Privacy Policy

How it works: Our AI and algorithms review your financial data and goals to identify patterns. For example, if the AI notices your subscription spending has increased, it will generate a 'nudge' or an educational insight to highlight this to you. If you subscribe to Illora Plus or Pro, we also use the information you provide to generate illustrative wealth projections through our financial modelling partner, and to help you build and prioritise your own action set. These outputs are based on the data and assumptions you give us.

Regulatory boundary: Our profiling logic focuses on spending patterns, budgeting, and general financial education. It does not evaluate the merits of, or provide a personal recommendation for, any specific investment, insurance, or regulated financial product.

No solely automated decisions: Illora does not use your personal data to make 'solely automated decisions' that have legal effects or similarly significant impacts on you (such as automatically moving your money, applying for credit on your behalf, or refusing you a service).

Human involvement (Illora Pro): If you subscribe to Illora Pro, a member of the Illora team reviews your finalised plan and Summary Report to confirm it accurately reflects your conversation. This review does not assess whether your plan is suitable for you.

You are in control: All insights provided by the Illora AI Coach are for information and educational purposes only. You are the final decision-maker regarding any financial action you take. If you have questions about how your data is processed by our algorithms, you can contact us at legal@illora.co.uk.

Product quality assurance. To check that our safety guardrails are working correctly and to improve the educational value of our AI, we periodically review chat logs that have been pseudonymised — that is, where direct identifiers such as your name and email address have been removed or masked. This review looks at how our AI performs, not at individual users.

Expert Quality Review (Illora Pro). If you subscribe to Illora Pro, a member of the Illora team will review your finalised plan and Summary Report as part of the service you have requested. This review necessarily involves access to your identifiable financial information, because its purpose is to check that your report accurately reflects your conversation. It is carried out only where you have asked for it.

Confidentiality and access. Access to your data is limited to those who need it to provide the Service or carry out these reviews, and everyone with access is bound by obligations of confidentiality. Your data is accessed through secure internal systems, and we restrict the ability to copy or export it.

Service providers: we may share your personal information with third parties that perform services for us or on our behalf, which may include providing or assisting with data hosting, website and app hosting, AI support tools, financial modelling and forecasting, payment processing, email marketing, customer relationship management, customer support and communications, online surveys, analytics, user engagement and business intelligence tools, online advertising and marketing, technical support, and error reporting and fixing.

Law enforcement, regulators, governmental authorities and other parties for legal reasons: we may share your personal information with third parties if we are legally required to do so, or if we believe, in good faith, that such disclosure is necessary to comply with a legal obligation or request, to enforce our terms and conditions or to protect the rights, property or our safety, or the safety of our users, a third party, or the public.

Professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.

Purchasers and third parties in connection with a business transaction: if we are involved in a merger, acquisition, bankruptcy, reorganisation, partnership, asset sale or other transaction, we may disclose your personal information as part of that transaction.

International Transfers: We may need to transfer your personal data to third party service providers which are located outside the UK. In the event we need to transfer your personal data to a country which is not recognised by the UK government as ensuring an adequate level of protection for personal data, we shall ensure that appropriate safeguards are in place to ensure adequate protection for your personal data (for example, by entering into standard contractual clauses with the recipients of your personal information).

To provide our interactive AI coaching experience, we must process your conversational inputs using our third-party AI providers. We employ automated security layers designed to actively detect and redact sensitive personal identifiers (such as names, account numbers, or National Insurance numbers) before this data leaves our secure environment.

However, because automated systems cannot guarantee the detection of every variation, typo, or contextual disclosure, any text you enter directly into the chat interface may be processed by our AI partners. To protect your privacy in these events, our enterprise agreements strictly prohibit our AI partners from using your conversational data to train, improve, or fine-tune their general AI models. We continuously monitor and improve our redaction systems to minimise this risk.

We hold internal retention schedules setting out the specific periods that apply to each category of data. Where we no longer need your personal data, we will delete it or anonymise it so that it can no longer be linked to you.

Account deletion: You can ask us to delete your account at any time. When you do, we will delete or anonymise your personal data, other than any information we are required to keep to meet a legal or regulatory obligation, or to establish, exercise or defend legal claims. Where we retain anything for those reasons, we keep the minimum necessary and hold it securely.

Under UK data protection law you have a number of rights in relation to your personal data. You have the right to request access to your data, to have inaccurate data corrected, and to have your data erased. You also have the right to request that we restrict our processing of your data, the right to request data portability, the right to object to processing, and the right to withdraw consent at any time where we rely on consent as our lawful basis.

To exercise any of these rights, please contact us at legal@illora.co.uk. Exercising these rights is normally free of charge, unless a request is manifestly unfounded, excessive or repetitive, and we will respond within one calendar month (extendable by a further two months for complex requests, in which case we will tell you why).

Please note that the above rights are not absolute, and we may be entitled to refuse requests wholly or partly where exceptions under applicable law apply. We may refuse a request for erasure, for example, where the processing is necessary to comply with a legal obligation or necessary for the establishment, exercise or defence of legal claims.

If you believe we have processed your data in a way that does not comply with data protection laws, you have the right to make a complaint to the Information Commissioner's Office (ICO) at www.ico.org.uk/make-a-complaint/. We would, however, appreciate the chance to deal with your concerns before you approach the regulator so please first contact us at legal@illora.co.uk.

Where we receive a complaint regarding the processing of your personal data, we will acknowledge receipt of the complaint no later than 30 days from when we received the complaint and, without undue delay, take appropriate steps (making enquiries into the subject matter of the complaint, to the extent appropriate) to respond to the complaint, keeping you up-to-date on the progress and informing you of the outcome of the complaint.