Privacy Policy

1. Introduction

This privacy notice tells you how we collect and process your personal data when you use the ProfitMIND website (profitmind.co.uk), our advisory services and booking pages, or our sister product forecastly (the cashflow forecasting software). forecastly is a trading name of ProfitMIND Ltd. By using our services, you confirm you are over 18 years of age and entering into the agreement on behalf of yourself or your business.

"ProfitMIND Ltd" is the data controller and is responsible for your personal data (referred to as "we", "us" or "our" in this notice).

Contact details

Legal entity: ProfitMIND Ltd
Trading as: forecastly
Postal address: 4 Capricorn Centre, Cranes Farm Road, Basildon, Essex, SS14 3JJ, United Kingdom
Email: [email protected]
Registered in England and Wales. Reg. no. 09918255

It is important that the information we hold about you is accurate and current. Please update us by email or in your account settings if anything changes.

2. What data we collect, why, and on what lawful basis

Personal data means any information that identifies an individual. We may process the following categories about you:

Enquiry & booking data (ProfitMIND services)

Name, email, phone number, business name, revenue band, and anything you choose to share in the website contact form, the TidyCal booking flow, or the Profit & Cashflow Clarity Check self-assessment.
Purpose: to respond to your enquiry, deliver any session or programme you've booked, and send your Clarity Check report.
Lawful basis: performance of a contract, or our legitimate interest in responding to enquiries.

Account data (forecastly)

Your name, email address, password (stored only as a one-way bcrypt hash — we never see it), business name, and chosen pricing plan.
Purpose: to create and run your account. Lawful basis: performance of a contract.

Financial data you enter (forecastly)

Your business income, costs, opening cash, personal pay, monthly actuals, goals, and any notes you choose to add. This is YOUR business data; we treat it as confidential.
Purpose: to compute your forecast, variance and AI insights, and display them back to you. Lawful basis: performance of a contract.

Payment data

Handled by Stripe (our payment processor). We receive only the limited transaction metadata Stripe shares with us (customer id, plan id, payment status, last 4 digits of card if applicable). We do NOT store your card number.
Purpose: to take payment and reconcile your subscription. Lawful basis: performance of a contract.

Communication data

Any emails or replies you send us, the contents of contact-form submissions, and our responses. Personal email correspondence is handled via our Protonmail account for end-to-end encryption.
Purpose: customer support, record-keeping, and to establish, pursue or defend legal claims. Lawful basis: our legitimate interest in operating the business.

Technical data

Your IP address, browser type, the pages you visit on our site, time-zone settings and similar device data. We use Cloudflare Web Analytics on the ProfitMIND marketing website — a privacy-respecting, cookieless analytics tool that aggregates visitor counts, top pages and referrers WITHOUT collecting personal data, setting cookies, or tracking you across sites. Inside the forecastly application we do NOT currently run any analytics; basic technical logs are kept by our hosting provider (Cloudflare) for security and abuse-prevention.
Purpose: to keep the service running and secure, and to understand which pages our visitors find useful. Lawful basis: our legitimate interest.

Marketing data

If you have opted in via the website or by becoming a customer, we may keep your email address in our MailerLite list to send you product updates and occasional helpful content. You can unsubscribe with one click in any email.
Lawful basis: consent (for marketing-only opt-ins) or our legitimate interest (for product updates to existing customers).

Sensitive data

We do NOT collect or process any sensitive personal data (race, ethnicity, religion, sexual orientation, political opinions, health, biometric data or criminal records).

Automated decision making and AI-generated content

We use AI (Anthropic's Claude model, accessed via Emergent Integrations) in two places:

• Inside forecastly — to generate narrative insights from your forecast and actuals.
• On the ProfitMIND Profit & Cashflow Clarity Check — to generate your personalised Clarity Check report (the headline, summary, strengths, blind spots, recommended next steps and outlook) based on the answers you submit. Only the scoring numbers and your Clarity Check responses are sent at the moment of generation; no other personal identifiers are shared with the AI provider.

These outputs are suggestions and educational insights — they do not produce any legal or financial decision that meaningfully affects you. You always remain in control, and you can email us at [email protected] if you'd like a human review of anything we've produced.

3. How we collect your data

Directly from you — when you fill out the website contact form, book a call via TidyCal, take the Profit & Cashflow Clarity Check, sign up for forecastly, fill out your onboarding wizard, enter actuals, set goals, or contact us by email.

Automatically — basic technical data (IP, browser) when you load the site, and authentication cookies set when you log in to forecastly (see our Cookie Policy).

From third parties we use to run the service:

• TidyCal (calendar booking) — your booking details when you schedule a call with us.
• Web3Forms (contact-form delivery) — when you submit the ProfitMIND website contact form, your name, email and message are sent through Web3Forms to our inbox. Web3Forms acts as a processor and does not retain submissions long-term.
• Stripe (payments) — transaction metadata when you pay or subscribe.
• MailerLite (marketing emails) — subscription status and engagement data if you receive our emails.
• Resend (transactional emails) — delivery status for emails we send you.

