Privacy Policy

Entitld (“we”, “us”) is operated by Entitld Limited. We act as the data controller for the personal data described in this policy. If you have any question about how your data is used, or want to exercise any of the rights below, contact us at hello@entitld.co.uk.

If you just browse the directory — without creating an account — we don't collect anything about you. The eligibility questionnaire and your matches are stored only in your own browser (technically: localStorage), never sent to us, and disappear if you clear your browser data.

If you create an account — we collect your email address and a securely hashed password (handled entirely by our authentication provider, Supabase; we never see or store your password in readable form). Your eligibility questionnaire answers are then saved to your account instead of your browser, so they follow you across devices. Those answers can include:

• which UK nation(s) you or your business operate in
• income band, age band
• whether you're a business owner or self-employed, your industry, and employee count
• your local council
• whether you or someone you're applying on behalf of has a disability or additional support need

A note on disability/additional-needs data specifically: UK data protection law treats this as “special category” data, which gets extra protection. This question is always optional, includes a “prefer not to say” option that we treat identically to not answering at all, and exists purely so we can surface entitlements you might otherwise miss (like Personal Independence Payment or Carer's Allowance) — never for any other purpose. Our legal basis for processing this specific field is your explicit consent, given by choosing to answer it.

If you click “get help with this application” on a listing and optionally leave an email address, that's recorded in our own database (see Data sharing below) — which listing you clicked on, and your email address if you chose to give one. This isn't tied to any account, even if you happen to be signed in, and no live referral partner is confirmed for any listing yet. If we later match your interest to a real advisory partner, we'll only ever do that with your explicit go-ahead, never automatically.

How your matches are generated: the directory matches shown to you are produced automatically from the answers you give, including your disability/additional-needs answer if you choose to provide it. This is a suggestion for things you might want to look into yourself — it doesn't grant, deny, or decide anything about you, and no automated decision with legal or similarly significant effect is made using your data.

• Account and profile data: our legitimate interest in providing the matching service you've asked for, and your consent where you provide it (see the disability/additional-needs note above).
• Marketing/notification emails: your explicit, opt-in consent only — see the next section.

Beyond the account-confirmation email every sign-up requires, we send one further non-optional email — a one-off “your account is live” message once your email is confirmed. This is transactional, not marketing, and every confirmed account gets exactly one.

Everything else is opt-in. Account holders can opt in to an email digest covering new grants or reliefs matching their saved profile, meaningful changes to something already in their matches, and upcoming deadlines — either via a checkbox at sign-up, or later from account settings. Specifically:

• You will only receive these emails if you explicitly opt in yourself — an unticked checkbox at sign-up, or a switch you turn on in account settings. They are off by default, and never enabled just because you created an account.
• Every email includes a working one-click unsubscribe link that requires no login.
• You can withdraw consent at any time from your account settings, and we'll stop immediately.
• We use a third-party email delivery provider (Resend) purely to send these emails on our behalf — see Data sharing below.
• A small amount of technical data (when you were last notified, and a private unsubscribe token) is kept so we know what's genuinely new to tell you about, rather than repeating ourselves, and so the unsubscribe link works without you having to sign in.

We don't sell your data. We share it only with:

• Supabase — our database and authentication provider, hosting your account and profile data, and the “get help with this application” interest data described above (EU-based hosting region).
• Netlify — our hosting provider, which may briefly retain server logs for operational purposes.
• Resend — our email delivery provider, used solely to send the digest emails described above to account holders who have opted in.

If we ever introduce paid referral partnerships (connecting you with an accountant or grant consultant, as described in our disclaimers elsewhere on the site), we will only ever share your details with a specific partner if you explicitly ask to be connected to them — never automatically, and this policy will be updated to describe that flow clearly before it happens.

Supabase stores your account and profile data in a specific region we've chosen (currently the EU), but Supabase itself is a Singapore-incorporated company, and Netlify and Resend are both US-based. Where your data is transferred outside the UK, it's protected by the same safeguards UK GDPR requires of any company doing this — mainly the UK's International Data Transfer Addendum and the EU's Standard Contractual Clauses, and, for Netlify and Resend, also their certification under the UK Extension to the EU-US Data Privacy Framework. You can read each provider's own data processing terms directly: Supabase, Netlify, and Resend.

• Account and profile data: kept for as long as your account exists. If you delete your account, we delete your profile data straightaway from our live database; residual copies in routine backups are purged within 30 days.
• Email digest technical data (when you were last notified, your unsubscribe token): kept only for as long as email notifications stay switched on, and deleted along with the rest of your account data as above.
• “Get help with this application” interest data: not linked to an account, so it isn't covered by account deletion above. We don't currently run automatic deletion on this data — we'll set a fixed retention period once we have a real referral partner and know what a reasonable window looks like in practice.
• Anonymous browsing data: never reaches us — it lives only in your own browser's local storage until you clear it.

Under UK GDPR, you have the right to:

• access the personal data we hold about you
• correct inaccurate data
• request deletion of your account and associated data
• withdraw consent at any time (e.g. for the disability/additional-needs question, or email notifications)
• object to or restrict certain processing
• request a portable copy of your data

To exercise any of these, contact us at hello@entitld.co.uk. We aim to acknowledge your request within 5 working days and respond in full within one calendar month, as required under UK GDPR. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), if you think we've mishandled your data.

We keep this deliberately minimal — no advertising cookies, no cross-site tracking, and no cookie banner, because nothing here needs one.

• Supabase Auth session cookie — essential, keeps you signed in; set only if you create an account; expires when your session ends or you sign out.
• localStorage — not a cookie, but works similarly; stores your onboarding answers in your own browser if you're not signed in, so they're remembered between visits; never sent to us or any third party; stays until you clear your browser data.
• Plausible Analytics — we use this to see aggregate traffic trends (how many people visit, which pages, roughly where from). It doesn't use cookies, doesn't generate any identifier that could track you individually or across visits, and doesn't collect data that could identify you as a person. Hosted in the EU. See Plausible's data policy for exactly what's collected.

This service is not directed at children, and we don't knowingly collect data from anyone under 16.

If we make material changes, we'll update this page and the “last updated” date at the top.