Privacy Notice

Who are we?

Truecast is cashflow modelling software for UK financial advisers. It lets advice firms build client plans, run projections and scenarios, review drafts prepared by the firm's own AI assistant and keep a record of their work. Truecast is provided by Wealthcast Ltd, which also provides the Wealthcast personal financial planning app. Truecast has its own website, sign-in and data, separate from Wealthcast.

Wealthcast Ltd is the controller of the personal information described in this notice, except as described under "Information about advisers' clients".

• Legal entity name: Wealthcast Ltd
• Company registration: Registered in England and Wales
• Company number: 17455947
• Registered office: 128 City Road, London, United Kingdom, EC1V 2NX
• ICO registration number: ZC253434
• Email address: support@truecast.co.uk

You can contact us at the above address should you have any questions about this Privacy Notice, or if you would like to exercise any of your rights under data protection laws, which we set out below.

What types of information do we collect from you?

We may collect, use, store and transfer different kinds of personal information about you such as:

Identity, contact and account information: your work email address, the firm you belong to and your role in that firm (administrator, adviser or paraplanner), which your firm's administrator provides when they invite you, and your first and last name where your firm adds them.

Firm details: the firm's name, legal name and branding, including its registered address, FCA firm reference number, authorisation statement, report disclaimer, report text such as risk warnings and introductions, logos, cover image, colours and fonts. For most firms this is business information, but for a sole trader it may be personal information.

Sign-in information: the sign-in method you use (a single-use email link, a passkey or your organisation's Microsoft account). If you add a passkey, we store credential metadata such as the credential ID, public key, authenticator type, nickname and when it was created and last used; we do not store your fingerprint, face, PIN or device unlock secret. If you sign in with Microsoft, see "Microsoft sign-in" below.

Security, session and activity information: records of your sessions and when you were last active, a hash derived from your internet protocol (IP) address that we use to limit repeated sign-in attempts (this is pseudonymised, not anonymous), and records of changes to firm settings, roles and membership. Changes you make to client records are also recorded in an audit trail that we keep for your firm; see "Information about advisers' clients".

AI assistant connection information: if you connect an AI assistant to Truecast, the connection record (including the app's name and the web address it returned to when you approved it) and connection credentials (stored only as one-way hashes), and for each request the tool used, who made it, the outcome, how long it took and when it happened. When it reads client report content, we record the report reference, a fingerprint, the parts sent and the connection used, not a copy of the content. See "AI assistant connections" below.

Technical information: when you visit the Truecast website or use Truecast, our hosting provider Cloudflare processes technical information such as your IP address, browser type and version, operating system and the pages requested, to deliver and protect the service. Our diagnostic logs may also contain account, firm and record reference numbers and, for Microsoft sign-in, technical details such as your organisation's Microsoft tenant ID and the application and permissions requested.

Correspondence and business contact information: your name, job title, firm and contact details, and what you tell us, when you contact us, book a call, ask for a demonstration, discuss using Truecast with us or report a problem. We may also get these details from your colleagues or from public professional sources, such as the FCA register or your firm's website.

Problem reports: if you use "Report a problem" in Truecast, what you write, the page you were on, your user ID, email address, firm and role, your browser and display settings, and recent error messages. We automatically remove client names, email addresses, amounts and similar details where we recognise them, but this does not catch everything, so please leave client details out. Our staff and the AI coding tools we use, from Anthropic and OpenAI, may read your report, and those tools may process it in the United States. What you write is cleared 12 months after the report is closed.

Order Form and notice records: when your firm signs an Order Form with us, we keep the name, role and contact details of the person who signed it and of the person your firm names to receive notices. When Truecast shows you a banner about this Privacy Notice and you close it, we record which version of the notice it referred to and when you closed it.

We do not use analytics, advertising or tracking tools on the Truecast website or in Truecast. Our hosting provider keeps aggregate traffic and performance figures, such as request counts, which do not identify you.

