Privacy Notice
Last updated 29 September 2026 (adds the Ask assistant and the daily brief)
This notice explains what personal data Twelve34 collects, why, who it's shared with, how long it's kept, and your rights. It's written to meet the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
Twelve34 is operated by [legal name of the business, e.g. "Twelve34 Ltd, a company registered in England and Wales, company number …" or "James Linkson, trading as Twelve34"], of [registered or business address]. We are the "controller" of your personal data.
We are registered with the Information Commissioner's Office (ICO), registration number [ICO registration number].
Contact us about anything in this notice at [privacy@twelve34.uk].
2. What we collect
- Account details: your email address, and records of when you signed in and accepted our terms.
- Trading and income data you upload: the contents of broker exports you import – trades, dates, quantities, prices, fees, option positions, dividends, interest and exchange rates. Broker exports can contain other details, such as account numbers; we don't need these and don't use them.
- Questions you ask the assistant ("Ask"), and its answers, kept so you can see your conversation.
- Settings you give us: for example, how much of your basic rate tax band is left, which indicates your income level, and your preferred exchange rate source.
- Technical data: your IP address, browser type and the pages you request, recorded in our server logs for security and troubleshooting.
- Payment details (once paid subscriptions start): handled by our payment provider, Stripe. We never see or store your full card number.
We don't collect special category data (such as health or ethnicity) and ask you not to upload any.
3. How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service: importing your data, calculating gains and tax estimates, showing your dashboard and reports | Performing our contract with you |
| Signing you in and sending sign-in codes and essential service emails | Performing our contract with you |
| The daily brief email (you can switch it off in Settings or from any brief) | Performing our contract with you |
| Answering questions you ask the assistant | Performing our contract with you |
| Keeping the service secure, preventing misuse and fixing faults | Our legitimate interests in running a secure, reliable service |
| Improving the service using aggregated or de-identified statistics | Our legitimate interests in improving Twelve34 |
| Keeping business and accounting records, and responding to lawful requests | Legal obligation |
| Marketing emails (only if you opt in) | Your consent, which you can withdraw at any time |
We do not sell your data, use it for advertising, or share it with anyone to market to you. Our calculations are provided to inform you; we don't make decisions about you that have legal or similarly significant effects.
4. Who we share it with
We use these service providers ("processors"), who may only use your data to provide their service to us:
- Supabase: database and sign-in. Your data is stored in London, UK (Amazon Web Services, eu-west-2).
- Fly.io: runs the Twelve34 application, in its London, UK region.
- Resend: sends our emails, such as sign-in codes. It processes your email address and the content of those emails.
- Anthropic: provides the AI model behind the Ask assistant. Only when you use Ask, your question and the parts of your trading and tax data needed to answer it are sent to Anthropic, which processes them in the United States to generate the answer. Anthropic doesn't use this data to train its models, and keeps it for no longer than [confirm Anthropic's current API data retention period].
- Stripe: payments, once paid subscriptions start.
We may also share data with professional advisers (such as lawyers or accountants) under confidentiality, or where the law requires it.
To convert foreign currency and value holdings we fetch public data, such as Bank of England exchange rates and market prices. No personal data is sent when we do this.
5. International transfers
Your data is stored in the UK. Some of our providers are based in the United States and may access or process data there, for example for support, email delivery, or answering questions you ask the assistant. Where that happens, we rely on [the safeguard each provider uses, e.g. the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum – confirm per provider] to protect it.
6. How long we keep it
- Your account and trading data: for as long as your account is open. When you close your account, we delete it within 30 days, and it's removed from our backups within a further [7] days.
- Uploaded broker files: the raw file is deleted as soon as you confirm or discard the import. Only the trades you choose to import are kept.
- Server logs: up to [30] days.
- Our business records (such as invoices): as long as the law requires, usually six years.
HMRC expects you to keep records supporting your tax return (generally at least 22 months after the end of the tax year, or longer if you're self-employed). Please keep your own copies. Don't rely on Twelve34 as your only record.
7. Your rights
You have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to how we use it;
- receive your data in a portable format;
- withdraw consent where we rely on it.
To use any of these rights, email [privacy@twelve34.uk]. We'll respond within one month. There's normally no charge.
If you're unhappy with how we've handled your data, please tell us. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
8. Security
Data is encrypted in transit (HTTPS) and at rest. Access is restricted so each user can only reach their own data. We don't use or store passwords: you sign in with a one-time code sent to your email, so keep your email account secure.
9. Cookies
We use a single cookie to keep you signed in. It's strictly necessary for the service to work, so it doesn't need your consent. We don't use analytics or advertising cookies.
10. Children
Twelve34 is not intended for anyone under 18.
11. Changes to this notice
If we make material changes, we'll tell you and ask you to review the new version when you next sign in. The date at the top shows when this notice was last updated.