Privacy policy

The short version

That is a short list because Nummiro has not launched. The product itself will handle real financial data, and it will have its own, much longer privacy policy. This one covers the website you are reading.

Who we are

This site is operated by [registered company name], registered in [jurisdiction] at[registered address]. For the purposes of data protection law we are the controller of the limited personal data described below.

Nummiro is a personal finance tool. It is not a bank, a broker, or a financial adviser, and it does not hold or move anyone’s money.

What this policy covers

This policy applies to https://nummiro.com and nothing else. It does not cover the Nummiro application, which does not exist yet. When the application becomes available it will be governed by a separate policy published before anyone can sign up, and we will not quietly extend this one to cover it.

What we collect

From your visit to this website, we collect no personal data ourselves. Specifically, and to be concrete about it:

• There are no user accounts, so there is nothing to register and no profile to build.
• There is no analytics software of any kind — no page-view counter, no session recording, no heatmaps, no A/B testing tool.
• There are no advertising or social media tracking pixels, and no conversion tags.
• There is no embedded third-party content: no external fonts, no hosted scripts, no maps, no video players, no comment widgets. Every font, image and script is served from this domain, so your browser makes no requests to anyone else while reading this page.

This is enforced technically, not only by intention: the site is configured to send a Content-Security-Policy header that permits resources from its own origin and nowhere else. Adding a third-party script would visibly break the page, which is the point. That header is applied by our host once the site is deployed — you can check it yourself in your browser’s network inspector.

The waitlist form

The email field on the home page is a placeholder and is not connected to anything. It has no destination address, submitting it is cancelled in the browser, and the page tells you plainly that nothing was sent. No address you type into it is transmitted, logged, or stored — not by us, and not by anyone else. If you have already typed an address into it, nothing happened to it.

When the waitlist starts working, we will replace this section before switching it on, and it will say: what we store (an email address and the date you joined), what we use it for (telling you when Nummiro is ready), how long we keep it, and how to get off the list. We commit now to three things about that future version:

• The address will be used to email you about Nummiro and nothing else. No newsletters you did not ask for, no marketing for other products.
• It will not be sold, rented, shared with advertisers, or uploaded to an advertising platform as a custom audience.
• Every email will have a working one-click unsubscribe, and asking us to delete your address will actually delete it.

Cookies and tracking

This site sets no cookies of its own and uses no local storage, session storage, or browser fingerprinting. There is no cookie banner because there is nothing to consent to — a banner asking permission to do nothing would be theatre.

Our hosting provider may set strictly necessary cookies for security and abuse prevention as part of serving the site. Those are not under our control and are not used to profile you, build an advertising audience, or track you across other websites.

Hosting and server logs

The site is intended to be hosted on Cloudflare, Inc.’s global network, which would act as our processor. To deliver a page and protect a site from attack, their infrastructure necessarily handles technical request data, which may include your IP address, the time of the request, the page requested, and your browser’s user-agent string. If you are reading this somewhere other than our own domain — a preview build, for instance — the host may differ, and we will update this section if the arrangement changes.

We do not intend to receive, query, export, or retain those logs, and we do not plan to run a visitor dashboard. They are held and deleted according to our provider’s own policies, which are published atcloudflare.com/privacypolicy.

Legal bases for processing

Where the UK GDPR or EU GDPR applies, the legal basis we rely on for the request data described above is legitimate interests — specifically, serving a website that works and keeping it available and secure. We think that is a low-impact processing activity that a visitor would reasonably expect, and it is the minimum needed to show you a page at all.

When the waitlist goes live, the legal basis for holding an email address will be consent, given by choosing to submit it, and withdrawable at any time.

How long we keep things

We hold no personal data of our own from this website, so there is nothing for us to retain or delete. Provider-side request logs are retained for their own defined periods, not ours.

Your rights

Depending on where you live, you may have the right to access the personal data an organisation holds about you, to have it corrected or erased, to object to or restrict its processing, and to receive it in a portable form. You also have the right to complain to your data protection authority.

We are being straight with you about one thing here: because we do not hold personal data from this website, a request to access or delete "your data" will most likely be answered with the accurate but unsatisfying reply that there is nothing on file. We would still rather you asked than assumed. The supervisory authority you can complain to is the one for[jurisdiction].

Children

Nummiro is intended for adults managing their own money. This website is not directed at children, and we do not knowingly collect data from anyone — including children — through it.

Changes to this policy

We will update this page when what we do changes, and the "last updated" date at the top will change with it. The commitment we are making is about order of operations: the policy is updated before the behaviour is, not after. If we ever start collecting something, this page will say so first.

Contact us

Privacy questions, requests, or corrections to anything on this page can go to [email protected]. We would genuinely like to hear if you think something here is vague or overstated.