Privacy Policy

Who we are

Cairn is operated by [YOUR COMPANY NAME] ("we", "us", "our"), a company registered in England and Wales (company number [XXXXXXXX]), with registered address at [YOUR ADDRESS].

We are the data controller for the personal information you provide to us. If you have any questions about this policy or how we handle your data, contact us at privacy@mycairn.co.uk.

What data we collect

Information you give us directly

When you create a Cairn account and use the service, you may provide:

• Identity information — your full name and date of birth
• Contact information — email address, phone number, and home address
• Household information — marital status, whether you have dependants, whether you own your home
• Employment and income information — employment status and income band
• Financial information — details of bank accounts, savings, pensions, mortgages, loans, credit cards, and other financial products you choose to record
• Insurance information — details of insurance policies, including policy numbers, premiums, cover amounts, and renewal dates
• Possessions and property — details of property, vehicles, and valuables you choose to record
• Legacy information — details of wills, powers of attorney, funeral preferences, and trusted contacts you name

You are always in control of what you add. Nothing is pulled in automatically without your action.

Information we collect automatically

• Usage data — which sections of the app you use, how you navigate, and actions you take. We log behaviour only — never the content of your financial records.
• Device and browser information — your device type, operating system, and browser
• Session information — a short-lived identifier used to group your activity. For in-app analytics while you are signed in, this is held only in memory and is not stored on your device; for pre-login site analytics it is stored in your browser and used only if you accept analytics storage.
• Referrer information — the website or link that brought you to Cairn

Information from uploaded documents

If you upload PDF documents, we store these securely in your account. If you use our AI-powered policy reading feature, the content of uploaded PDFs is sent to Anthropic's Claude API for processing. Anthropic's privacy policy applies to that processing. We do not retain document content beyond what is stored in your Cairn account.

How we use your data

• Provide the Cairn service — storing and displaying your financial records so you can manage them in one place
• Authenticate you — verifying your identity when you sign in
• Improve the service — understanding how people use Cairn so we can make it better, using aggregated usage data
• Communicate with you — sending essential service emails, and (where you have not opted out) updates about new Cairn features and services
• Surface relevant prompts and nudges — using your own data to highlight things that may need your attention, such as an insurance renewal or a mortgage rate ending soon
• Show you relevant market information — we may use information about your financial profile to surface relevant market information, such as interest rates, insurance options, or financial products that may be relevant to your circumstances. This is information only — Cairn does not provide financial advice and any decision is entirely yours
• Conduct research and product development — we may invite you to participate in surveys or research interviews, and use anonymised data to understand what to build next
• Operate a referral programme — if you invite someone to Cairn, we will use your email address and theirs to process the referral. No financial data is shared as part of this
• Comply with our legal obligations — including keeping records as required by applicable law

We do not sell your personal data to third parties. We do not share your identifiable financial data with insurers, banks, or any other financial institution without your explicit consent.

Our legal basis for processing

• Contract — processing your personal and financial data is necessary to provide the Cairn service you have signed up for
• Legitimate interests — collecting usage analytics; surfacing personalised nudges and market information based on your own data; operating a referral programme — in each case where this does not override your rights
• Consent — where we send you marketing communications, you may opt out at any time via the unsubscribe link in any email or by contacting us
• Legal obligation — where we are required to retain records by law

Who we share your data with

We do not share your data with any other third parties except where required by law.

Where your data is stored

Cairn uses Supabase for data storage. Supabase stores data in data centres within the European Union. Your data does not leave the UK/EU except where noted above (Anthropic processes data in the United States; by using the PDF upload feature you consent to this transfer).

How long we keep your data

We keep your personal and financial data for as long as your Cairn account is active. If you delete your account, we delete all your records immediately. We may retain anonymised, aggregated usage statistics indefinitely.

We retain backup copies for up to 30 days after deletion, after which they are permanently destroyed.

Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, object to, and port your personal data. To exercise any of these rights, contact us at privacy@mycairn.co.uk. We will respond within 30 days.

We analyse how signed-in users use the app (behaviour only, never the content of your records) on the basis of our legitimate interest in running and improving Cairn. You can object to this at any time by contacting us, and we will stop analysing your usage.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Security

All data is encrypted in transit (HTTPS) and at rest. Access to your data is protected by Row-Level Security — no user can access another user's records. We strongly recommend using a unique, strong password for your Cairn account.

Children

Cairn is not intended for use by anyone under the age of 18. We do not knowingly collect data from children.

Changes to this policy

We will notify you by email if we make material changes to this privacy policy.