Who we are
Wynton is a trading name of WYNTON TECHNOLOGIES LTD, a company registered in England and Wales under number 17461038, with its registered office at 273 Selly Oak Road, Birmingham, B30 1HS. WYNTON TECHNOLOGIES LTD is the data controller for the personal data described in this policy and is registered with the Information Commissioner's Office under registration ZC250041.
You can reach us about anything in this policy at [email protected] or by post at the address above.
What Wynton is
Wynton is a personal finance assistant that lives in WhatsApp. With your permission it reads what your bank shares through Open Banking, watches your spending, and messages you when there is something worth saying. It has read-only access. It cannot make payments, set up direct debits, move money or change anything at your bank.
WYNTON TECHNOLOGIES LTD is an agent of [Provider Name], which is authorised and regulated by the Financial Conduct Authority as an account information service provider under the Payment Services Regulations 2017 (FRN [000000]).
Wynton provides information about your own spending, and may point out ways to save, such as cheaper deals, unused subscriptions or price comparisons. It does not give regulated financial advice — nothing it says is a personal recommendation to buy, switch or cancel a regulated product such as an investment, credit agreement, insurance policy, mortgage or pension. Savings figures are estimates based on your transaction history and third-party pricing at the time of the message.
The data we collect
Your phone number. It is how WhatsApp identifies you, and it is your account with us.
Your name. Wynton asks for it directly, so it can speak to you properly, and keeps it with your account.
Your Gmail, if you connect it. When a question needs email, Wynton asks you to connect Google with read-only Gmail access. Searches retrieve matching messages, including senders, subjects, dates, snippets and available text, to answer your question. Search results are kept with your account and may appear in the conversation. Wynton cannot send, change or delete emails. You can withdraw access in your Google account's connections settings.
No password. We do not collect a password — there is nothing to log into to use Wynton.
Your messages. Everything you send Wynton on WhatsApp: text, reactions, images and voice notes, along with when each message was sent, delivered and read. Voice notes are transcribed so Wynton can read them, and the transcript is kept with the message. Everything Wynton sends you is kept too, so the conversation makes sense next time.
Your bank data. When you connect a bank, it shares the names, types and last four digits of the accounts you choose, and their transactions: the date, amount, currency, merchant and description of each one. We take up to two years of history when you connect, then new transactions as they arrive for as long as the connection lasts. We do not receive your bank login details.
What Wynton works out. To be useful, Wynton sorts your transactions into categories, spots recurring payments and subscriptions, and keeps a running note of what you have told it about your money: limits you have set, merchants you have said to ignore, subscriptions you have decided to keep or cancel, and its own reading of your habits. This note builds up over the life of your account, so Wynton can still answer questions about last year or compare one period with another. It is updated over time.
Your answers and feedback. When Wynton asks you to decide something — keep or cancel a subscription, agree to a spending limit, or similar — we record the choice you made. We also keep anything else you tell Wynton about how it's doing.
How you use Wynton's pages. When Wynton sends you a link to a page such as recap, we record that it was opened, which page it was and the browser used. Each link works once and stops working after a few minutes, whichever comes first, so a leaked link is no use to anyone who finds it.
Server logs. Our servers keep ordinary technical logs, such as the time of a request and any errors, so we can keep the service running. They are kept for a short period and are not used to build a picture of you.
Why we use it, and the legal basis
To provide the service you asked for. Reading your bank data, understanding your messages and replying to them is the service itself. The legal basis is the performance of our contract with you.
With your consent, for your bank connection. Access to your bank is granted by you, through your bank, under the Open Banking rules. It lasts 90 days at most. Wynton, as your account information service provider, will contact you directly to reconfirm it before then, or it lapses. You can withdraw it at any time from your banking app or via Wynton.
To keep Wynton safe and make it better. We look at how Wynton is used, where it goes wrong and what people ask it, so we can fix it and improve it. The legal basis is our legitimate interest in running a reliable service, balanced against your privacy. Where we can, we do this with data that no longer identifies you.
To meet our legal obligations. Occasionally the law requires us to keep or share information, for example to respond to a lawful request from a regulator or a court.
We never sell your data, and we never use it for advertising.
Who sees your data
Wynton is built from a few services, each of which sees only what it needs.
Meta (WhatsApp). Your messages to and from Wynton travel over WhatsApp, which is run by Meta Platforms. WhatsApp's own privacy policy applies to how Meta handles them on its side. We use the WhatsApp Business platform to send and receive them. WhatsApp is a trademark of Meta Platforms, Inc.
Plaid. Your bank connection is made through Plaid, an Open Banking provider authorised and regulated by the Financial Conduct Authority. Plaid handles your consent with your bank and passes us the data your bank shares. Plaid's privacy policy explains what it does with that data.
OpenAI. Wynton's replies are written by a language model run by OpenAI. To write a reply, the model sees your conversation, including images you send and transcripts of your voice notes, the figures from your bank data that it needs to answer, and matching email content when you have connected Gmail and a search is needed. OpenAI also transcribes your voice notes. Under our agreement OpenAI may not use your data to train its models or for any purpose of its own.
Our hosting provider. Wynton runs on servers provided by Railway, in Amsterdam, the Netherlands. Your data is stored there, encrypted at rest.
Merchants. When Wynton points you to a merchant's cancellation page, it gives you a link to the merchant's own website. Nothing about you is sent to the merchant.
None of these providers may use your data for their own purposes. We do not share your data with anyone else, except where the law requires it.
Where your data goes
Some of the providers above process data outside the United Kingdom, including in the United States. Where they do, the transfer is covered by the UK's international data transfer agreement or addendum, or by a UK adequacy decision, so that your data has the same protection it has here.
How long we keep it
While you use Wynton. Your messages, your bank data and what Wynton has worked out from it are kept for as long as you have an account, so that recaps, comparisons and questions about last year still work.
If you disconnect a bank. Wynton stops receiving new data from it immediately. What the bank had already shared stays as history, unless you ask us to delete it.
Images and voice notes. The files themselves are kept only long enough to be read or transcribed, and are removed with the message they belong to. The transcript stays with the conversation.
If you leave. Text Wynton to stop, or email us, and we will delete your account, your messages, your bank data and everything Wynton worked out from it. Aggregated figures that no longer identify you, such as how many people asked a certain kind of question, may be kept for research.
Your rights
Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a form you can take elsewhere. Where we rely on your consent, you can withdraw it at any time.
The quickest way to use most of these rights is to text Wynton. Say "stop" to end the service, "disconnect" to revoke a bank connection, or "delete my data" to have everything removed. For anything else, or if you would rather not go through WhatsApp, email [email protected]. We will answer within one month.
If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would be grateful for the chance to put things right first.
Make complaint under Data (Use and Access) Act 2025.
How we keep it safe
Your data travels over encrypted connections and is stored encrypted. The tokens that let Wynton read your bank are encrypted separately with a key that is not kept with the data. Links Wynton sends you work once and expire within minutes, so even a leaked link can't be reused. Wynton's access to your bank is read-only by design, so even in the worst case nobody could use it to move your money.
About this website
This website does not use analytics cookies. The waitlist form is provided by Tally, whose privacy policy covers the email address and name you give it. Fonts are loaded from Google Fonts.
Children
Wynton is for adults. You must be 18 or over to connect a bank account, and we do not knowingly collect data from anyone younger. If you think a child has used Wynton, email us and we will delete their data.
Changes to this policy
We will update this policy as Wynton grows. If a change matters to you, for instance a new kind of data or a new provider, Wynton will tell you in a message before it takes effect. The date at the top says when it was last changed.