Privacy Policy

SettleWell Ltd ("we," "us," or "our") is committed to protecting your privacy. This policy explains how we collect, use, store, and protect your personal information when you use our website and apps and our related services.

We are a company registered in England and Wales (company number 17333474), with our registered office at Bartle House, 9 Oxford Court, Manchester, England, M2 3WQ. We are the data controller for the personal information described in this policy. We are registered with the Information Commissioner's Office (ICO) under registration number ZC195754.

We process your personal information in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Our privacy-first approach

Privacy is not a footnote for us; it is the point of the product. We built SettleWell to help you understand your immigration journey without having to hand over the most sensitive documents in your life.

We deliberately never ask for, and never collect:

• BRP (Biometric Residence Permit) or eVisa share codes as stored identifiers
• Passport numbers
• National Insurance numbers
• Bank or card details (these go directly to our payment provider; we never see them)
• Your full date of birth where the year alone is enough
• Copies of your documents. We store the data points you tell us (for example, a visa start date), never the underlying documents

Consent and lawful bases

Under UK GDPR we must have a lawful basis for processing your personal information. We rely on the following:

• Performance of a contract: to create and run your account and provide the core service you sign up for.
• Consent: for non-essential communications (product updates, marketing) and non-essential cookies. You will never receive marketing emails unless you have specifically opted in, and you can withdraw consent at any time in your account settings or by contacting us.
• Legitimate interests: to improve and secure the product, prevent fraud and abuse, and understand how the service is used. We balance these interests against your rights.
• Legal obligation: to comply with our legal and regulatory duties.

Information we collect

Information you provide:

• Name and email address when you create an account
• Immigration profile data you choose to enter to get personalised guidance, such as visa type and sub-category, visa start and expiry dates, nationality, absences (dates and rough durations), sponsor company name, and family member context (name, relationship, and year of birth where relevant, never their ID numbers)
• Messages you send through our AI feature ("Ask")
• Payment information when you subscribe to a paid plan (processed by our payment provider; we do not store full card numbers)
• Anything else you choose to tell us through forms or in contacting us

Information collected automatically:

• Device type, browser, and operating system
• Pages visited, features used, and time spent on the platform
• Product-analytics events and session recordings used to understand and improve the experience (see Cookies and analytics below); personal data shown on screen is masked in these recordings
• IP address and approximate (city-level) location
• Referring website or source

How we use your information

• Provide and operate the service: generate personalised settlement timelines, readiness views, absence tracking, alerts, and AI-powered guidance based on the profile you give us
• Send you alerts: visa expiry, ILR eligibility, and relevant rule-change notifications, which are a core part of the service
• Improve the product: analyse usage to fix problems and build new features
• Communicate with you: account and service notifications, and support responses. Non-essential updates only with your opt-in consent
• Process payments: manage subscriptions and billing through our payment processor
• Keep the service secure: detect and prevent fraud, abuse, and unauthorised access
• Meet legal obligations: respond to lawful requests where we are legally required to

We do not sell your personal information, and we never use your immigration profile data for advertising.

How our AI ("Ask") handles your data

SettleWell uses artificial intelligence to help you understand the rules that apply to you. Here is how your data is handled:

• Your messages are used to generate relevant responses within your session. We retain your chat history so you can review past conversations in your account. You can delete conversations.
• No model training. We do not use your messages, immigration profile, or any other personal information to train or fine-tune AI models.
• How answers are generated. Responses are grounded in the information you provide combined with published UK sources (for example GOV.UK / Home Office guidance). Where we cannot ground an answer in a trusted source, we tell you rather than guess.
• Our AI providers. To generate responses, your question and the relevant journey context are processed by specialist AI providers acting as our processors, currently OpenAI and Anthropic for generating answers, and Voyage AI to match your question to the right guidance. They may use your data only to provide this service to us, not for their own purposes and not to train their models. This processing may involve a transfer outside the UK and EU protected by appropriate safeguards (see International transfers).
• Guidance, not advice. All AI outputs are informational only and are not legal or immigration advice. UK immigration advice is regulated; for advice on your situation, always consult an adviser regulated by the Immigration Advice Authority (IAA) or a qualified solicitor.

