Privacy Policy

Effective Date: April 2026

Welcome to Endute. We are committed to protecting your privacy and handling your personal data in an open and transparent manner. This Privacy Policy explains how Elision Ltd (company number 16544567), trading as Endute (“we,” “us,” or “our”), collects, uses, shares, and protects your personal data when you use our personal finance management application and website (collectively, the “Services”).

Elision Ltd is registered in England and Wales. Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC005147.

1. Who We Are

Endute is a personal finance management platform that empowers individuals to take control of their financial future through clear, actionable financial information. The platform enables users to connect their bank accounts via open banking, track spending, manage budgets, monitor investments and tangible assets, set financial goals, and generate financial reports and insights.

For privacy-related questions, contact us at: privacy@endute.com

2. What Personal Data We Collect

a. Account and Profile Information

• Your username, email address, and display name
• Password (securely hashed - we never store your password in plaintext)
• Profile settings: base reporting currency, country, timezone
• Multi-factor authentication (MFA) settings: MFA status, encrypted backup codes, and trusted device information (user agent, IP address, token expiry)
• Email verification status and any pending email address changes
• Onboarding progress

b. Financial Data (Entered by You or Imported with Your Consent)

• Account details: names, types (checking, savings, credit card, loan, investment, cash), currencies, balances
• Transaction data: dates, amounts, descriptions, merchant names, categories, payees, currencies, notes, and status. This includes split transactions, transfers, refund links, and loan repayment splits.
• Scheduled/recurring transactions: frequency, amounts, linked accounts and categories
• Budgets: monthly category allocations and budget preferences
• Investment data: securities tracked (linked to market data or custom-defined), holdings, buy/sell/dividend transactions, custom valuations for unlisted assets
• Tangible assets: property, vehicles, and other assets with valuation history
• Financial goals: names, target amounts, target dates, contributions
• Open banking data (with your explicit consent): if you connect your bank accounts, we receive account details (identifier, name, currency, bank name) and transaction history for the accounts you select. We do not receive or store your bank login credentials.
• Spending habit data: system-calculated patterns for how you typically spend across account types

c. Subscription and Billing Information

• Your subscription plan, status (active, trialling, expired), and plan/trial dates
• Payment processor customer and subscription identifiers, used to manage your subscription

Your payment method details (e.g., card number) are processed and stored directly by our PCI-DSS compliant payment processor. We do not collect or store your payment card information.

d. Technical and Usage Data

• IP address: collected during registration for currency suggestion and for security logging
• Device and browser information: browser type, operating system, device type - used for service functionality and security
• Cookies and session tokens: essential cookies for login sessions, security protections, and MFA trusted device management (see Section 12)
• API interaction logs: logged for troubleshooting, security analysis, and performance monitoring; may include IP addresses
• Anonymous usage analytics: aggregated, anonymous data about feature usage and page views to improve the service. This data does not identify you. Our analytics provider is hosted within the EU and user identification is not implemented - all analytics are fully anonymous.

e. Communication and Support Data

• If you contact us via email or the contact form on endute.com, we collect the content of your communication, your name, and your email address
• If you use the in-app helpdesk chatbot, your messages are logged. The chatbot is powered by an AI assistant and your messages are processed to generate responses. The chatbot does not have access to your account data, and a notice is displayed informing you that you are interacting with an AI assistant.

f. Referral Data

• If you participate in our referral programme, we store referral codes and the relationship between referrer and referred user, along with any referral rewards earned

g. Marketing Site Data (endute.com)

• Cookie preferences managed via a consent management tool
• If you accept analytics cookies, our website analytics provider collects page views, referral sources, and device information. If you decline, no analytics data is collected.
• Our website hosting provider collects basic page visit data as part of its platform

3. How We Collect Your Data

Directly from you: when you register, input financial data, configure settings, contact support, or submit the contact form on endute.com.

Automatically: through essential cookies and session management for authentication; through anonymous analytics; through API logging for security and troubleshooting.

From third parties with your authorisation: when you connect your bank accounts via open banking, we receive account and transaction data from your bank through our regulated open banking providers (see Section 6). When you subscribe, our payment processor provides us with subscription management data.

4. Legal Basis for Processing

You can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

5. How We Use Your Data

To provide and operate the service:

• Authenticate you and manage your account access
• Enable you to track, manage, and analyse your financial information
• Calculate and display reports, net worth, forecasts, and financial insights based on your data
• Facilitate open banking connections and data import as directed by you
• Process scheduled transactions
• Categorise transactions using AI-powered enrichment (see Section 9 for privacy details)
• Fetch market data for securities you track

To manage your subscription:

• Process payments and manage your plan through our payment processor
• Communicate with you about subscription status, billing, and renewals

To communicate with you:

• Send essential service announcements (maintenance, security, policy changes)
• Respond to support requests and feedback
• Send marketing communications if you have opted in

To improve and secure the service:

• Monitor usage trends (using anonymous data) to improve features and performance
• Diagnose and fix technical issues
• Prevent fraud and protect the security of the platform

We will NOT:

• Sell your personal data to any third party
• Use your financial data for targeted advertising
• Share your financial data with any third party for their own marketing or analytical purposes
• Access your bank login credentials - these are handled directly by your bank during the open banking authorisation process and are never visible to or stored by Endute
• Provide financial advice - Endute provides information and analysis tools, not advice
• Make automated decisions based on your financial data that affect your access to the service, its features, or its pricing

6. Who We Share Your Data With

We do not sell your personal data. We share data only with trusted service providers, strictly for service delivery. We do not share your data with any third party for their own marketing, advertising, or analytical purposes. All third-party providers are contractually bound to protect your data and use it only for specified purposes.

