analytics (Umami), and log management (Axiom) are stored in the EU. These intra-UK/EEA transfers are permitted under the UK-EU adequacy decision.
Several of our service providers are incorporated in the United States and may access personal data from outside the UK and EEA for operational purposes. Where your data is transferred to the United States, we rely on one or more of the following safeguards:
- EU-U.S. Data Privacy Framework and UK Extension. Where a US provider is certified under the EU-U.S. Data Privacy Framework (DPF) and its UK Extension, we rely on that certification as the primary transfer mechanism. The following processors hold active DPF certifications: Stripe, LLC; Cloudflare, Inc.; Functional Software, Inc. (Sentry); PostHog Inc.; Plus Five Five, Inc. (Resend); and Astrodon Corporation (Loops). Certification status can be verified on the Data Privacy Framework participant register.
- Standard Contractual Clauses. All US processors are also bound by the European Commission's Standard Contractual Clauses (SCCs, Module 2: controller-to-processor) and the UK International Data Transfer Addendum, which apply as a contractual fallback in the event that the DPF certification is invalidated or withdrawn.
- Transfer Impact Assessments. For processors that are not DPF-certified (currently Axiom, Inc.), we have completed a Transfer Impact Assessment to evaluate the legal framework in the destination country and confirm that the SCCs provide adequate protection.
UK-based processors (Finexer Ltd) and EU-based processors (Hetzner and Crisp) do not require an international transfer mechanism. Transfers between the UK and EEA are covered by the UK-EU adequacy decision.
13. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. Features such as budget alerts, transaction categorisation, and spending summaries are tools to help you manage your finances — they do not make decisions about you or restrict your access to services.
14. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting a notice within the Plutus app or by sending you an email.
We encourage you to review this policy periodically. Your continued use of Plutus after any changes indicates your acceptance of the updated policy.
15. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please get in touch:
Email: privacy@plutusfinance.app
Data Controller: Telotek Ltd
Registered Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
We aim to respond to all enquiries within 30 days.