Privacy Policy

1. About Cherpa and who we are

Cherpa is an educational, non-regulated money tool. We do not provide FCA-regulated financial advice and we do not recommend or sell financial products. Cherpa gives you information to make your own decisions.

Cherpa is provided by Cherpa.AI Ltd (“Cherpa”, “we”, “us”, “our”), a company registered in Scotland, company number SC852497, registered office 6 Bainfield Drive, c/o Bright Red Triangle, Edinburgh EH11 1AR.

We are the data controller for the personal information you give us. We are registered with the Information Commissioner’s Office (ICO) under number ZC025275 and we follow UK data protection law.

Questions about your data? Email us at hello@cherpa.ai.

2. What this policy covers

This policy covers how we handle your information when you:

• visit our website or join our early access list,

• take part in surveys, interviews or research sessions, or

• use the Cherpa app.

It tells you what we collect, how we use it, how long we keep it, and what rights you have.

3. What we collect

On the website and in research:

• Contact details: name and email so we can reach you.

• Survey, interview or research responses: your views and feedback about Cherpa or money topics.

• Research notes or recordings: only if you agree, used for internal analysis to improve the product.

In the Cherpa app:

• Profile details from onboarding: first name, age band, gender, UK country, employment, relationship status and housing status. Only your first name is required.

• What you tell Cherpa: anything you type or say to Cherpa. This can include details about your life and money, such as income, benefits, debts, family and work. Some of this can be sensitive, for example references to health or relationships.

• Information Cherpa remembers: facts Cherpa saves so it can help you over time, such as your situation and a summary of past conversations.

• Basic technical data: device type, app version and anonymous usage data that helps us fix problems.

We do not collect your bank login or connect to your bank accounts.

4. Voice data

If you talk to Cherpa instead of typing, here is what happens to your audio.

• Your voice is turned into text. your speech is recorded on your device and sent securely to our server, which passes it to a trusted transcription service to turn it into text.

• We do not keep recordings. we delete the audio from our server the moment it has been transcribed, typically within one second. We never save voice recordings to any database.

• Our provider’s short-term hold: our transcription provider may hold the audio and text for a short period (up to 30 days) for security and abuse monitoring, then deletes it. They do not use it to train their systems.

• Cherpa’s spoken replies are not stored. when Cherpa speaks back to you, the audio is streamed to your device, played, then deleted. It is not stored.

5. How we use your information and our legal basis

Under UK data protection law we must have a lawful reason for using your information.

• Website and early access: we send updates and early access news where you have asked us to. Legal basis: consent.

• Surveys and research: we use feedback to understand users and improve Cherpa. Legal basis: legitimate interest.

• Helping you and remembering you: in the app, we read your messages to give accurate answers, and Cherpa remembers your situation to keep helping you. This is core to how the app works. Legal basis: performance of our contract with you.

• Nudges and follow-ups: where you have asked us to, we send reminders, check-ins and useful prompts. Legal basis: consent. You can turn this off anytime.

• Running the service: we use anonymous usage data to keep Cherpa working and safe. Legal basis: legitimate interest.

Because some of what you tell Cherpa can be sensitive (special category data, such as health), we rely on your explicit consent to process it. You give this when you start using the app, and you can withdraw it at any time.

We never sell your information and never use it for advertising.

6. How Cherpa uses AI

The Cherpa app uses artificial intelligence to understand your questions and write answers.

The words you send are processed by trusted AI providers that supply the underlying language technology.

• We have contracts in place that stop these providers from using your data to train their systems.

• These providers may hold your data briefly (up to 30 days) for security and abuse monitoring, then delete it.

• Before your messages are used for our own internal quality checks, we remove details that could identify you.

• Cherpa’s answers are grounded in verified, published sources. Cherpa gives you information, not regulated financial advice.

7. Who we share your information with

We do not sell your data and do not share it for advertising. We only use trusted service providers who help us run Cherpa, and only as much as they need.

• Website and research: for example tools that send our emails or run surveys.

• The app: the AI providers that power Cherpa’s answers, the service that transcribes voice, and secure cloud services that store your information.

• Where you reach Cherpa through a partner: if you use Cherpa through your employer or a financial institution, your information is kept separate from other organisations’ users and is not shared back with them in a way that identifies you, unless we have told you otherwise.

• Legal requests: if the law requires it.

Every provider we use is bound by a contract requiring them to protect your information and use it only for the purpose we agreed.

8. Sending data outside the UK

Most of your information stays in the UK or Europe. Our app servers run in the UK and our databases run in Europe. Some processing, such as voice transcription and AI responses, happens with providers in the United States. When data leaves the UK, it is protected by safeguards approved under UK data protection law, such as standard contractual clauses set out in our providers’ data processing agreements.

9. How long we keep it

• Voice recordings: never stored. Deleted within about one second of being transcribed.

• Early access sign-ups: until you unsubscribe, or up to 12 months after launch, whichever comes first.

• Survey and interview data: kept for up to 12 months after analysis, then anonymised or deleted.

• App profile and conversations: kept while your account is active. Deleted within 30 days of you deleting your account.

• System logs: technical logs that help us run and debug the service are deleted on a rolling 30-day cycle.

• Internal quality logs: kept for up to 90 days for quality and safety checks, with identifying details removed.

10. How we keep your information safe

Protecting your information matters to us. We use measures including:

• Encryption: your information is encrypted when stored and when sent over the internet.

• Strict access controls: only authorised people can access systems, limited to what each person needs.

• Separation of identity from content: we keep what identifies you separate from the content of your conversations.

• Ongoing monitoring: we monitor our systems and review our security regularly.

No system can be guaranteed perfectly secure, but we take this responsibility seriously and work continuously to protect your data.

11. Your rights

You have the right to see the data we hold about you, correct it, delete it, withdraw your consent at any time (including turning off nudges), ask us to limit how we use it or object to certain uses, and ask for a copy to take elsewhere.

You can do most of this directly in the app. Or email hello@cherpa.ai with “Data Request” in the subject line. We will respond within one month.

12. Cookies

Our website uses only essential cookies to keep the site secure and working properly. We do not use analytics or tracking cookies at this stage. You can control cookies in your browser settings anytime.

13. Children

Cherpa is for adults. You must confirm you are 18 or over to sign up to the app. Cherpa is not intended for anyone under 18, and we do not knowingly collect information from children.

14. Accessibility

We are building Cherpa to be inclusive, aiming to meet WCAG 2.1 AA standards, with clear language, accessible colours and voice-first design. Email hello@cherpa.ai with “Accessibility Feedback” if you spot anything we can improve.

15. Changes to this policy

We may update this policy as Cherpa evolves. The latest version will always be on our website, with the version and date at the top. We will tell you if anything important changes.

16. Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right.

You also have the right to complain to the ICO at ico.org.uk or by calling 0303 123 1113.