Privacy Policy

This Privacy Policy explains how Double AI Limited, trading as Caspian, collects, uses, shares, and protects your personal data. Please read it carefully before using our services.

1. Who We Are

Caspian is operated by Double AI Limited, a company registered in England and Wales (company number 16887230), registered with the Information Commissioner's Office (ICO reference ZC067774). Our registered address is 6 Old Rydon Ley, Exeter, Devon, EX2 7UA.

You can contact us at [email protected].

Caspian is intended for adults aged 18 and over only.

2. Types of Personal Data We Collect

2.1 Account Information

When you register, we collect your name, email address, login credentials, account identifiers, and preferences.

2.2 Financial Account Data

Via open banking connections, we collect account names, identifiers, balances, transaction histories, descriptions, merchant information, and timestamps from your linked financial institutions. Enhanced security controls are applied to this data.

2.3 Manually Entered Financial Data

We collect any transactions, assets, liabilities, income, expenses, and notes that you enter directly into Caspian.

2.4 Transaction Enrichment Data

We process your transaction data to identify merchants, assign categories, detect recurring payments, and surface spending patterns. This enrichment is performed using Ntropy via a secure API integration.

2.5 AI Interaction Data

We collect the questions, prompts, and responses from your interactions with our AI features, along with contextual data such as your goals, plans, and financial circumstances. This information may be stored as contextual memory to personalise your experience.

Our AI features use infrastructure provided by Anthropic, OpenAI, and Google. Caspian does not use your data to train AI models.

2.6 Household Data

If you participate in a shared household environment, financial data and contextual memory may be shared with other household members. If you leave a household, your directly associated data will be deleted within 30 days. Derived insights or aggregated data relating to the household may persist beyond that period.

2.7 Device and Technical Data

We automatically collect your IP address, device type, operating system, app version, browser type, session activity, and diagnostic logs when you use the Services.

2.8 Usage Data

We collect information about pages viewed, features used, actions taken within the app, and performance diagnostics to help us improve the Services.

2.9 Email Receipt Data (Gmail)

If you choose to connect your Gmail inbox, we collect structured receipt information extracted from emails that match your transactions: the email's subject line, sender address, date, merchant name, amounts, and itemised receipt lines. Connecting your inbox is optional and requires your explicit, separate consent. See section 8 for full details of how we handle Gmail data.

3. How We Collect Your Data

• Directly from you— when you register, connect accounts, or interact with features
• From financial institutions— via open banking connections you authorise
• From service providers— enrichment and analytics partners
• Automatically— via cookies, logs, and usage tracking when you use the Services

4. How We Use Your Data

We use your personal data to:

• Aggregate and display your financial data, including balances and transaction histories
• Categorise transactions, identify merchants, and detect recurring payments
• Generate financial insights, analytics, and projections
• Power AI features and build contextual memory to personalise your experience
• Provide shared household financial views
• Monitor and improve platform performance
• Ensure the security of the Services and prevent fraud
• Comply with legal and regulatory obligations

5. Legal Bases for Processing

• Contract— processing necessary to provide the Services you have signed up for
• Legitimate interests— improving the Services, maintaining security, and preventing fraud
• Consent— open banking connections, third-party integrations, and non-essential cookies
• Legal obligations— where we are required to process data to comply with applicable law

6. Sharing Your Data

We share your data only as necessary with:

• Infrastructure providers— hosting, storage, and cloud services
• Enrichment providers— Ntropy, for transaction categorisation and merchant identification
• AI providers— Anthropic (US), OpenAI (US), and Google (US), for AI features
• Open banking providers— to establish and maintain financial account connections
• Professional advisers— legal, financial, and compliance advisers where necessary
• Authorities— law enforcement or regulators where required by law

We do not sell your personal data.

7. International Transfers

Some of our service providers are located outside the United Kingdom, including our AI providers in the United States. Where we transfer data internationally, we rely on UK adequacy regulations, Standard Contractual Clauses (SCCs), or other approved transfer mechanisms to ensure your data remains protected.

8. Gmail and Google User Data (Limited Use)

Connecting your Gmail inbox is optional. It happens through a separate Google consent screen, and we request read-only access (the gmail.readonly scope) only — Caspian can never send, modify, or delete your email.

When your inbox is connected:

• What we access— we search your inbox for receipts, order confirmations, refunds, and subscription notices that relate to transactions in your connected accounts, and read only the messages that match.
• What we store— a structured summary of each matched email: subject line, sender address, date, merchant, amounts, and itemised receipt lines. We never store the body of your emails, attachments, or personal details from them (names, addresses, phone numbers, order or account identifiers).
• AI processing— matched messages are processed transiently by our AI infrastructure to extract the structured summary above, then discarded. Gmail data is never used to train AI models, ours or anyone else's.
• Retention— extracted receipt summaries are kept for up to 13 months; records of non-receipt emails are kept for up to 30 days so we don't re-process them.
• Disconnecting— when you disconnect your inbox, all extracted email data is deleted immediately and we revoke our access to your Gmail account with Google. You can also revoke access at any time from your Google Account security settings.

We never use Gmail data for advertising, never sell it, and never allow humans to read it except with your explicit consent, where necessary for security or abuse investigation, or where required by law.

Caspian's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

9. Data Retention

• Account information— retained for 30 days after account closure
• Financial account data— retained for 30 days after disconnection
• AI interaction data and contextual memory— retained for 30 days after account closure
• Household data— direct data deleted within 30 days of leaving; derived insights may persist
• Technical and diagnostic logs— retained for 90 days
• Email receipt data (Gmail)— extracted receipt summaries retained for up to 13 months; non-receipt records for up to 30 days; everything deleted immediately on disconnect
• Third-party AI provider data— subject to each provider's own retention terms

10. Data Security

We apply appropriate technical and organisational measures to protect your data, including encryption in transit and at rest, access controls, monitoring, secure infrastructure, and internal data access restrictions. However, no system is 100% secure and we cannot guarantee absolute security.

11. Your Rights

Under UK data protection law, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your personal data in certain circumstances
• Restrict our processing of your data
• Object to processing based on legitimate interests
• Data portability— receive your data in a structured, machine-readable format
• Withdraw consent at any time where processing is based on consent

We will respond to requests within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

12. AI and Automated Processing

Caspian uses machine learning models to analyse your transactions, assign categories, detect spending patterns, generate financial insights, and build contextual memory. These outputs are generated automatically and may be incomplete, inferred, inaccurate, or out of date.

AI-generated outputs are not financial advice. Caspian does not make automated decisions that produce legal effects or similarly significant impacts on you.

13. Cookies

We use the following categories of cookies:

• Strictly necessary— required for login, sessions, and security. These do not require your consent and cannot be disabled without breaking the Services.
• Analytics— help us understand how the Services are used. These require your consent.
• Functionality— remember your preferences and settings. These require your consent.

You can manage cookie preferences via your settings or browser. Blocking strictly necessary cookies may prevent the Services from functioning correctly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Where changes are material, we will notify you with reasonable notice before they take effect.

15. Contact Us

To exercise your rights or make a privacy-related request, please contact us at:

Double AI Limited
6 Old Rydon Ley, Exeter, Devon, EX2 7UA
Email: [email protected]
Please use the subject line "Privacy Request" so we can handle your enquiry promptly.