Privacy Policy

1. Who We Are

The data controller is Heycube, a sole trader registered in England and Wales, trading as AjoCircle.

2. Data We Collect

Account data

When you register and complete onboarding, we collect: full name, email address, UK mobile phone number, date of birth, and residential address. This information is required to create and maintain your account.

Identity verification data

To comply with our anti-money laundering obligations, we require identity verification. This is processed by Stripe Identity, who collect and verify documents such as passports, driving licences, and identity cards on our behalf. We do not directly store copies of your identity documents. Stripe processes this data under their own privacy policy.

Payment data

All payments are processed by Stripe, Inc. We do not collect or store your card details. We receive confirmation of payment status and a Stripe customer reference. Your bank account details for payouts are stored securely by Stripe under their own terms.

Usage and activity data

We collect data about how you use the platform, including: login times, circles you create or join, contribution history, payout records, and dispute activity. This data is essential to operate the service and is stored in our audit log.

Communications

We send one-time passcodes and notifications via SMS using Twilio, Inc. Your phone number is transmitted to Twilio for this purpose. We may also send service-related emails if you provide an email address.

3. Legal Basis for Processing (UK GDPR Article 6)

We process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)) — processing your account data, contribution records, and payout information is necessary to provide the AjoCircle service.
• Legal obligation (Art. 6(1)(c)) — identity verification and transaction record-keeping are required by the Money Laundering Regulations 2017 and the Proceeds of Crime Act 2002.
• Legitimate interests (Art. 6(1)(f)) — fraud prevention, platform security, abuse detection, and improving the service.
• Consent (Art. 6(1)(a)) — marketing communications, where you have opted in during onboarding. You may withdraw consent at any time.

4. How We Use Your Data

We use your data to:

• Create and manage your account
• Verify your identity and comply with AML obligations
• Operate savings circles, process contributions, and trigger payouts
• Send service notifications, OTP codes, and contribution reminders via SMS
• Detect and prevent fraud and money laundering
• Resolve disputes between circle members
• Maintain an audit log of all platform activity for compliance
• Improve and secure the platform (legitimate interests)
• Send marketing updates where you have consented

We will not sell your personal data to third parties or use it for advertising purposes.

5. Who We Share Data With

We share personal data only with the following third parties, each acting as a data processor on our behalf under appropriate data processing agreements:

• Stripe, Inc. — payment processing, identity verification (Stripe Identity), and payout infrastructure. Stripe Privacy Policy
• Twilio, Inc. — SMS delivery for OTP codes and notifications. Twilio Privacy Policy
• Supabase, Inc. — database hosting and authentication infrastructure, running on Amazon Web Services (AWS) data centres.
• Vercel, Inc. — web hosting, content delivery, and cookieless, anonymised page-view analytics (Vercel Web Analytics — sets no cookie and uses no persistent device identifier). See our Cookie Policy.
• Law enforcement and regulatory bodies — where we are required to disclose data by law, court order, or to comply with our AML obligations (including reports to the National Crime Agency).

We do not sell personal data. We do not share personal data with advertisers, data brokers, or any unrelated third parties.

6. International Transfers

Some of our service providers process data outside the UK. Specifically:

• Supabase operates on AWS infrastructure, which may process data in the United States and other regions
• Stripe and Twilio are US-based companies
• Vercel operates globally

Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including UK-approved Standard Contractual Clauses (SCCs) or reliance on an adequacy decision, as applicable. You may request details of the safeguards by contacting legal@ajocircle.com.

7. Data Retention

We retain personal data for the following periods:

• Identity and transaction records — 5 years from the end of the business relationship, as required by the Money Laundering Regulations 2017.
• Account data — for the duration of your account plus 2 years following closure, unless a longer retention period is required by law.
• Audit logs — 5 years from the date of the activity.
• Marketing preferences — until you withdraw consent.

After the applicable retention period, data is securely deleted or anonymised.

8. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — obtain a copy of the personal data we hold about you
• Right to rectification — correct inaccurate or incomplete data
• Right to erasure — request deletion of your data where no legal basis for retention exists
• Right to restriction — request that we limit processing in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests, including direct marketing
• Rights related to automated decisions — not be subject to solely automated decisions that significantly affect you

Please note that some rights are subject to exceptions. For example, we may not be able to erase data that we are legally required to retain for AML compliance purposes.

9. Exercising Your Rights

To exercise any of your rights, please contact us at legal@ajocircle.com with your request. We will respond within 30 days. We may need to verify your identity before processing your request.

There is no charge for exercising your rights, unless requests are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.

10. Right to Complain

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.

ICO website: ico.org.uk · ICO helpline: 0303 123 1113

11. Cookies

We use cookies to maintain your authenticated session. We do not use advertising or third-party tracking cookies. For full details, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you via SMS or email before they take effect. The current version is always available at ajocircle.com/privacy.