DepositScout Ltd ("we", "us", or "our") operates depositscout.com (the "Website"), an independent UK savings comparison service. This Privacy Policy explains what personal information we collect, why we collect it, who we share it with, and the rights you have over it. It is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
DepositScout Ltd, 124 City Road, London EC1V 2NX, United Kingdom, is the data controller for the personal information described in this policy. That means we decide why and how your personal information is used. We are registered with the Information Commissioner's Office (ICO) under registration number ZC025953.
For anything relating to your personal information, contact us at [email protected].
2. Whose information we collect
- Visitors browsing the Website.
- Alert subscribers who sign up for rate alerts, news, or the weekly roundup.
- Account holders who create a DepositScout account and use the dashboard.
- Customers who pay for a DepositScout product by Direct Debit.
- Business contacts who request API access, join a waitlist, or contact us about partnerships or media.
- Reviewers who submit a review of a provider, savings product, investment or card.
3. What information we collect
Information you give us directly
- Alert subscriptions: email address, optional first and last name, country, and your alert preferences (account types, rate thresholds).
- Account details: email address, name, and an optional profile photo when you create an account.
- Dashboard information you choose to add: your savings accounts (provider, account name, balance, rate, key dates), investment holdings, property addresses and vehicle registrations you want valued, an estimated salary and tax region if you use the tax features, savings plans, and bank-switch progress.
- Payment sign-up: your email address when you set up a Direct Debit. Your bank details are collected and held by our payment provider, Stripe — we never see or store them.
- Questions you ask Penny, our AI savings assistant.
- Business enquiries: name, email, company, website, and your message when you request API access or join a waitlist.
- Data API and press dashboard activity: if you have a developer or press account, we record what you do with it — each API request (endpoint, time, result and credits used), each sign-in to the developer portal, changes to your account, keys and payments, and the dashboard pages and downloads you use — together with the IP address and browser or client software it came from.
- Reviews: the display name you choose, your email address, the provider, product or card you are reviewing, your ratings (an overall score, a 0–10 recommendation score, and optional scores for things like app, service and withdrawals), the title and text of your review, and optionally how long you have been a customer and whether you still hold the account. We also record a hashed version of your IP address and your browser type to detect duplicate and automated submissions. Your raw IP address is not stored.
When you leave a review
If you leave a review we collect the display name you choose, your email address, the provider, product or card you are reviewing, your ratings (an overall score, a 0–10 recommendation score, and optional scores for things like app, service and withdrawals), the title and text of your review, and optionally how long you have been a customer and whether you still hold the account. We also record a hashed version of your IP address and your browser type to detect duplicate and automated submissions. Your raw IP address is not stored. We use your email to send a six-digit verification code and, if we need to, to confirm a detail of your experience.
We store reviews in our database, hosted on our own servers in London, United Kingdom. The verification email is sent by Brevo.
We use this information to check your review and to prevent fake or duplicate reviews as required by the Digital Markets, Competition and Consumers Act 2024. We do not show reviews on the public site yet. Once reviews are published, we may share them with the provider concerned as they appear on the site, or as anonymised aggregate data. We do not share unpublished reviews or your contact details.
The lawful basis is contract (for taking and checking your review) and legitimate interests (for preventing fake, duplicate and abusive reviews). You can ask us to remove your review at any time by emailing [email protected]; if published, we will take it down. We keep a record of your email address and the product reviewed for 12 months so the one-review rule still applies.
Your email address is not shown with the review. How we check, refuse, or remove reviews is set out in our Reviews Policy.
Information collected automatically
- Technical data: IP address, browser type, device information, and pages visited. Our main analytics tool runs on our own servers and works without cookies; optional Google Analytics only runs if you accept cookies. See our Cookies Policy.
- Provider engagement data: if you accept analytics, we record bank and product page views, products displayed, detail interactions, internal product links, and clicks through to providers using random, rotating identifiers. We do not connect this activity to your account, email address, alert subscription, or bank information.
- Approximate location: we use your IP address to estimate your country (never your precise location) so we can show relevant content.
Information from your bank
None. We do not connect to your bank, and we do not receive balances, transactions, account numbers or login details from it. Everything on your dashboard is there because you entered it.
4. Where we get your information from
- Directly from you — forms, account signup, dashboard entries, emails, reviews, and questions you ask Penny.
- From your device — technical and usage data collected automatically when you browse.
- From public data sources — market prices for holdings you add, and property and vehicle valuations for addresses and registrations you enter.
- From Stripe — payment status updates (for example, whether a Direct Debit payment succeeded).
We do not buy personal information from data brokers or collect it from public sources.
5. Why we use your information and our lawful bases
UK data protection law requires us to have a lawful basis for each use of your personal information:
| What we do | Lawful basis |
|---|---|
| Send rate alerts, news emails, and the weekly roundup you signed up for | Consent — you can unsubscribe at any time |
| Provide your account, dashboard, savings plans, and paid products | Contract — needed to deliver the service you asked for |
| Answer questions you ask Penny | Legitimate interests — operating the assistant you chose to use |
| Measure how the Website is used and improve it | Legitimate interests (cookieless analytics) and consent (optional cookie-based analytics) |
| Measure bank and product engagement, including provider click-throughs | Legitimate interests for minimal server-side outbound click counts and consent for page views, impressions, interactions and session-level analysis |
| Keep the Website secure, prevent abuse, and rate-limit requests | Legitimate interests — protecting our service and users |
| Record Data API and press dashboard activity, with IP addresses, to bill usage, enforce our Data Licence and Press Data Terms, and investigate fraud, key misuse and payment disputes | Contract — metering and billing the service — and legitimate interests — protecting our data, our customers and our payments |
| Respond to enquiries and complaints | Legitimate interests — running our business responsibly |
| Keep records of payments | Legal obligation — UK accounting and tax law |
| Take, check and moderate reviews, send the verification code, and enforce the one-review rule | Contract — providing the review service you asked for — and legitimate interests — preventing fake, duplicate and abusive reviews and meeting our obligations under the Digital Markets, Competition and Consumers Act 2024 |
We do not use your personal information for automated decision-making that has legal or similarly significant effects on you, and we never sell it.
