Privacy Policy

Last updated: August 18, 2026

1. Who the controller is

Killion Labs Ltd ("Killion", "we", "our", or "us") is the data controller of personal data processed under this Privacy Policy. We are a private limited company registered in England and Wales under company number 16905669. Our registered office is 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

This policy explains how we collect, use, share, and protect personal data when you visit the public website, create an account, or use the personal finance planning service (the "Service"). It should be read with our Terms of Service and Cookie Policy.

If you do not agree with this policy, please do not use the Service. Using the Service after this policy is posted means we will process personal data as described here. Where we rely on consent (including Google Analytics cookies), we will not start that processing until you accept.

2. Information we collect

2.1 Information you provide

  • Account information: email address, password (stored as a hash by our auth provider), and sign-in events.
  • Profile information: name, display name, and optional profile details you choose to add.
  • Financial data you enter: income, expenses, savings, investments, debts, goals, tax assumptions you type in, and simulation settings.
  • Linked-account data you authorise: read-only positions, balances, and transaction history from brokerages or banks you connect through our linking providers.
  • Payment information: billing email and subscription state. Card details are processed by Stripe and are not stored on our servers.
  • Support and contact: messages you send through the contact form or email, including any attachments you choose to include.

2.2 Information collected automatically

  • Usage data: features used, pages viewed, and approximate time spent, so we can operate and improve the Service.
  • Device and log data: browser type, operating system, language, IP address, access times, and referring URL. Hosting logs are used for security and reliability.
  • Website measurement: if you accept analytics cookies, Google Analytics records page-level website data (path, title, referrer, coarse device and geography). This is for the website only. See the Cookie Policy.

2.3 Information from third parties

  • Stripe: payment status, last four digits or wallet type as Stripe exposes them to us, invoice and subscription events.
  • SnapTrade: read-only brokerage positions, balances, and transactions you connect.
  • Teller: read-only bank balances and transactions when bank linking is enabled.
  • Sign-in providers: if you use a social or SSO sign-in, the provider shares the account identifiers you authorise (typically email and name).
  • Cloudflare: request metadata used to host, cache, and protect the site. Optional Cloudflare Web Analytics is cookieless traffic measurement operated by our host.
  • Google Analytics: after consent, aggregated and identifier-level website measurement as described in section 5 and the Cookie Policy.

3. Why we use personal data

We use the information we collect to:

  • Provide, maintain, secure, and improve the Service
  • Create your account and keep you signed in
  • Generate the projections, backtests, and insights you request
  • Process subscriptions, invoices, refunds, and related notices
  • Send service, security, and support messages
  • Respond to questions and exercise or defend legal claims
  • Measure how the public website is used (Google Analytics, after you accept) so we can see which pages help people
  • Detect, investigate, and prevent fraud, abuse, and security incidents
  • Comply with law, including tax and accounting rules

We do not use financial-account or transaction data to advertise. We do not build an advertising profile of you. We do not make solely automated decisions that produce legal or similarly significant effects about you.

4. Legal bases

Where UK GDPR or EU GDPR applies, we process personal data on these legal bases:

  • Contract (Article 6(1)(b)): creating an account, providing the planning tools, processing a subscription, and support you ask for.
  • Legitimate interests (Article 6(1)(f)): securing the Service, preventing abuse, understanding product reliability, and operating hosting logs. You may object as described in section 11.
  • Consent (Article 6(1)(a) and UK PECR): Google Analytics cookies and any optional marketing email you opt into. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
  • Legal obligation (Article 6(1)(c)): tax, accounting, and responding to a binding request from a court or regulator.

5. Who we share data with (processors and recipients)

We do not sell your personal information. We do not sell any of your financial data. We share personal data only with the processors and recipients needed to run the Service:

  • Supabase: authentication and database hosting, with row-level security.
  • Stripe: payment processing. Card numbers never sit on our servers.
  • Cloudflare: hosting, content delivery, security, and optional cookieless Web Analytics.
  • xAI: optional AI features. Queries are processed to answer you; we do not send your data to xAI so that it can sell it, and we do not use those features to feed Google Analytics.
  • SnapTrade: read-only brokerage linking.
  • Teller: read-only bank linking when that product is enabled.
  • Google Analytics (Google LLC): website measurement only, and only after you accept cookies. Google does not receive financial-account or transaction payloads from us. Google explains how it uses information from sites or apps that use its services at https://policies.google.com/technologies/partner-sites.

