Privacy Policy

Effective Date: 7 March 2026
Last Updated: June 2026
Data Controller: Vadercom Limited (trading as RetirePlan)
ICO Registration: Pending — application in progress

1. Who We Are

RetirePlan is operated by Vadercom Limited, a company registered in England and Wales (Company No. 7701620), with its registered office at:

Old Schoolhouse, 12b Chapel Street, Berkhamsted, Hertfordshire, HP4 2EA, United Kingdom.

In this Privacy Policy, "we", "us", or "our" refers to Vadercom Limited trading as RetirePlan. We are the data controller responsible for personal data collected through the RetirePlan app (iOS and Android), the RetirePlan web app, and the retireplan.co.uk website.

We are committed to protecting your privacy and handling your personal data responsibly, transparently, and in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. What Personal Data We Collect

2.1 Account and Identity Data

• Your email address, collected when you register or sign in via Google Sign-In or Apple Sign-In (powered by Firebase Authentication).
• If you use Apple Sign-In with email relay, we store the relay address provided by Apple. Apple only shares your real email address once; we store it at first sign-in.
• A unique user identifier (UID) assigned by Firebase Authentication.

2.2 Financial Planning Data

RetirePlan's core purpose requires collecting personal financial information. This includes:

• Retirement target age and lifestyle goals.
• Pension details: defined contribution (DC) pot values, defined benefit (DB) pension estimates, and State Pension projections.
• Income sources: employment income, rental income, self-employment income, and other income streams.
• Savings and investments: ISA balances, general investment accounts, cash savings, and other assets.
• Pre-retirement capital items and planned expenditure goals.
• Household type and other planning parameters entered in the Finance Planner.

This data is stored in your account on Firebase Firestore (a Google Cloud service) and is used solely to provide your personalised retirement planning experience.

Important: what we store is planning data, not account data. We do not ask for, and we actively discourage entry of, account numbers, sort codes, policy reference numbers, provider names, or login credentials for any financial institution. The figures you enter — pension pot values, savings balances, income amounts — are planning estimates: the kind of numbers you might write on a worksheet. They cannot be used to locate, access, or interact with your underlying financial assets. All financial planning data stored in RetirePlan is encrypted at rest using AES-256 encryption as part of Google Cloud's standard Firestore security controls.

2.3 Plan Summary Data

If you use the Plan Summary feature (Premium), we process a snapshot of your financial planning data to generate a personalised PDF document. This processing occurs via a secure Cloud Function and uses the Puppeteer rendering pipeline. Plan Summary data is not shared with any third party beyond the infrastructure providers listed in Section 4.

2.4 Ask the Expert Data

If you use the Ask the Expert feature, we process the questions you submit in order to provide a guidance response. Queries are handled within the RetirePlan platform and are not sold or shared with third parties for marketing purposes.

2.5 Subscription and Payment Data

• If you subscribe to RetirePlan Premium via the Apple App Store or Google Play, payment is processed by Apple or Google respectively as the merchant of record. We do not receive or store your payment card details.
• Subscription status, entitlement information, and purchase history are managed via RevenueCat, our subscription management platform.
• If you subscribe directly via our website, payment is processed by Stripe. We do not store full card details; Stripe handles payment security under PCI DSS.

2.6 Usage and Technical Data

• App usage data including features accessed, screens viewed, and interaction patterns (collected via Firebase Analytics).
• Device type, operating system version, and app version.
• IP address and approximate location (derived from IP, not GPS).
• Session and crash data to help us identify and fix technical issues.

2.7 Communications Data

• Email address and marketing preferences if you subscribe to our newsletter or updates via Brevo (formerly Sendinblue).
• Messages or enquiries you send to us directly.

2.8 Digital Download Data

If you download a planning playbook, The Complete Guide to UK Pensions, or other digital content, your email address and download activity are processed by BookFunnel for secure delivery.

3. How We Use Your Data

We use your personal data for the following purposes:

• Providing and personalising the RetirePlan planning tools, Finance Planner, Lifestyle Designer, and Plan Summary.
• Creating and maintaining your account and authenticating your identity.
• Processing Premium subscriptions and managing your entitlements.
• Generating AI-assisted commentary and personalised guidance within the app. This is template-driven and does not constitute regulated financial advice.
• Delivering digital downloads you have requested via BookFunnel.
• Sending newsletters, product updates, and relevant content if you have opted in.
• Analysing usage patterns to improve app performance, features, and content.
• Complying with our legal obligations and maintaining secure records.
• Responding to your enquiries and providing support.

We will never sell or rent your personal data to any third party for their own marketing purposes.

4. Third-Party Service Providers

We share your data only with trusted service providers who process it on our behalf, under our instructions, and subject to appropriate data protection agreements. These are:

Infrastructure and Authentication

• Firebase (Google LLC) — Firebase Authentication (identity management), Firebase Firestore (data storage), Firebase Analytics (usage analytics), Cloud Functions (server-side processing including Plan Summary generation), and Firebase Hosting. Data is processed under Google's standard contractual clauses.

