Privacy Policy

1. Introduction

EQVI LTD ("EQVI," "we," "us," or "our") provides an AI-powered lifestyle personalisation layer embedded within partner banking applications, offering recommendations across nutrition, fashion, travel, and other lifestyle domains. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, and the rights you have over it.

We have designed EQVI so that consent, transparency, and control are built directly into the product experience — not buried in a document you never read. This policy is the detailed reference that sits behind those in-product controls.

2. Who We Are — Data Controller

EQVI LTD is registered in England and Wales (Companies House number 14060750), with its registered office at 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom.

EQVI's role in relation to your data depends on the specific activity, rather than being fixed for all processing:

The precise allocation for a given bank integration is set out in the data processing agreement, controller/processor matrix and data-flow map agreed with that partner bank, which take precedence over this general description for that integration.

Registered jurisdiction: England and Wales, United Kingdom. This policy is governed by UK data protection law, including the UK GDPR and the Data Protection Act 2018, and, where applicable to users in the EEA, EU data protection law.

3. Scope

This policy applies to all users of EQVI's services, whether accessed directly or through a partner bank's application. It covers data collected through conversational interactions, in-app settings, purchase and wardrobe data connections, and related integrations (e.g. merchant partners for grocery or product fulfilment).

This policy governs the service provided by EQVI LTD, the England and Wales-registered entity described in Section 2, to users in the UK and EEA. It does not extend to any separately structured or separately branded product operated in another market, which — if and when launched — will be governed by its own privacy policy appropriate to that market's legal and regulatory requirements.

4. Our Approach: Transparency and Control

Rather than requiring users to complete a static questionnaire, EQVI explains the purpose of each data request in the dialogue itself and gives relevant feedback throughout the personalisation process. For every category of data we request, you can see:

1. what data is being requested;

2. why it is needed;

3. how it will be used and processed;

4. exactly what you are consenting to;

5. how to modify or withdraw your consent;

6. how to access, correct, or delete your data.

These controls are available at any time from Data & Privacy settings within the app.

5. Data We Collect and Why

The table below reflects the main data categories and toggles available in your Data & Privacy settings. Section 5a lists the fuller set of data categories EQVI may process, and Section 5b explains where this data comes from.

EQVI does not request, collect or use medical or health information for personalisation. This includes diagnoses, medical conditions, allergies, symptoms, medication, biometric data, and health or fitness measurements (including sleep, heart rate, calorie or activity data used as an indicator of health or fitness). EQVI does not provide medical advice, diagnose conditions, or make health-related decisions.

EQVI may process food and dietary preferences that you choose to share, such as preferred cuisines, disliked ingredients, or household meal preferences. We use this information only to personalise food recommendations. We do not use these selections to infer your health status, religious beliefs, or other special category data.

5a. Fuller List of Data Categories

Depending on which features you use, EQVI may process:

• Account and profile information (e.g. name, contact details, login identifiers);

• Conversational content you provide when interacting with EQVI;

• Goals and stated preferences (e.g. style, budget, food, household preferences);

• Wardrobe information, including wardrobe photographs and associated image metadata, where you use this feature;

• Sizing and fit preferences you provide;

• Purchase history, where you have authorised this connection;

• Transaction-derived signals passed to us by a partner bank, where authorised;

• Product searches, views, clicks, and recommendation history within EQVI;

• Merchant purchases and related attribution data, where you complete a purchase through EQVI;

• Ratings and feedback you give on recommendations;

• Non-sensitive preferences inferred by EQVI (e.g. likely style, cuisine, or budget preferences) based on the above;

• Device and technical data, IP address, and app logs;

• Push notification identifiers;

• Location data, where a feature that uses it is enabled;

• Your consent and privacy settings.

We do not treat any of the above as special category data, and we do not use it to infer your health, religious beliefs, or other special category data about you.

5b. Where This Data Comes From

We collect personal data:

• directly from you, when you use EQVI or provide information in-app;

• from the partner bank, where you have authorised the connection;

• from merchants involved in a purchase you initiate through EQVI;

• automatically, through your use of the service (e.g. technical and log data);

• from other connected services you choose to link to EQVI;

• as non-sensitive preferences inferred by EQVI from the data listed above.

6. How We Use Your Data

We use your data to:

• generate personalised recommendations (style, nutrition, travel, and other lifestyle content);

• operate, maintain, and improve the EQVI service and its integration with partner banking apps;

• facilitate transactions with merchant partners you choose to purchase through (e.g. recipe ingredient checkout);

• communicate with you about your account, consent status, and — where you have opted in — marketing offers;

• meet legal, regulatory, and security obligations.

We do not sell your personal data to third parties.

6a. AI and Profiling

EQVI uses automated systems, including artificial intelligence, to analyse the preferences, goals and feedback you choose to provide and to generate personalised lifestyle recommendations. This may involve profiling your non-sensitive interests and preferences (for example, likely style, cuisine, or budget preferences).

EQVI does not use health data, and does not make solely automated decisions that determine your eligibility for credit, insurance, banking services, or other products with a legal or similarly significant effect on you. EQVI does not make final decisions on credit eligibility, pricing, insurance underwriting, or access to banking products — these remain decisions for the partner bank or relevant provider.

