Privacy Policy

Who this policy is for

This policy explains how Affordit handles personal information when someone visits the website, creates an account, uses a planning tool, saves or shares a plan, contacts support, uses an institution-provided access route or manages a subscription.

Affordit is a product of ElenIQ Ltd. The final approved policy will identify the relevant legal entity, registered details and privacy contact before it becomes effective.

Information we process

Affordit provides financial planning and decision-support tools. We process information users provide to create an account, complete a planner, save a plan, contact support or manage access. This may include a name, email address, age or age band, income, regular costs, savings, debts, contribution amounts, goals and timeframe.

Depending on the journey, we may also process saved plans, plan updates, shared-plan records, support communications, subscription records and choices made within the service.

We also process limited technical and usage information needed to operate, secure and improve the service. The final data inventory will identify the exact fields, sources and systems used by the live product.

How information is used

We use personal information to provide the service, save and retrieve plans, calculate outputs, explain results, prevent fraud and misuse, provide support, manage access, understand product performance and comply with law.

Affordit does not sell personal information.

Legal reasons for processing

The lawful basis depends on the purpose. It may include performing a contract with the user, pursuing legitimate interests in operating and securing the service, meeting a legal obligation, or consent for particular optional technologies or communications.

Consent is not treated as the default basis for every activity. The approved privacy notice and internal lawful-basis register must match the live product before this draft is published.

Education partners

Institutions that provide Affordit to learners receive aggregated engagement reporting by default. They do not receive a named learner’s salary, debts, savings, rent, affordability verdict or saved plan unless a separate lawful, transparent and expressly agreed arrangement exists.

Aggregate reporting may cover measures such as invitations, activations, planner starts, completions, return rates and broad goal categories. Minimum-group and disclosure controls should be used so reports measure engagement rather than expose an individual learner.

Service providers and international transfers

Affordit uses service providers for functions such as hosting, authentication, email, analytics, payments, monitoring and, where applicable, automated explanations. A confirmed subprocessor list will be maintained in the Trust Centre.

The final subprocessor register will identify material providers, service purposes, relevant data categories, processing locations and transfer safeguards. It will not be approved until the live architecture and supplier terms have been checked.

How long information is kept

Information is retained only for as long as needed for its stated purpose, legal obligations, security and dispute handling. Retention is purpose-based rather than indefinite.

Exact periods for accounts, plans, support records, analytics, payments, security logs and backups must be confirmed in the approved retention schedule before publication.

Your choices and rights

Users can request access, correction, deletion, restriction, objection and portability where applicable. They can also ask for an explanation of an automated output or report an output that appears unexpected or harmful.

Account deletion removes or de-identifies live personal information, triggers relevant service-provider actions and preserves only limited information where law, security or dispute handling requires it. Backup copies expire through their documented rolling schedule.

Requests can be made through the privacy actions on the Trust Centre or the monitored support route. Affordit may need to verify identity before acting so information is not disclosed or deleted for the wrong person.

Shared plans and recipient copies

A shared-plan link exposes the plan snapshot associated with that link to anyone who can access it. Users should avoid placing unnecessary personal information in a plan name or other shared content and should share links only with intended recipients.

A recipient who saves the shared plan creates an independent copy under their own account. They do not receive access to the owner’s account, and later changes to the copy do not alter the owner’s original plan.

Marketing choices and complaints

Optional marketing communications should provide a clear way to opt out. Service messages needed for security, account operation, billing or a requested transaction may still be sent where appropriate.

A privacy concern can be raised through the monitored support route. The approved policy will identify the supervisory authority and escalation rights that apply after legal review.