Subscription Management

• RevenueCat Inc. — Manages Premium subscription entitlements, purchase verification, and quota tracking across iOS, Android, and web.
• Apple Inc. — Processes App Store payments for iOS subscriptions and in-app purchases. Governed by Apple's own privacy policy.
• Google LLC — Processes Google Play payments for Android subscriptions and in-app purchases. Governed by Google's own privacy policy.
• Stripe Inc. — Processes direct web subscription payments. Governed by Stripe's privacy policy and PCI DSS compliance.

Hosting and Deployment

• Vercel Inc. — Hosts our web application. Processes request data in the course of serving the app.

Email and Marketing

• Brevo (Sendinblue SAS) — Manages newsletter subscriptions and email communications for opted-in users.

Digital Content Delivery

• BookFunnel — Delivers planning playbooks, The Complete Guide to UK Pensions, and other digital downloads securely to registered recipients.

We may also disclose personal data if required to do so by law, court order, or to protect the rights, property, or safety of Vadercom Limited, our users, or others.

5. Legal Basis for Processing

We rely on one or more of the following lawful bases under UK GDPR:

• Contract — Processing necessary to provide the services you have signed up for, including account management, the Finance Planner, and Premium features.
• Legitimate interests — Operating and improving our services, analysing usage, ensuring security, and communicating service-related information. We balance these interests against your rights.
• Consent — For newsletter subscriptions, marketing communications, and non-essential cookies. You may withdraw consent at any time without affecting the lawfulness of prior processing.
• Legal obligation — Where we are required to process or retain data to comply with applicable law.

6. Cookies and Similar Technologies

6.1 Our Website (retireplan.co.uk)

Our website uses cookies. When you first visit, you will be presented with a cookie consent banner. You can choose to accept or decline non-essential cookies at that point, and change your preferences at any time.

We use the following categories of cookies:

• Essential cookies — Required for the website to function correctly. These cannot be disabled.
• Analytics cookies — Help us understand how visitors use the site (e.g. Firebase Analytics, Google Analytics). Only set with your consent.
• Functional cookies — Remember your preferences and settings.

6.2 The RetirePlan App

The native iOS and Android apps do not use browser cookies. However, the Firebase and RevenueCat SDKs embedded in the app collect usage and device data as described in Section 2.6. Apple's App Tracking Transparency framework applies to any advertising-related tracking on iOS; we do not currently use advertising identifiers.

7. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes described in this policy, including satisfying legal, accounting, or reporting obligations.

• Account and financial planning data — Retained for the lifetime of your account. Deleted within 30 days of a verified account deletion request. Note that plan data stored locally on your device will persist until you uninstall the app or clear app data.
• Plan Summary snapshots — Retained in Firestore as part of your account data. Deleted with your account.
• Newsletter subscription data — Retained until you unsubscribe. Deletion actioned within 14 days.
• Payment and subscription records — Retained for up to 7 years to comply with financial record-keeping obligations.
• Support communications — Retained for up to 2 years.
• Analytics data — Retained in aggregated or anonymised form after 26 months.

8. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
• Right to restriction — Request that we limit how we process your data in certain circumstances.
• Right to data portability — Receive your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests or for direct marketing.
• Rights relating to automated decision-making — We use template-driven logic to generate Plan Summary commentary. If you believe an automated output has significantly affected you, you may request human review by contacting us.

To exercise any of these rights, contact us at: privacy@retireplan.co.uk

We will respond within 30 days. We may need to verify your identity before processing your request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): www.ico.org.uk

9. International Data Transfers

Some of our service providers (including Google/Firebase, RevenueCat, Vercel, and Stripe) are based in or process data in the United States and other countries outside the UK. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, including:

• UK International Data Transfer Agreements (IDTAs) or standard contractual clauses approved by the ICO.
• Transfers to countries deemed to provide an adequate level of protection.
• Provider-specific binding corporate rules or equivalent mechanisms.

10. Children

RetirePlan is intended for users aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us at privacy@retireplan.co.uk and we will delete it promptly.

11. Security

We take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, disclosure, or destruction. These include:

• Encrypted data storage via Firebase Firestore with Google Cloud security controls.
• Secure authentication via Firebase Authentication (OAuth 2.0 / OpenID Connect).
• HTTPS encryption for all data in transit.
• Access controls limiting data access to authorised personnel only.
• Regular review of our security practices.

No method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security, but we are committed to protecting your data using industry-standard practices.

We also take a deliberate approach to minimising the sensitivity of the data we hold. RetirePlan stores planning estimates — numerical values you assign to your pension pots, savings, and income — not the account identifiers, provider details, or credentials that would be needed to access the underlying assets. We do not ask for this information and we do not encourage its entry. The practical effect is that your RetirePlan data, even if accessed without authorisation, does not provide a means to locate or interact with your actual financial accounts.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, or legal obligations. When we make material changes, we will notify you via the app or by email where appropriate. The revised version will be posted on this page with an updated "Last Updated" date. Continued use of RetirePlan after changes are posted constitutes acceptance of the revised policy.

13. Contact Us

For any questions about this Privacy Policy, your personal data, or to exercise your rights:

Email: privacy@retireplan.co.uk
Post: RetirePlan (Vadercom Limited), Old Schoolhouse, 12b Chapel Street, Berkhamsted, Hertfordshire, HP4 2EA, UK.

For general enquiries: hello@retireplan.co.uk

Vadercom Limited — Registered in England and Wales, Company No. 7701620. ICO registration pending.