forecastly — Cash flow forecasting for solopreneurs

1. INTRODUCTION This privacy notice tells you how we collect and process your personal data when you use forecastly.me (the cashflow forecasting software) or our website at profitmind.co.uk. forecastly.me is a trading name of ProfitMIND Ltd. By using the software, you confirm you are over 18 years of age and entering into the agreement on behalf of yourself or your business. "ProfitMIND Ltd" is the data controller and is responsible for your personal data (referred to as "we", "us" or "our" in this notice). CONTACT DETAILS Legal entity: ProfitMIND Ltd Trading as: forecastly.me Postal address: 4 Cranes Farm Road, Basildon, Essex SS14 3JJ, United Kingdom Email: hello@profitmind.co.uk It is important that the information we hold about you is accurate and current. Please update us by email or in your account settings if anything changes. 2. WHAT DATA WE COLLECT, WHY, AND ON WHAT LAWFUL BASIS Personal data means any information that identifies an individual. We may process the following categories about you: ACCOUNT DATA — your name, email address, password (stored only as a one-way bcrypt hash — we never see it), business name, and chosen pricing plan. Purpose: to create and run your account. Lawful basis: performance of a contract. FINANCIAL DATA YOU ENTER — your business income, costs, opening cash, personal pay, monthly actuals, goals, and any notes you choose to add. This is YOUR business data; we treat it as confidential. Purpose: to compute your forecast, variance and AI insights, and to display them back to you. Lawful basis: performance of a contract. PAYMENT DATA — handled by Stripe (our payment processor). We receive only the limited transaction metadata Stripe shares with us (customer id, plan id, payment status, last 4 digits of card if applicable). We do NOT store your card number. Purpose: to take payment and reconcile your subscription. Lawful basis: performance of a contract. COMMUNICATION DATA — any emails or replies you send us, the contents of contact-form submissions, and our responses. Purpose: customer support, record-keeping, and to establish, pursue or defend legal claims. Lawful basis: our legitimate interest in operating the business. TECHNICAL DATA — your IP address, browser type, the pages you visit on our site, time-zone settings and similar device data. We do not currently run analytics on the forecastly.me application itself; basic technical logs are kept by our hosting provider for security and abuse-prevention. Purpose: to keep the service running and secure. Lawful basis: our legitimate interest. MARKETING DATA — if you have opted in via the website or by becoming a customer, we may keep your email address in our MailerLite list to send you product updates and occasional helpful content. You can unsubscribe with one click in any email. Lawful basis: consent (for marketing-only opt-ins) or our legitimate interest (for product updates to existing customers). SENSITIVE DATA — we do NOT collect or process any sensitive personal data (race, ethnicity, religion, sexual orientation, political opinions, health, biometric data or criminal records). AUTOMATED DECISION MAKING — we use AI (Anthropic's Claude model via Emergent Integrations) to generate narrative insights from your forecast and actuals. These insights are suggestions; they do not produce any legal or financial decision that meaningfully affects you. You always remain in control. 3. HOW WE COLLECT YOUR DATA DIRECTLY FROM YOU — when you sign up, fill out your onboarding wizard, enter actuals, set goals, or contact us by email or the in-app contact form. AUTOMATICALLY — basic technical data (IP, browser) when you load the site, and authentication cookies set when you log in (see our Cookie Policy). FROM THIRD PARTIES we use to run the service: • Stripe (payments) — transaction metadata when you pay or subscribe. • MailerLite (marketing emails) — subscription status and engagement data if you receive our emails. • Resend (transactional emails) — delivery status for emails we send you. 4. MARKETING COMMUNICATIONS We will only send you marketing emails if you have explicitly opted in OR you are an existing customer and we have a legitimate interest in keeping you informed about product changes (under the Privacy and Electronic Communications Regulations). You can unsubscribe at any time using the link in every email, or by emailing hello@profitmind.co.uk. Opting out of marketing does NOT affect transactional emails (password resets, payment receipts, account-deletion confirmations, monthly nudges to log your actuals). We do not share your personal data with third parties for their own marketing purposes without your express consent. 5. WHO WE SHARE YOUR DATA WITH We share your data with the following categories of service provider, strictly for the purpose of running the service: • Stripe (Stripe Payments Europe Ltd) — payment processing. • MailerLite (UAB MailerLite, Lithuania / MailerLite Inc., US) — marketing email delivery. • Resend (Resend.com Inc., US) — transactional email delivery. • Anthropic (via Emergent Integrations) — AI insight generation. Only the relevant numbers (forecast headlines, this month's actuals, and your goals) are sent at the moment of generation. No personal account identifiers are shared. • MongoDB Atlas — encrypted database hosting (EU region). • Emergent — application hosting infrastructure. • Our professional advisers (accountants, lawyers, insurers) when strictly necessary. • Government bodies where we are required by law to disclose data. Each of these providers is bound by contract and by data protection law to keep your data secure and use it only for the purposes we instruct. We may also share your data if we sell, transfer or merge parts of our business or our assets. We will require any acquirer to honour this privacy notice. 6. INTERNATIONAL TRANSFERS Some of our service providers are located outside the UK (notably Anthropic, MailerLite Inc. and Resend in the US). We rely on the UK government's adequacy regulations, UK-approved Standard Contractual Clauses and the UK-US Data Bridge to ensure your data has equivalent legal protection wherever it is processed. 7. DATA SECURITY We have implemented technical and organisational measures to protect your data — including bcrypt password hashing, HTTPS everywhere, encrypted database connections, access controls limited to authorised personnel, and a documented incident response procedure. We will notify you and the ICO of any personal data breach where we are required by law. 8. DATA RETENTION We keep your data only for as long as we need it: • Account, forecast, actuals and goals data: while your account is active. When you delete your account from inside the app, we permanently erase this data within 24 hours. • Payment records: 6 years from the last transaction, to comply with HMRC tax record-keeping rules. • Marketing list: until you unsubscribe. • Support emails: 3 years from the last response. When we no longer need your personal data we either delete it or anonymise it for research/statistics. 9. YOUR LEGAL RIGHTS Under UK GDPR you have the right to: • REQUEST ACCESS to your personal data ("subject access request"). • REQUEST CORRECTION of any data we hold that is wrong or incomplete. • REQUEST ERASURE of your data (the "right to be forgotten"). • OBJECT to processing where we rely on legitimate interests. • REQUEST RESTRICTION of processing in specific circumstances. • REQUEST PORTABILITY — receive your data in a structured, commonly used, machine-readable format. • WITHDRAW CONSENT at any time where consent is the lawful basis. You can exercise the right to portability and the right to erasure DIRECTLY from inside your account settings — go to your profile → "Export my data" or "Delete my account". For any other request, please email hello@profitmind.co.uk. We respond to all legitimate requests within one month. There is no fee unless the request is clearly unfounded, repetitive or excessive. If you are not satisfied with how we handle your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator — www.ico.org.uk. We would appreciate the chance to address the issue with you first. 10. THIRD-PARTY LINKS Our website and emails may include links to third-party websites and tools. We are not responsible for their privacy practices. When you leave our site, please read the privacy notice of every site you visit. 11. CHILDREN forecastly.me is intended for use by businesses and self-employed adults. We do not knowingly collect data about anyone under the age of 18. 12. CHANGES TO THIS NOTICE We may update this privacy notice from time to time. The "Last updated" date at the top of the page reflects the most recent change. Significant changes will be notified to active customers by email.

Privacy Policy