PRIVACY POLICY
How we look after your information
This page explains, in plain English, what we collect when you use Foundation Women, why we use it, where it is stored and how long we keep it.
Last updated: 5 October 2026
On this page
Who we are
Foundation Women is a financial-education service for women. We help you understand your financial position through the Financial Check, monthly check-ins and your own records of your money.
When you submit a scorecard or create an account, Foundation Women is the controller of the personal information in this policy. That means we decide how your information is used, and we are responsible for it.
If you have a question, want a copy of your information, want something corrected or deleted, or want us to stop using something, contact us at hello@foundationwomen.co.uk. You can also use the data controls in your Foundation dashboard.
What we collect
Here is what we collect, piece by piece.
Account information
When you create an account, we collect your name and email address, and a password which we keep only as a one-way (hashed) form, never readable by us. We record that a sign-in session for your account is active. Before your account is used, you verify your email with a six-digit code, which expires after about fifteen minutes.
Financial Check answers
When you complete the Financial Check, you answer 20 statements by rating yourself from not yet to consistently. The statements cover things like your emergency savings, insurance and income protection, your credit report, account security, debts and spending awareness, subscriptions, saving and goals, pensions, investing and retirement plans, mortgage or housing terms, fees, wills and provision for people who depend on you, and how organised your key documents are. These are self-assessments about habits and awareness; the scorecard does not ask for bank balances, account numbers or statements. Even so, the answers can describe your financial circumstances, so we handle them with care.
Monthly check-ins
As a Financial Progress member you complete a short monthly check-in: the month, an optional age field, your household status, your main financial goal in your own words, 20 statements rated the same way, and which suggested actions you have marked done. We keep one record per calendar month.
Money records you save
My Money, My Wealth and your Financial Vault let you save your own figures and notes: income, spending, savings and debt payments; assets such as cash, pensions, investments or property; liabilities such as mortgages, loans or credit cards with balances and rates; property details including an optional postcode; goals; and anything you choose to record in the Vault, which can contain sensitive details such as account or policy information. This is your own record-keeping: you add it, change it and delete it.
Payment and subscription information
Financial Progress costs £4 a month and is billed through Stripe. When you start a subscription we send Stripe your email address and an internal account reference so your subscription can be matched to your account. Stripe collects and stores your card or payment details under its own security rules and privacy policy. We store your plan, its status (active or cancelled), Stripe references, the current billing-period-end date and a small amount of technical detail needed to keep your membership working. We also keep a record of purchases and subscription history needed to provide the service and keep billing records accurate. We never receive your full card details.
Email preferences
If you tick the optional box to hear about new resources, we record your choice and the date. Marketing emails are never a condition of joining. If you untick it, the choice is recorded again.
Why we use it
Under UK GDPR we can only use your information if we have a lawful basis. The bases we rely on are:
- Delivering your account, your Financial Check, your monthly check-ins, your dashboard and your stored records: this is necessary to provide the service you request, including your guest scorecard result.
- Taking payments and keeping your membership working: contract once you subscribe.
- Keeping the service secure: records such as sign-in sessions and verified-email status, in our legitimate interests.
- Optional updates about new resources and features: your consent, which you can withdraw at any time.
- Meeting legal duties: keeping billing records that UK law requires.
How your scorecard is used
When you enter your email to view a guest score, we store your email, scorecard answers, a submission reference, marketing choice and timestamps in Convex. This lets us add your score to an account after you verify ownership of the same email address. Results appear on the website; this flow does not email your score. Marketing consent is optional and separate from storing your result.
Your answers are scored on our servers: each foundation (EMPOWER, BUILD, INVEST and PROSPER) becomes a score out of 100, your Financial Check is their average, and your three weakest areas become your next moves. The result is saved to your account so your dashboard can show how you change over time. Your answers are never used to price your membership, change what you can access, or select marketing.
Your score responses are ordinary information about your financial circumstances. Financial data is not, by itself, special-category data under UK GDPR, but it is still personal information that we handle with care. Guest answers are linked to your email; account results are available through your verified account.