6. Who we share information with
We share personal information only with service providers (processors) that help us run DepositScout, each under a contract that restricts what they can do with it:
- Supabase — secure hosting of our database, account login, and file storage (for example, profile photos).
- Brevo — sending our emails (alerts, news, transactional emails) and managing subscriber lists.
- Stripe — processing Direct Debit payments. Stripe holds your bank details; we only hold references to your Stripe customer record.
- Anthropic — the AI provider that powers Penny. Your questions (and a few previous messages for context) are sent to Anthropic to generate an answer; we do not include your name or contact details.
- Google — optional Google Analytics (only with your cookie consent) and YouTube video embeds.
- ipapi.co — converting your IP address into a country estimate.
We may also disclose information if required by law, to protect our legal rights, or as part of a business sale or reorganisation (in which case this policy would continue to apply).
When you click through to a bank or provider (including affiliate links), you leave our Website and their privacy policy applies. We do not pass your personal details to a provider when you click through. Separately, once reviews are published, we may share the review as it would appear on the site — display name, ratings and text — with the provider concerned, or as anonymised aggregate data. We never share your email address, IP address or other contact details with providers, and we do not share unpublished reviews.
7. International transfers
Some of our service providers (including Anthropic, Stripe, and Google) are based in, or process data in, the United States. Where personal information leaves the UK, we rely on safeguards recognised under UK law — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and, where applicable, the UK–US Data Bridge — so your information keeps an equivalent level of protection.
8. How long we keep your information
- Alert subscriptions: until you unsubscribe. Unsubscribing stops all alert emails immediately; you can ask us to delete your details entirely.
- Account and dashboard data: for as long as your account is open. When your account is deleted, your dashboard data and subscriptions are deleted with it.
- Payment records: kept for 6 years after the transaction, as required by UK accounting and tax rules (with the link to your deleted account removed).
- Enquiries and complaints: up to 6 years, in case of follow-up or dispute.
- Penny conversations: not stored — your question is processed to generate an answer and is not kept in our database.
- Technical logs: kept for short periods for security and troubleshooting, then deleted or anonymised.
- Data API and press dashboard activity: IP addresses are deleted after 30 days, except the IP address and browser a credit purchase was agreed from, which we keep with the payment record (6 years) as evidence of the purchase; we keep a one-way, daily-changing code made from them to spot repeat abuse. Individual API requests are kept for 90 days, then only daily totals. Sign-ins, dashboard activity and account changes are kept for up to 2 years (key and security events for 180 days).
- Provider analytics: rotating visitor links are deleted after 30 days, raw click and engagement events after 18 months, and anonymous daily totals may be kept for long-term trend analysis.
- Reviews: published reviews stay on the site until you ask us to remove them or we remove them under our Reviews Policy. Reviews that are started but not verified by email are deleted after 7 days. We keep unpublished or rejected reviews for 12 months so we can enforce the one-review rule and investigate abuse. When a review is removed, we keep your email address and the product reviewed for 12 months to enforce the one-review rule, then delete it.
9. How we protect your information
All traffic to the Website is encrypted (HTTPS). Personal information is stored in access-controlled databases with row-level security, and payment details never touch our systems. Access to personal information within DepositScout is limited to people who need it to do their job.
10. Your rights
Under UK GDPR you have the right to:
- Access — get a copy of the personal information we hold about you.
- Rectification — correct inaccurate or incomplete information.
- Erasure — ask us to delete your information ("right to be forgotten").
- Restriction — ask us to limit how we use your information.
- Portability — receive your information in a machine-readable format.
- Objection — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent (emails, cookies), withdraw it at any time without affecting earlier processing.
To exercise any of these rights, email [email protected]. We respond within one month. You can also unsubscribe from emails using the link in any email or at depositscout.com/unsubscribe.
12. DepositScout Chrome Extension
We do not collect, store, or transmit any personal data, browsing history, or user information through our Chrome extension.
What the extension does:
- Reads public text on UK bank savings pages to detect interest rates (e.g. "4.50% AER").
- Compares detected rates against public market benchmarks (fetched from depositscout.com).
- Shows local analysis ("This beats market leaders") without sending page content or URLs anywhere.
Permissions used:
- storage: Save your banner preferences and 24-hour dismissals locally on your device.
- activeTab: Scan only the page you're currently viewing.
- Bank domains: Inject analysis only on listed UK bank sites.
No tracking, no servers, no third parties.
13. Changes to this policy
We may update this policy as our services or the law change. We will post the updated version here with a new effective date, and for significant changes we will tell subscribers by email.
14. Contact us and how to complain
Questions or concerns about this policy or your personal information? Email [email protected] or write to DepositScout Ltd, 124 City Road, London EC1V 2NX, United Kingdom.
If you are unhappy with how we have handled your information, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113. We would appreciate the chance to resolve your concern first.