Privacy Policy

1. Who we are

Chewy Bytes Limited is the controller of the personal data described in this notice. We are registered in England and Wales under company number 16443347, with a registered office at 71-75 Shelton Street, London, England, WC2H 9JQ. Genwel is our personal budgeting product.

Contact us about privacy at developer@chewybytes.com.

2. The data we collect

• Account data: your name, email address, profile image, authentication provider, and account identifiers.
• Open Banking data: connected bank and account details, balances, transaction dates, amounts, descriptions, merchants, and categories supplied through TrueLayer after you authorise access.
• Budgeting data: the budgets, preferences, categories, and goals you create, together with generated insights and suggestions.
• Technical data: app and browser information, approximate location derived from an IP address, diagnostics, security events, and how the service is used.
• Communications: messages and support requests you send to us.

3. Where the data comes from

We receive data directly from you, from the sign-in provider you choose, from TrueLayer and your bank when you connect an account, and from the devices and services used to access Genwel. We only request Open Banking data after you complete the bank's authorisation flow.

4. How and why we use it

• Contract: to create and secure your account, connect authorised accounts, synchronise transactions, provide budgets and insights, and deliver paid features you request.
• Legitimate interests: to keep Genwel reliable and secure, prevent misuse, diagnose faults, understand aggregate service performance, and improve the product. We balance these interests against your rights.
• Consent: for optional PostHog product analytics and any marketing communication you actively request. You can withdraw consent at any time.
• Legal obligation: to meet applicable legal, accounting, security, and regulatory requirements and respond to lawful requests.

5. AI-powered features

Genwel uses AI providers, currently Google and OpenAI, to categorise transactions and create budgeting suggestions and spending insights. Categorisation may include a transaction identifier, merchant or description, amount, and existing category. Suggestions and insights generally use aggregated spending totals, comparisons, and budgets. We do not send your bank login credentials or TrueLayer access tokens to AI models.

AI output can be incomplete or wrong. It is informational guidance, not regulated financial advice, and you remain responsible for any decision you make. Genwel does not make solely automated decisions that have legal or similarly significant effects on you.

6. Who we share data with

We use service providers only where needed to operate Genwel. These include TrueLayer for Open Banking; Neon for database hosting; Vercel for hosting and aggregate web analytics; Resend for authentication email; Apple, Google, and Facebook when you choose their sign-in service; OpenAI and Google for AI features; Sentry for diagnostics; Plausible for cookieless aggregate analytics; and PostHog for optional product analytics after consent.

Providers act under their own terms or our processing arrangements. We may also disclose data when required by law, to protect users or the service, or as part of a corporate transaction with appropriate safeguards. We do not sell your personal data.

7. International transfers

Some providers may process data outside the UK. Where required, we rely on UK adequacy regulations or contractual and organisational safeguards designed to protect transferred data. Contact us if you would like more information about the safeguards relevant to your data.

8. Retention and deletion

We keep account and financial data while your account is active and for only as long afterwards as reasonably needed to provide the service, resolve disputes, maintain security, and meet legal duties. The precise period depends on the type of record and why it is held. Backups and security logs are deleted or overwritten on their normal rotation schedule.

You can disconnect a bank account in Genwel. To request deletion of your Genwel account and associated data, email us using the address above. We may retain limited records where the law requires it.

9. Your rights

Depending on the circumstances, UK data protection law may give you rights to access, correct, erase, restrict, or receive a copy of your data, and to object to some processing. Where processing is based on consent, you can withdraw it without affecting earlier lawful use.

You have the right to object to processing based on our legitimate interests. Tell us what you object to and why, and we will assess the request under applicable law.

Contact us to exercise a right. You can also complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint.

10. Security and children

We use access controls, encryption in transit, provider security controls, and monitoring intended to protect personal data. No online service can guarantee absolute security. Genwel is intended for people aged 18 or over and is not directed at children.

11. Changes to this notice

We will update this page when our practices or legal obligations change. Material changes may also be shown in the product or sent to your account email. See our Cookie Policy for browser-storage details.