4. Marketing communications

We will only send you marketing emails if you have explicitly opted in OR you are an existing customer and we have a legitimate interest in keeping you informed about product changes (under the Privacy and Electronic Communications Regulations). You can unsubscribe at any time using the link in every email, or by emailing [email protected].

Opting out of marketing does NOT affect transactional emails (password resets, payment receipts, account-deletion confirmations, monthly nudges to log your actuals, booking confirmations).

We do not share your personal data with third parties for their own marketing purposes without your express consent.

5. Who we share your data with

We share your data with the following categories of service provider, strictly for the purpose of running the service:

• Cloudflare (Cloudflare, Inc.) — website hosting, CDN, security and bot mitigation. We also use Cloudflare Web Analytics on the ProfitMIND marketing site to understand which pages are visited — no cookies, no personal data, fully aggregated.
• TidyCal — calendar booking and scheduling.
• Web3Forms (Web3Forms.com) — secure contact-form delivery for the ProfitMIND website. Forwards your submission to our inbox; does not store or use it for any other purpose.
• Stripe (Stripe Payments Europe Ltd) — payment processing.
• MailerLite (UAB MailerLite, Lithuania / MailerLite Inc., US) — marketing email delivery.
• Resend (Resend.com Inc., US) — transactional email delivery.
• Protonmail (Proton AG, Switzerland) — encrypted email correspondence.
• Anthropic (via Emergent Integrations) — AI insight generation inside forecastly and on the ProfitMIND Profit & Cashflow Clarity Check. Only the relevant numbers and your submitted answers are sent at the moment of generation. No personal account identifiers are shared.
• MongoDB Atlas — encrypted database hosting (EU region) for forecastly.
• Emergent — application hosting infrastructure.
• Our professional advisers (accountants, lawyers, insurers) when strictly necessary.
• Government bodies where we are required by law to disclose data.

Each of these providers is bound by contract and by data protection law to keep your data secure and use it only for the purposes we instruct. We may also share your data if we sell, transfer or merge parts of our business or our assets. We will require any acquirer to honour this privacy notice.

6. International transfers

Some of our service providers are located outside the UK (notably Cloudflare, Anthropic, MailerLite Inc., Resend in the US, and Protonmail in Switzerland). Where we transfer your personal data outside the UK, we only do so to countries or providers whose data protection standards meet the UK's "not materially lower" test introduced by the Data (Use and Access) Act 2025, and we rely on UK-approved Standard Contractual Clauses, the UK-US Data Bridge, or equivalent safeguards to ensure your data has appropriate legal protection wherever it is processed.

7. Data security

We have implemented technical and organisational measures to protect your data — including bcrypt password hashing, HTTPS everywhere, encrypted database connections, access controls limited to authorised personnel, and a documented incident response procedure. We will notify you and the ICO of any personal data breach where we are required by law.

8. Data retention

We keep your data only for as long as we need it:

• Enquiry data, contact-form submissions and Clarity Check responses: 3 years from your last interaction.
• forecastly account, forecast, actuals and goals data: while your account is active. When you delete your account from inside the app, we permanently erase this data within 24 hours.
• Payment records: 6 years from the last transaction, to comply with HMRC tax record-keeping rules.
• Marketing list: until you unsubscribe.
• Support emails: 3 years from the last response.

When we no longer need your personal data we either delete it or anonymise it for research/statistics.

9. Your legal rights

Under UK GDPR you have the right to:

• Request access to your personal data ("subject access request").
• Request correction of any data we hold that is wrong or incomplete.
• Request erasure of your data (the "right to be forgotten").
• Object to processing where we rely on legitimate interests.
• Request restriction of processing in specific circumstances.
• Request portability — receive your data in a structured, commonly used, machine-readable format.
• Withdraw consent at any time where consent is the lawful basis.

forecastly customers can exercise the right to portability and the right to erasure DIRECTLY from inside the app — profile → "Export my data" or "Delete my account". For any other request, please email [email protected].

We respond to all legitimate requests within one month. Where you make a subject access request, our searches will be reasonable and proportionate to the request, rather than exhaustive. There is no fee unless the request is clearly unfounded, repetitive or excessive.

Complaining directly to us. You also have the right to raise a data protection complaint directly with us under section 164A of the Data Protection Act 2018. To do so, please email [email protected] with "Data protection complaint" in the subject line. We will acknowledge your complaint within 30 days of receipt and respond fully without undue delay. If you remain unhappy after our response, you can escalate the matter to the Information Commissioner's Office (ICO), the UK's data protection regulator — www.ico.org.uk. We would appreciate the chance to address the issue with you first.

10. Third-party links

Our website and emails may include links to third-party websites and tools. We are not responsible for their privacy practices. When you leave our site, please read the privacy notice of every site you visit.

11. Children

ProfitMIND services and forecastly are intended for use by businesses and self-employed adults. We do not knowingly collect data about anyone under the age of 18.

12. Changes to this notice

We may update this privacy notice from time to time. The "Last updated" date at the top of the page reflects the most recent change. Significant changes will be notified to active customers by email.