We may also share data if the law requires it; to protect the rights, property, or safety of Killion Labs, our users, or others; or in connection with a merger, acquisition, or sale of assets, in which case this policy will still apply until you are told otherwise. We may share data with your consent.

These processors have their own privacy policies. We require them, by contract, to process personal data only on our instructions and to keep it secure.

6. Sale and sharing stance

We do not sell any of your financial data. We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising. Google Analytics is a processor we use for the website only; it is not a sale of financial data and it is not an ads product on this site. We do not enable Google Ads, remarketing, or Google Analytics advertising features.

If a US state privacy law defines "sell" or "share" more broadly, our position is the same: we do not sell or share personal information as those laws use those words, and we do not sell financial data.

7. Cookies and similar technologies

We use cookies and similar technologies as described in our dedicated Cookie Policy. In short:

  • What they are: small files or storage entries on your device.
  • First-party versus third-party: we set necessary first-party cookies and storage; Google Analytics sets third-party analytics cookies only after you accept.
  • Necessary versus analytics: necessary cookies run the site and the sign-in session; analytics cookies measure the public website and are optional.
  • How to manage them: use the cookie-choice control (Accept analytics or Reject), change the choice later via Cookie settings, or use your browser controls.

Because Analytics cookies are not strictly necessary, you will see a cookie-choice control. We do not set Google Analytics cookies until you accept, and you can withdraw acceptance.

8. Retention

We keep personal data only as long as we need it for the purposes above:

  • Account and financial data you store in the Service: for as long as the account is active. When you delete the account we delete or irreversibly anonymise this data, except where a legal hold applies.
  • Billing records: typically up to 7 years, so we can meet tax and accounting duties.
  • Security and hosting logs: typically up to 90 days, unless we are investigating an incident.
  • Google Analytics: not more than 14 months of website-measurement events, unless a longer legal hold is required.
  • Cookie consent records: for as long as needed to show what you chose.

9. Security

We use organisational and technical measures appropriate to the risk:

  • Encryption in transit (TLS) and encryption at rest
  • Supabase row-level security so one account cannot read another
  • Read-only scopes for linked brokerages and banks — we cannot move money
  • We never store brokerage or bank passwords
  • Payment cards are handled by Stripe, not by our database
  • Access to production systems is limited and logged

No method of transmission or storage is 100% secure. We cannot guarantee absolute security. If you believe an account has been compromised, contact us immediately.

10. International transfers

We are established in the United Kingdom. Some processors (including Google, Stripe, Supabase, SnapTrade, and Teller) may process personal data in the United States or other countries. Those countries may have different data-protection laws than your own.

Where a transfer mechanism is required we use one or more of: an adequacy decision recognised under UK or EU law; the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum; and the processor's own transfer terms. We take steps to keep transferred data protected in line with this policy.

11. Your rights and how to exercise them

If UK GDPR or EU GDPR applies, you have the right to:

  • Access a copy of your personal data
  • Rectification of inaccurate data
  • Erasure ("right to be forgotten") in the cases the law allows
  • Restriction of processing
  • Data portability of data you provided, in a machine-readable format
  • Object to processing based on legitimate interests
  • Withdraw consent where processing is based on consent, including Analytics cookies
  • Complain to a supervisory authority (see section 14)

To exercise these rights, use the contact form or email privacy at killionlabs.com. You can also delete your account from profile settings, which deletes stored financial data and cancels an active subscription in the same operation. We will respond within one month (30 days), or tell you if we need more time as the law allows.

We may need to verify your identity before fulfilling a request. We will not discriminate against you for exercising these rights.

12. Children's privacy

The Service is not intended for anyone under 18. We do not knowingly collect personal information from children. If you are a parent or guardian and believe a child has provided personal information, contact us and we will delete it.

13. How this policy changes

We may update this Privacy Policy from time to time. We will post the new policy on this page and update the "Last updated" date. For a material change we will also give a more prominent notice (for example, an email to the account address or a notice in the Service). The updated policy applies from the date it is posted, except that a new use that needs consent will wait for that consent.

14. Contact, privacy, DPO, and the ICO

Killion Labs Ltd
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
Privacy: privacy at killionlabs.com
Data Protection Officer: dpo at killionlabs.com
Or use our contact form.

If you are in the UK, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe your data protection rights have been violated.

If you are in the European Economic Area, you have the same right with the supervisory authority in your country of residence, place of work, or where you believe the issue occurred.