Privacy notice: sign-up and beta access

Version 1 — draft, not yet legally reviewed

  1. Who we are. Eagle Financial Labs, Inc., 131 Continental Drive, Suite 301, Newark, New Castle, Delaware, 19713, USA, is the data controller. Contact: privacy@eagleapp.us [TO CONFIRM BEFORE GOING LIVE: this mailbox and any DPO/EU-UK representative details actually exist and are monitored].
  2. What we collect. Name; email address; country of residence; your optional message; your answers to the two consent questions on the sign-up form; the page or campaign you came from (referrer and link source); IP address (we store only a one-way hash for abuse control, plus the country it maps to); browser user-agent; timestamps of your consent and account activation.
  3. Why we use it and our legal basis. (a) To process your beta sign-up, decide whether to admit you, and create your beta account: necessary to provide the service you've asked for (Art. 6(1)(b)/(f)), recorded via the first consent question. (b) To send you product updates about Eagle: your consent (Art. 6(1)(a)), recorded via the second question, and entirely separate from (a). (c) To keep the service secure and prevent bots and abuse (rate limiting, spam and fraud checks, including automated checks on your email domain and IP location): our legitimate interests in protecting our service (Art. 6(1)(f)). (d) To understand how people find us: our legitimate interest in measuring sign-up sources, using only the data above.
  4. Automated decisions. We use automated rules (for example, your declared country, email checks and available capacity) to decide whether to admit you to the beta straight away or review your request manually. This does not have a legal or similarly significant effect on you. If you are not admitted automatically, a person may review your request, and you can contact us to ask for one.
  5. Who we share it with. Service providers acting on our instructions: Amazon Web Services (hosting, database, email delivery) and Cloudflare (Turnstile bot check) process your sign-up details. If you activate a beta account and go on to use the app, the further information you provide during onboarding (for example identity and account details) is processed by WealthKernel Limited, our regulated account infrastructure partner, in their test/sandbox environment — see the in-app privacy notice for that stage, and please use dummy data there, not real identification numbers. We do not sell your data.
  6. Where it is stored and international transfers. Your data is stored in AWS in the United Kingdom (London region). Cloudflare, AWS and WealthKernel may process limited data in or from the United States/other locations; we rely on [UK IDTA/Addendum, EU Standard Contractual Clauses, or the UK-US Data Bridge, as applicable] for these transfers.
  7. How long we keep it. Sign-ups that never activate a beta account: deleted after 30 days. Activated prospects: until the beta ends plus [12] months, or until you withdraw consent (for the updates in item 3(b)) or ask us to delete it, whichever is sooner. IP hashes and technical logs: [30] days.
  8. Your rights. You can ask to access, correct or delete your data, restrict or object to our use of it, receive a copy in a portable format, and withdraw your marketing consent at any time (withdrawing does not affect earlier processing). Email privacy@eagleapp.us. You can also complain to the UK Information Commissioner's Office (ico.org.uk) or your local EU data protection authority.
  9. Providing your data. Giving us your name, email and country, and answering the first consent question, is needed to process your beta sign-up; without it we can't process your request. The second question and the message field are optional.
  10. Beta notice. The Eagle beta runs in a test environment. Please use dummy data and do not enter real identification numbers (for example NINO or SSN).
  11. Changes. We'll update this notice if we change how we use your data, with the version and date shown at the top.