We may also disclose your personal data if required by law, to comply with legal process, to protect our rights, or in connection with a merger, acquisition, or sale of assets (with prior notice to you).

7. International Data Transfers

Our primary servers and database are hosted in Germany, within the European Economic Area (EEA). Some of our service providers are based outside the UK/EEA, including in the United States. When your data is transferred to these providers, it is protected by Standard Contractual Clauses (SCCs) or equivalent transfer safeguards.

Our analytics provider and transactional email provider process data within the EU. Our DNS and CDN provider processes traffic globally via its edge network.

8. Open Banking

When you choose to connect your bank account, the following process occurs:

• You select your bank from a list of supported institutions within the Endute app
• You are redirected to your bank’s login page via our open banking provider, where you authenticate using your own banking credentials (Strong Customer Authentication). Endute never sees or stores your bank login credentials.
• You authorise read-only access to your account balances and transaction history. Endute cannot initiate payments, modify your accounts, or access any other bank services.
• Your consent is valid for 90 days, after which you must re-authenticate with your bank to continue receiving updated data
• You can disconnect your bank connection at any time from within the app. When you disconnect, we immediately revoke the consent with the open banking provider. Previously imported data is retained unless you delete your account.
• If your Endute subscription lapses, your bank connections are automatically revoked after a short grace period to stop unnecessary data collection

9. AI-Powered Features

a. Transaction Categorisation

To automatically categorise your bank transactions, we use an AI service. The data sent for categorisation is strictly limited to:

• The normalised merchant description from the transaction (e.g., “SHELL OIL”)
• A direction flag indicating whether the transaction was a debit or credit

No user identifiers, transaction amounts, dates, account numbers, or any other contextual data is included. The description is normalised before sending, which strips store numbers, phone numbers, card masks, dates, and location information. Results are cached globally, meaning each unique merchant description is sent to the AI service at most once across all users. The AI provider cannot associate any description with a specific user or transaction.

b. Helpdesk Chatbot

The in-app helpdesk chatbot is powered by an AI assistant. Your messages are processed to generate responses. The chatbot does not have access to your Endute account data, financial information, transactions, or balances. A notice is displayed in the chat interface informing you that you are interacting with an AI assistant.

10. Data Retention

Account Deletion

You can request account deletion via email. Upon request:

• A 72-hour grace period applies, during which you can cancel the deletion
• After the grace period, your personal data is permanently deleted: username, email, display name, password, MFA data, payment processor references, referral data, helpdesk conversations, and open banking consent records
• Financial records (transactions, budgets, goals) are anonymised - the user association is removed, preserving accounting integrity without retaining personal data
• Open banking consents are revoked with all connected providers
• Your subscription is cancelled

This process runs automatically on a daily schedule.

11. Your Data Protection Rights

Under the UK GDPR, you have the following rights. To exercise any of these rights, contact us at privacy@endute.com. We will respond within one month.

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate or incomplete data. You can update most information directly in the app.
• Right to erasure: Request deletion of your data. Account deletion is available in-app with automated processing (see Section 10).
• Right to restrict processing: Request that we limit how we use your data. You can disconnect bank accounts at any time to stop ongoing data collection.
• Right to data portability: Request your data in a machine-readable format. Data export features are available in the app.
• Right to object: Object to processing based on legitimate interest or for direct marketing.
• Right to withdraw consent: Withdraw consent at any time. For open banking, disconnect your bank connection. For cookies, use the consent management tool on endute.com.
• Automated decision-making: Endute does not make automated decisions that produce legal effects or similarly significantly affect you.

12. Cookies and Similar Technologies

a. Endute Application (app.endute.com)

• Strictly necessary cookies for session management, authentication, security protections, and MFA trusted device management. These are essential for the application to function and do not require consent.
• Bot protection on the login page, which may set cookies as part of its detection process.
• No marketing or advertising cookies are used in the application.

b. Marketing Site (endute.com)

• A cookie consent tool manages your preferences. You are presented with a consent banner on your first visit.
• If you accept analytics cookies, website analytics are activated and collect page views, referral sources, and device information.
• If you decline analytics cookies, no analytics tracking occurs and no analytics cookies are set.
• No marketing or advertising cookies are used on the marketing site.

13. Data Security

We implement technical and organisational measures to protect your personal data, including:

• Encryption of all data in transit (TLS 1.2+)
• Full-disk encryption on our production servers
• Encryption of sensitive fields using industry-standard symmetric encryption
• Token-based authentication with short-lived tokens, automatic rotation, and multi-factor authentication
• Database and cache services isolated from the public internet
• Key-only server access with intrusion detection
• Firewall with deny-by-default policy
• Daily automated database backups with periodic restoration testing
• Continuous code vulnerability monitoring
• All service credentials stored in an encrypted vault

While we implement robust security measures, no method of electronic storage or transmission is 100% secure, and we cannot guarantee absolute security.

14. Children’s Data

Endute is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a child under 18 has provided us with personal data, we will delete it. If you believe we may have data from a child under 18, please contact us.

15. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, services, legal requirements, or for other operational reasons. If we make material changes, we will notify you by email and/or by a prominent notice within the Endute application. We encourage you to review this page periodically.

16. Contact Us

If you have questions, concerns, or complaints about this Privacy Policy or our data handling practices, or if you wish to exercise your data protection rights, please contact us:

Email: privacy@endute.com

Company: Elision Ltd (No. 16544567), trading as Endute

Registered address: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom

ICO registration: ZC005147