Where your conversational content or other data is processed by a third-party AI provider on our behalf, that provider is bound by contractual confidentiality and data protection obligations, and your data is not used to train that provider's general-purpose models unless we tell you otherwise. Details of retention periods for conversational data and AI outputs are set out in our retention schedule (Section 9).

You can always see why a recommendation was made, provide feedback on it, and choose not to act on it.

7. Data Sharing and Recipients

We may share data with:

• Partner banks, strictly for the purpose of delivering the embedded EQVI experience within their app, and governed by a data processing agreement;

• Merchant and fulfilment partners (e.g. grocery or retail partners), limited to what is needed to complete a purchase you initiate;

• Service providers who process data on our behalf (hosting, AI providers, analytics, customer support, push notifications, crash and error monitoring), under contractual confidentiality and data protection obligations;

• Regulators or authorities, where required by law.

An up-to-date list of categories of service providers and subprocessors, including the country in which each operates, is available on request from our Data Protection Contact (Section 17).

When you turn off a data category, we stop using it for that purpose going forward. This is different from withdrawing consent, disconnecting a data source, or deleting existing data — see Section 11 for what each of these actions does.

7a. Merchant Purchases and Attribution

Where you complete a purchase through a merchant link or checkout in EQVI, the merchant may receive an identifier that lets them confirm the purchase came through EQVI, and EQVI may receive confirmation that a purchase was completed (which may include the order value) for the purpose of attribution, commission, or cashback where applicable. The merchant acts as a separate data controller for the purchase itself. Attribution data may be used to improve future recommendations, in line with the purposes described in this policy. Partner banks do not receive commission or purchase-value data from EQVI unless separately agreed and disclosed to you.

8. International Data Transfers

If you are located in the UK, and your personal data is transferred outside the UK — including to group entities or service providers operating in other jurisdictions — we rely on appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment and additional technical and organisational measures as needed.

If you are located in the EEA, and your personal data is transferred outside the EEA, we rely on an applicable adequacy decision or, where none applies, EU Standard Contractual Clauses together with a transfer impact assessment and additional safeguards as needed.

Where required because we offer services to, or monitor the behaviour of, individuals in the EEA without an establishment there, we will appoint an EU representative under Article 27 GDPR; contact details for that representative, where applicable, will be provided in Section 17.

Our cloud infrastructure, AI, and analytics providers may be located in the UK, EEA, or other jurisdictions; the countries in which each subprocessor operates are set out in the Subprocessor List referenced in Section 7.

9. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes described in this policy, or as required by law. The table below summarises our general retention approach; exact periods for a given category are set out in our internal retention schedule.

When you delete a data category or your account, the relevant information is removed, or irreversibly de-identified, from our active systems within the period set out in our retention schedule. Residual copies may remain in secure backups until they are removed through our standard backup cycle, and some records may be retained for longer where required by law (e.g. accounting or fraud-prevention records) or to establish, exercise, or defend legal claims.

10. Your Rights

Under UK GDPR, you have the following rights over your personal data:

11. Exercising Your Rights In-App

Most rights can be exercised directly from Data & Privacy settings. These actions are related but not identical, so it is worth understanding the difference:

• Turn off a category — stops EQVI using that category for its associated purpose going forward, without necessarily deleting data already collected;

• Withdraw consent — has the same forward-looking effect as turning off a consent-based category, and is logged as a formal withdrawal of consent;

• Disconnect a source — stops a connected data source (e.g. a linked account) from sending new data to EQVI;

• Delete data — permanently removes a specific data category from our active systems, subject to the backup and legal-retention notes in Section 9;

• Delete account — requests full account and data deletion, subject to the same notes.

For requests that cannot be completed in-app, contact us using the details in Section 17; we will respond within one month, as required by UK GDPR.

12. Data Security

We apply technical and organisational measures — including encryption in transit and at rest, access controls, and regular security review — to protect your data against unauthorised access, loss, or misuse. Further detail is set out in our Security Overview and Technical and Organisational Measures documentation, available to partner banks on request.

13. Children's Privacy and Eligibility

EQVI is not directed at children, and we do not knowingly collect personal data from individuals under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly.

Where EQVI is provided through a partner bank, eligibility to access the service, including any minimum age requirement, may be determined by the partner bank's own terms and account eligibility checks.

14. Cookies, SDKs and Similar Technologies

Where EQVI uses cookies, analytics SDKs, device storage, attribution technologies, push-notification tokens, device identifiers, crash reporting, or similar technologies, details of what is used and how to manage your preferences are set out in our separate Cookie Policy, available on request pending publication.

15. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or legal requirements. Material changes will be communicated in-app before they take effect. The "Effective date" at the top of this document reflects the latest revision.

16. Governing Law

This Privacy Policy explains how we comply with applicable UK data protection law and, where relevant, EU data protection law. Nothing in this policy limits your statutory data protection rights, or your right to lodge a complaint with the competent supervisory authority. Jurisdiction over any contractual disputes relating to your use of EQVI is addressed separately in our Terms of Use.

17. Contact Us

For any questions about this policy or to exercise your data protection rights, contact:

EQVI LTD — Data Protection Contact
Registered office: 167-169 Great Portland Street, Fifth Floor, London, W1W 5PF, United Kingdom
Companies House number: 14060750
Email: privacy@eqvilibria.com

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk.