Privacy Policy

1. About Cherpa and who we are

Cherpa is an educational, non regulated money tool. We do not provide FCA regulated financial advice and we do not recommend or sell financial products. Cherpa gives you information to make your own decisions.

Cherpa is provided by Cherpa.AI Ltd (“Cherpa”, “we”, “us”, “our”), a company registered in Scotland, company number SC852497, registered office 6 Bainfield Drive, c/o Bright RedTriangle, Edinburgh EH11 1AR.

We are the data controller for the personal information you give us. We are registered with the Information Commissioner’s Office (ICO) under number ZC025275 and we follow UK data protection law.

Questions about your data? Email us at hello@cherpa.ai.

2. What this policy covers

This policy covers how we handle your information when you:

• visit our website, subscribe to our newsletter or download the app,

• take part in surveys, interviews or research sessions, or

• use the Cherpa app.

It tells you what we collect, how we use it, how long we keep it, and what rights you have.

3. What we collect

On the website and in research:

• Contact details: name and email so we can reach you.

• Survey, interview or research responses: your views and feedback about Cherpa or money topics.

• Research notes or recordings: only if you agree, used for internal analysis to improve the product.

In the Cherpa app:

• Profile details from onboarding: first name, age band, gender, UK country, employment, relationship status and housing status. Only your first name is required.

• What you tell Cherpa: anything you type or say to Cherpa. This can include details about your life and money, such as income, benefits, debts, family and work. Some of this can be sensitive, for example references to health or relationships.

• Information Cherpa remembers: facts Cherpa saves so it can help you over time, such as your situation and a summary of past conversations.

• Subscription details: your subscription status and history, so we know your access is active. See section 5.

• Basic technical data: device type, app version and anonymous usage data that helps us fix problems.

We do not collect your bank login and we do not connect to your bank accounts.

4. Voice data

If you talk to Cherpa instead of typing, here is what happens to your audio.

• Your voice is turned into text. Your speech is recorded on your device and sent securely to our server, which passes it to our transcription provider (OpenAI) to turn it into text.

• We do not keep recordings. We delete the audio from our server the moment it has been transcribed, typically within one second. The audio is never written to any database, cache or log. We never save voice recordings.

• Our provider’s short term hold: our transcription provider may hold the audio and text for a short period (up to 30 days) for security and abuse monitoring, then deletes it. They do not use it to train their systems.

• Cherpa’s spoken replies are not stored. When Cherpa speaks back to you, the audio is streamed to your device, played, then deleted. It is not stored.

5. Payments and subscriptions

Cherpa is a paid app. You subscribe through the Apple App Store or Google Play.

• We do not see your card details. Apple and Google take your payment and handle your card information under their own privacy policies. We never receive or store your full card number.

• We store your subscription status. We keep a record of whether your subscription is active, so you can use the app. This is part of our contract with you.

Apple and Google act as separate data controllers for the payment itself. Please see their privacy policies for how they handle your payment information.

6. How we use your information and our legal basis

Under UK data protection law we must have a lawful reason for using your information.

• Website and newsletter: we send updates and news where you have asked us to. Legal basis: consent.

• Surveys and research: we use feedback to understand users and improve Cherpa. Legal basis: legitimate interest.

• Helping you and remembering you: in the app, we read your messages to give accurate answers, and Cherpa remembers your situation to keep helping you. This is core to how the app works. Legal basis: performance of our contract with you.

• Running your subscription: we keep your subscription status so you can access the app. Legal basis: performance of our contract with you.

• Nudges and follow ups: where you have asked us to, we send reminders, check ins and useful prompts. Legal basis: consent. You can turn this off anytime.

• Running the service: we use anonymous usage data to keep Cherpa working and safe. Legal basis: legitimate interest.

Because some of what you tell Cherpa can be sensitive (special category data, such as health), we rely on your explicit consent to process it. You give this when you start using the app, and you can withdraw it at any time.

We never sell your information and never use it for advertising.

7. How Cherpa uses AI

The Cherpa app uses artificial intelligence to understand your questions and write answers. The words you send are processed by trusted AI providers that supply the underlying language technology. We name these providers in section 8.

When you first use the app, we tell you which AI providers will process your messages and ask for your consent before any data is sent.

