Privacy Policy

Casomo is operated by Casomo Ltd (“we”, “us”), company number 15030496, registered in England and Wales. We are registered with the Information Commissioner’s Office as a data controller, reference ZC219565. This policy explains what data we hold, what we don’t, and your rights under UK GDPR.

What we hold, and what we don’t

Financial and scenario data: not held by us

Our calculators run in your browser. Any salary figures, pension parameters, or scenarios you enter are stored locally on your device using your browser’s storage. They are not transmitted to our servers and we cannot see them.

You can export your scenarios to a file at any time using “Download my scenarios”, and import them back later or on another device. You can clear all scenarios from your browser using “Clear all scenarios” or by clearing this site’s data in your browser settings.

We do not hold your salary, pension data, NHS band, region, or any financial scenarios server-side. We don’t offer accounts or sign-in, so we hold no password or authentication data. The only personal details we hold are the ones you choose to send us: an email address, a message through our contact form, or a Wealth Report request (below).

Wealth Report requests

If you ask us for a free Wealth Report, the details you give us, in the questionnaire or by email, are used to build your report and nothing else. They are stored in our Google Workspace and never sold. We don’t share them with anyone outside the services listed below, except where the law requires it, and we delete them on a fixed clock.

The questionnaire is a Google Form. Google hosts it and stores your answers for us, under our instructions and nobody else’s. The data stays ours to look after, and ours to delete.

We build and send the report on the lawful basis of legitimate interest (UK GDPR Article 6(1)(f)), because you asked us for the report and we need those details to build it. You can object at any time.

We do not want your National Insurance number or home address. If they appear on a payslip or statement you send us, feel free to black them out first.

We don’t ask for health information and we don’t want it. If any reaches us in free text, we delete it on arrival and it never enters your report.

We track the progress of a request in our project tool. That record holds a reference and a status: no name, no email, no figures, no documents.

Analytics: anonymous, stored locally

Anonymous usage analytics (page views, calculator interactions) are handled by PostHog. A random identifier is stored in your browser so we can distinguish returning visitors from new ones. Analytics don’t capture your salary figures or calculation results, such as your take-home pay. We do record which broad options a scenario used (for example pay band, nation and tax year), to see which scenarios are common. We use the lawful basis of legitimate interest (UK GDPR Article 6(1)(f)) to understand how the site is used and to improve it.

We also record anonymised session replays (mouse movement, clicks, and page navigation), with all form inputs masked, so we can find and fix usability problems. Replays never capture the values you type.

We do this to find broken features, make the tools work well, and build more relevant, useful content. Most people never email to say something is broken. They get frustrated and leave, so anonymous usage data is how we spot it. The data is anonymous, and we never sell it to third parties.

Email: handled by Buttondown

If you give us your email address, it is held by Buttondown, our email provider. We run it on your consent, which you can withdraw at any time using the unsubscribe link in any email we send. Every address is confirmed before we use it: you get one email asking you to click a link, and until you do we send you nothing else.

We record what you asked to hear about, and we send you that and nothing else. If you asked about more than one thing, you can stop any of them without stopping the rest. We never sell or share your address.

We don’t send personalised alerts about your own figures. We don’t hold your figures to alert you about.

What we store in your browser

We aim to keep storage to a minimum. The ICO treats cookies and localStorage the same way for transparency, so both are listed here with how long each one lasts.

We do not use:

• Advertising cookies
• Cross-site tracking cookies
• Social media tracking pixels

What we use it for

Everything we hold has one job, and we’ve named it here alongside the lawful basis we rely on.

• Anonymous analytics: to understand site usage and improve the product.
• Email address: to send you what you asked to hear about, if you asked.
• Contact form messages: to read and reply to what you sent us. We do this on the lawful basis of legitimate interest, because you chose to write to us and a reply is what you asked for. Turnstile checks the form is not a bot on the same basis.

We don’t sell personal data, and we don’t share it with third parties for marketing.

Where your data goes

Our service providers may process data outside the UK. PostHog and Resend process it in the EU; the others may process it further afield. Where this happens, transfers are made under appropriate safeguards: UK adequacy decisions, or Standard Contractual Clauses, depending on the provider and destination.

How long we keep it

Different things have different clocks. Here is every one of them.

• Platform logs: our hosting provider (Vercel) retains standard request logs for up to 3 days. These contain request metadata (URL, status code, timing) but no financial inputs or calculation data.
• Wealth Report requests: questionnaire responses, emails and documents are deleted within 90 days of your request, whether or not we send you a report. Sooner if you ask.
• Email addresses: held by Buttondown until you unsubscribe.
• Anonymous analytics: retained by PostHog according to their retention policy.

Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you (Article 15)
• Correct inaccurate data (Article 16)
• Delete the data we hold about you (Article 17)
• Port your data to another service (Article 20)
• Object to processing based on legitimate interest (Article 21)
• Withdraw consent where processing is based on consent

Because we hold so little data, most of these are quick to action:

• To delete data we hold about you, email us using the contact link below. In practice this is your email address (if you gave us one) and your anonymous analytics record.
• To export your scenarios, use “Download my scenarios” in the app. They’re on your device, so you have direct access.
• To stop our emails, use the unsubscribe link in any email we send you. You can stop one thing you asked about without stopping the rest.

For anything else, get in touch via the contact link below. We’ll respond within one calendar month.

If you’re unhappy with how we’ve handled your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Who else touches your data

These companies help us run the site. Here is what each one receives, and why. We don’t share your data with anyone else, except where the law requires it.

When this policy changes

We’ll update the “last updated” date at the top of this page when this policy changes. Material changes will be reflected here, and notified by email to anyone who has given us an address.

Contact

For privacy-related inquiries, get in touch.

Who we are, our company number and our ICO registration are at the top of this page.