Privacy Policy

1. Who we are

Sarah (sarah-app.com) is operated by Modulus Systems Europe Ltd, a company registered in England and Wales (company number [COMPANY NUMBER]) with its registered office at [REGISTERED OFFICE ADDRESS], United Kingdom. We are the data controller for the personal data described in this policy. Our ICO registration number is [ICO REGISTRATION NUMBER]. You can reach our privacy team at privacy@sarah-app.com.

2. What Sarah does with your data, in one paragraph

Sarah reads your bank account and card data through Open Banking (with your explicit consent, via TrueLayer Limited), combines it with information you type in about your property, mortgage, pensions and investments, and uses it to calculate your net worth and to suggest ways to save money. We do not move money, we do not sell your data, and we do not let third parties pay to influence what Sarah suggests.

3. The data we collect

We do not knowingly collect data from anyone under 18. Sarah is for UK residents aged 18 and over.

4. Open Banking and TrueLayer Limited

Bank connections are provided by TrueLayer Limited, which is authorised by the Financial Conduct Authority as an Account Information Service Provider (FRN 901096). When you connect a bank you are redirected to TrueLayer and then to your bank; Sarah never sees your bank login credentials. TrueLayer processes your data under its own privacy notice, available at truelayer.com. Access is read-only, lasts for the period shown on the consent screen (typically 90 days before you are asked to reconfirm), and you can withdraw it at any time through Sarah, through TrueLayer, or through your bank.

5. Why we are allowed to use your data (lawful bases)

• Contract: providing the Sarah service you signed up for, including account creation, syncing your accounts and generating money moves.
• Consent: accessing your bank data through Open Banking. You can withdraw consent at any time.
• Legitimate interests: keeping the service secure, preventing fraud and abuse, improving how the rules work, and communicating with you about the service. We balance these against your rights.
• Legal obligation: where we must keep or disclose records under UK law.

Where Sarah makes suggestions based on your financial data, this is automated processing that helps you make your own decisions. Sarah does not make decisions with legal or similarly significant effects on you.

6. Who we share it with

• TrueLayer Limited, to obtain your bank data with your consent.
• Google Cloud (Google Ireland Limited / Google LLC), which hosts Sarah and stores your data in the London region.
• Email delivery providers, to send sign-in links and account emails.
• Google, if you choose to sign in with Google, for authentication only.
• Professional advisers, insurers, and authorities where required by law.

We do not sell personal data. We do not share your financial data with advertisers, and we do not accept payment to rank or feature products in your money moves.

7. International transfers

Your data is stored in the United Kingdom (Google Cloud, London). Some providers may process limited data outside the UK; where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement / standard contractual clauses.

8. How long we keep it

• Account and financial data: for as long as you have an account. When you delete your account, or ask us to, we delete it within 30 days, except for records we must keep by law.
• Bank access tokens: deleted immediately when you disconnect a bank or delete your account.
• Security logs: up to 12 months.

9. Your rights

Under UK GDPR you can ask us to: access the data we hold about you; correct it; delete it; restrict or object to how we use it; and give you a copy in a portable format. You can withdraw consent for bank access at any time. To exercise any right, email privacy@sarah-app.com. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

10. Security

Bank tokens are encrypted at rest. Passwords are stored as salted scrypt hashes. All traffic uses HTTPS. Access to production systems is limited to named staff. No system is perfectly secure; if we discover a breach that affects you, we will tell you and the ICO as the law requires.

11. Not financial advice

Sarah's money moves are information to help you make your own decisions. They are not regulated financial advice, and Modulus Systems Europe Ltd is not authorised by the FCA to give advice. Benchmarks and market rates used in calculations may be out of date; always check the current terms of any product before switching.

12. Changes

We will post any changes here and, for material changes, email you. This version is effective 23 September 2026.