Privacy notice

Holdwell is operated by GaimControl Ltd, a UK company. We are the data controller for everything you do inside Holdwell.

• We collect what we need to run a regulated UK current account, plus the CBT-coaching data Anna needs to support you.
• We never sell your data. We do not run advertising.
• Anna chats are private. Sponsors never see them.
• You can download a full machine-readable copy of your data at any time. You can ask us to erase your account once you are at £0 outstanding.
• We are FCA-regulated, ICO-registered, and SOC 2 aligned across our vendor stack.

Account data — name, address, date of birth, email, phone number, national identifier (for KYC), and the contents of your photo ID. Required to open a regulated current account.

Banking data — your card transactions, balance, direct debits, and any open-banking feeds you choose to link. Required to run the account.

Recovery data — your Holdwell profile, streak count, blocked-MCC events, Anna chat messages, sponsor invites, and any Relapse Hold events.

Device + analytics data — IP address, device fingerprint, app version, and anonymised usage events used to debug + improve the product. We do not pair these with your identity for analytics.

Under UK GDPR we rely on four lawful bases, depending on the data:

• Contract for everything needed to operate your account.
• Legal obligation for AML / KYC / FCA reporting.
• Legitimate interest for fraud prevention, product analytics, and sponsor onboarding (with consent for the sponsor side).
• Consent for marketing email, push notifications, and optional feature trials. You can withdraw consent at any time.

We only share data with vendors we contract with under UK GDPR Article 28 data processing agreements. Every vendor below is SOC 2 compliant.

• Algbra — card issuing and core banking.
• TrueLayer — open banking aggregation (read-only).
• Vouchsafe — ID verification.
• Experian — affordability checks at loan time only.
• Resend — transactional email.
• Twilio — SMS for OTP and crisis-line referrals.
• Inngest — event-driven background jobs.
• AWS, Vercel, Render, Neon — infrastructure hosting (UK + EU data residency).

We disclose to the police, the FCA, or HMRC only when legally required.

You can ask us to:

• Show you everything we hold (Subject Access Request, Article 15).
• Export it in a machine-readable form (Article 20). Available in-app via Profile → Download my data.
• Correct anything that is wrong (Article 16).
• Erase your account (Article 17). Requires £0 outstanding and triggers a profile-scaled cool-off.
• Object to processing or restrict it (Articles 18, 21).
• Complain to the Information Commissioner's Office at ico.org.uk if we get it wrong.

Email privacy@holdwell.app for any of the above. We aim to respond within 14 days; the legal limit is 30.

FCA rules require us to retain account, KYC, and transaction records for seven years after the account closes. Anna chats, streak data, and analytics are kept only while your account is active, plus a 90-day post-closure window in case you rejoin.

GaimControl Ltd · United Kingdom · privacy@holdwell.app · ICO registration: pending.