• We have contracts in place that stop these providers from using your data to train their systems.

• These providers may hold your data briefly (up to 30 days) for security and abuse monitoring, then delete it.

• Before your messages are used for our own internal quality checks, we automatically mask details that could identify you. See section 12.

• Cherpa’s answers are grounded in verified, published sources. Cherpa gives youinformation, not regulated financial advice.

Cherpa does not make automated decisions about you that have a legal or similar effect. It gives you information so you can decide for yourself.

8. The AI and other providers we use

We only use trusted providers, and only for what they need to do. Each one is bound by a contract that protects your information, limits it to the purpose we agreed, and stops them using it to train their own systems.

We update this list as our providers change. The latest version is always in this policy.

9. Who we share your information with

We do not sell your data and do not share it for advertising. We only use the trusted providers above, and share only what they need.

• Where you reach Cherpa through a partner: if you use Cherpa through your employer or a financial institution, your information is kept separate from other organisations’ users and is not shared back with them in a way that identifies you, unless we have told you otherwise.

• Legal requests: if the law requires it.

  
  

Every provider we use is bound by a contract requiring them to protect your information and use it only for the purpose we agreed.

10. Sending data outside the UK

Most of your information stays in the UK or Europe. Our app servers run in the UK and our databases run in Europe. Some processing, such as turning your voice into text and generating Cherpa’s answers, happens with providers in the United States.

When your data goes to the US, it is protected by safeguards approved under UK data protection law.

Depending on the provider, this is either the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework) where the provider is certified, or the UK International Data Transfer Agreement or Addendum built into our contracts with them.

11. How long we keep it

• Voice recordings: never stored. Deleted within about one second of being transcribed.

• Newsletter sign ups: until you unsubscribe.

• Survey and interview data: kept for up to 12 months after analysis, then anonymised or deleted.

• App profile and conversations: kept while your account is active. Deleted as soon asyou delete your account, with any copies in backups removed within 30 days.

• Billing and subscription records: we keep these for as long as the law requires, usually about 6 years, for tax and accounting. We do not keep your card details, only a record of your payments and your subscription status.

• System logs: technical logs that help us run and debug the service are deleted on a rolling 30 day cycle.

• Internal quality logs: kept for up to 30 days for quality and safety checks, with identifying details masked.

  
  

12. How we keep your information safe

Protecting your information matters to us. We use measures including:

• Encryption: your information is encrypted when stored and when sent over the internet.

• Strict access controls: only authorised people can access systems, limited to what each person needs.

• Automatic masking: before we store conversation logs for quality and safety checks, we automatically mask personal identifiers such as your name, email, phone number, National Insurance number, bank details, postcode and amounts of money.

• Separation of identity from content: we keep what identifies you separate from the content of your conversations.

• Ongoing monitoring: we monitor our systems and review our security regularly.

  
  

No system can be guaranteed perfectly secure, but we take this responsibility seriously and work continuously to protect your data.

13. Your rights

You have the right to see the data we hold about you, correct it, delete it, withdraw your consent at any time (including turning off nudges), ask us to limit how we use it or object to certain uses, and ask for a copy to take elsewhere.

You can do most of this directly in the app. Or email hello@cherpa.ai with “Data Request” in the subject line. We will respond within one month.

14. Cookies

Our website uses only essential cookies to keep the site secure and working properly. We do not use analytics or tracking cookies at this stage. You can control cookies in your browser settings anytime.

15. Children

Cherpa is for adults. You must confirm you are 18 or over to sign up to the app. Cherpa is not intended for anyone under 18, and we do not knowingly collect information from children.

16. Accessibility

We are building Cherpa to be inclusive, aiming to meet WCAG 2.1 AA standards, with clear language, accessible colours and voice first design. Email hello@cherpa.ai with “Accessibility Feedback” if you spot anything we can improve.

17. Changes to this policy

We may update this policy as Cherpa evolves. The latest version will always be on our website, with the version and date at the top. We will tell you if anything important changes.

18. Complaints

If you are unhappy with how we handle your data, please tell us first so we can put it right. You also have the right to complain to the ICO at ico.org.uk or by calling 0303 123 1113.