Data storage and security

Your account and journey data are stored in the European Union (Ireland) with our database provider, and our application runs on servers in the United Kingdom (London). Some processors we rely on (for example our AI providers) may process data elsewhere under the safeguards described in International transfers. We use industry-standard measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Row-level access controls so users can only access their own data, and staff access is limited on a need-to-know basis
• Secure authentication for your account
• Regular review of our security posture

No system is perfectly secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security.

Third parties and processors

We use a small number of trusted service providers to run SettleWell. Rather than build everything ourselves, we rely on established providers for:

• Cloud hosting and database: Supabase (database, in the EU) and Vercel (application hosting, in the UK)
• Payment processing: Stripe; your card details are handled directly by Stripe and never stored on our servers
• Email delivery: Resend, to send account and alert emails
• Product analytics: PostHog (in the EU), to understand usage and improve the experience
• AI processing: OpenAI, Anthropic and Voyage AI, to power the "Ask" feature (see above)

Each provider acts as our processor: they may use your data only to provide their service to us, on our instructions, and not for their own purposes. The one exception is Stripe, which also acts as an independent controller for detecting payment fraud and meeting its own legal and regulatory obligations (for example, anti-money-laundering). We do not share your immigration profile data with third parties for their own purposes.

International transfers

Your account and journey data are stored in the EU (Ireland), and our application runs in the UK, both covered by UK adequacy. Some of our processors (for example, our AI providers) may process data outside the UK and EU. Where they do, we ensure the transfer is protected by an appropriate safeguard recognised under UK GDPR, such as an adequacy decision or an International Data Transfer Agreement / the UK Addendum to the EU Standard Contractual Clauses.

Cookies and analytics

We use essential cookies to keep you logged in and make the platform work. These do not require consent.

We also use product-analytics tools, including session recording, to understand how people use SettleWell and to improve it. These rely on non-essential cookies or similar technologies, which we only set with your consent via our cookie banner. Session recordings mask personal information shown on screen. You can change your cookie choices at any time. We do not use advertising or cross-site tracking cookies. See our Cookie Notice for details.

Your rights

Under UK GDPR you have the right to:

• Access: request a copy of the personal information we hold about you
• Rectification: ask us to correct inaccurate or incomplete information
• Erasure: ask us to delete your account and associated personal data
• Restriction: ask us to limit how we use your data in certain circumstances
• Portability: request a copy of your data in a common, machine-readable format; email us and we'll provide it
• Object: object to processing based on our legitimate interests, and to any direct marketing
• Rights around automated decisions: our guidance is informational and we do not make solely automated decisions that produce legal or similarly significant effects about you; if this ever changes we will tell you and explain your rights
• Withdraw consent: at any time, where we rely on consent
• Complain: to the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have mishandled your data (we'd appreciate the chance to put things right first)

To exercise any of these rights, contact us at support@settlewell.uk.

Data retention

We keep your personal information for as long as your account is active or as needed to provide the service. If you delete your account, we remove your personal data within 30 days, except:

• Aggregated, anonymised data that cannot be linked back to you
• Records we are legally required to keep (e.g. billing records for tax)
• Information needed to resolve disputes or enforce our agreements

Breach notification

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and will inform affected users without undue delay where the risk is high. We maintain an incident-response process and a breach log.

Age

SettleWell is intended for adults managing their own or their family's immigration journey. It is not intended for use by anyone under the age of 18, and we do not knowingly collect personal data from under-18s as account holders. Where you add a dependent who is a minor, you are responsible for that information and confirm you are entitled to provide it.

International users

SettleWell Ltd is a UK company; our application runs in the UK and your account and journey data are stored in the EU (Ireland). If you access the service from elsewhere, your information will be transferred to and processed in these locations. UK and EU data protection law may differ from the law in your country.

Changes to this policy

We may update this policy from time to time. The "Last updated" date shows when it was last revised. We will bring material changes to your attention (by email or a notice on the platform) before we begin any new or materially different processing of your personal information.

Contact us

SettleWell Ltd (company no. 17333474)
Bartle House, 9 Oxford Court, Manchester, England, M2 3WQ
support@settlewell.uk

For privacy matters, email support@settlewell.uk with the subject line "Privacy."

SettleWell provides informational immigration guidance. It is not legal advice and does not provide legal representation. UK immigration advice is regulated; for advice on your situation, consult an adviser regulated by the Immigration Advice Authority (IAA) or a qualified solicitor.