Where it is stored
Your account and everything you save run on a managed platform: the website is served by Macaly, and all data lives in a cloud database provided by Convex, the database service the platform runs on. Your sign-in session is kept in your own browser's local storage while you are logged in. Verification codes are sent by the platform's transactional-email service and expire after about fifteen minutes.
Your dashboard, records and scores are available only when signed in as you. Foundation Women's operators can access account records through administrative systems in order to run and support the service; the admin interface itself shows names and membership emails only, not individual answers.
Locally, we also keep unfinished answers, pending submissions and your current result in your browser's session storage so a refresh does not clear your progress; this local copy is stored only on your own device and cleared when the session ends.
Payments and Stripe
- Membership payments are made inside an embedded checkout operated by Stripe. When you enter card details, they go to Stripe, not to Foundation Women.
- Stripe keeps records of your payments and subscription under its own terms. We keep only the subscription status and reference numbers needed to recognise your membership.
- If you cancel your membership, we keep the cancelled subscription record so your billing history stays accurate. Stripe's own retention rules apply to its payment records.
Email and marketing
- Your email address links your guest scorecard to a future verified account. It is also used to create and verify your account, to send sign-in or password-reset codes, and to identify you as the owner of your subscription (Stripe receives it for billing).
- Marketing emails are an optional extra: only if you actively tick yes do we record that you want practical financial education, new resources and product updates. Choosing no does not change your access. You can change your mind at any time by asking us or unticking in the app.
- Routine service emails may be sent where needed to operate your account or deliver a service you have requested. Marketing and product-update emails remain optional and are sent only if you opt in.
How long we keep it
Your saved progress history is a deliberate part of the product: Foundation Score retakes and monthly check-ins are kept so you can see your own change over time. If you want your history gone while keeping your account, just ask.
- Account and sign-in details: kept while your account is open.
- Guest scorecard submissions: stored against your email address. There is currently no automatic expiry for these records. You can ask us to delete them at hello@foundationwomen.co.uk, including if you never created an account.
- Financial Check answers and scores: kept while your account is open, including every retake, so your dashboard can show change over time.
- Monthly check-in records: kept while your account is open, one snapshot per month, deliberately retained so you can compare months; your current view shows the last twelve months.
- Money, wealth and Vault records: kept until you delete them, or delete your account.
- Email preference choices: kept while your account is open.
- Sign-in codes: expire about fifteen minutes after they are sent.
- Membership payment references: kept while your account is open. Stripe keeps its own payment records.
- When you use the account deletion control, it removes the records linked to your account: your account details, answers, scores, monthly history, financial records, Vault entries and email preferences. A separate guest scorecard submission linked to your email may remain; contact us to request its deletion as well. Copies may remain in platform backups until those backups expire. Stripe's records of the payments themselves follow Stripe's rules.
Your rights
You have rights over your information under the UK GDPR. In short you can:
- Ask for a copy of the personal information we hold (your dashboard has a download control).
- Ask us to correct anything wrong.
- Ask us to delete your account and the information in it.
- Ask us to restrict how we use your information, or object to certain uses.
- Get a machine-readable copy of the information you gave us (portability).
- Change or withdraw your marketing consent at any time.
We respond to requests within one month. Use the controls in your dashboard, or email hello@foundationwomen.co.uk.
Security
Your password is stored only as a one-way hash; we never see it. You verify your email before your account can be used. Data moves over encrypted connections, and only those operating Foundation Women can reach the production database. We do not claim more than this: if our security arrangements change, this policy will too.
Complaints and the ICO
If you have a concern about how your information is handled, please tell us first so we can fix it. You can also raise the issue with the Information Commissioner's Office (ICO), the UK's data-protection regulator, at ico.org.uk or 0303 123 1113.
Children
Foundation Women is aimed at adults (18+). We do not knowingly create accounts for children.
Changes to this policy
We update this policy when how we handle information changes. The date at the top shows the last update. If a change would affect what you have already told us, we will email the address on your account.
Questions about your data start with us: hello@foundationwomen.co.uk
Ready to find out how strong your financial foundation is?