We also collect, use and share aggregated information, such as how many firms use a feature. Aggregated information could be derived from your personal information but is not considered personal information in law as it does not directly or indirectly reveal your identity. If we combine aggregated information with your personal information so that it can identify you, we treat the combined data as personal information in accordance with this notice.

How and why do we use your personal information?

How your information is collected:

• From your firm: your firm's administrator gives us your email address and role when they invite you, and may add your name. The invitation email links to this notice, and Truecast shows a banner linking to it when you first sign in. It is also linked from the sign-in page and the footer.
• When you interact with us: when you sign in and use Truecast, set up a passkey, connect an AI assistant, book a call with us, contact us or correspond with us by email, telephone or any other means.
• From Microsoft: if you sign in with your organisation's Microsoft account, Microsoft confirms your identity to us. See "Microsoft sign-in" below.
• Automatically: as you use Truecast, we record the security, session, activity and technical information described above.

How your information is used:

Data protection laws require us to have a legal basis for everything that we do with your personal information. The ones we rely on are:

• Performance of a contract with you: where you personally have a contract with us, for example because you are a sole trader who has signed an Order Form with us.
• Legitimate interests: most users use Truecast because their firm has a contract with us. We rely on our legitimate interests, and those of your firm, in providing Truecast to your firm, keeping it secure and running our business. We make sure we consider and balance any potential impact on you and your rights before we process your personal information for our legitimate interests.
• Legal obligation: where we need to use your personal information to comply with a legal obligation.
• Consent: we rely on consent only where we ask for your active agreement for a specified purpose. You can withdraw your consent at any time.

We use your personal information in the following ways:

Where we need personal information to provide Truecast and it is not provided, we may not be able to give you access. We will tell you if this is the case.

Automated decision-making

We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

How can you manage your marketing preferences?

We do not currently send marketing emails about Truecast. If we start, we will only send them where the law allows, every message will include a simple way to opt out, and we will update this notice. You will still receive service messages that are needed to provide Truecast, such as sign-in links and changes to our terms.

We do not share your personal information with any third party for their own direct marketing purposes.

What about cookies?

Truecast uses only cookies that are strictly necessary to provide the service you request. They do not need your consent. We do not use analytics, advertising or other optional cookies.

Truecast also stores some information in your browser's local storage so the app works the way you left it. Except as noted below, it stays on your device and is not sent to us:

• a list of up to 50 clients you have opened recently and when, using client reference numbers only (no names), which is cleared when you sign out, so your client list can show them first;
• your display choices for goal-finding and charts, some saved against a client reference number, and your choice of light or dark theme (a problem report you send includes this choice); and
• on our public website, a display setting for the roadmap.

Who do we share your personal information with?

We do not sell your personal information. We share it only where reasonably necessary to provide Truecast and run our business, and we require third parties to respect the security of your personal information and to treat it in accordance with the law. Where providers process personal information only on our behalf, they may not use it for their own purposes.

• Your firm: your firm's administrators can see your name, email address and role, and colleagues can see your name and email address where you are responsible for a client.
• Cloudflare, which hosts Truecast and provides network security and email delivery for sign-in links and invitations.
• Microsoft, which provides our business email and phone, and Microsoft Bookings and Teams for calls you book with us, as our service provider. For the limited service data it uses for its own business operations, Microsoft is an independent controller. When you sign in with your organisation's Microsoft account, Microsoft provides that sign-in service to your organisation under its own terms. Microsoft also stores our encrypted offsite backups of Truecast's databases in its Azure EU regions, as our service provider.
• Our accounting and payment providers, with whom we share billing contact details to invoice your firm and collect payment by Direct Debit. Our Direct Debit provider decides how it uses the payment details it collects, under its own privacy notice.
• AI assistant providers you or your firm choose, when you connect an AI assistant. See "AI assistant connections" below.
• Professional advisers such as lawyers, accountants and insurers, where necessary, for example for the establishment, exercise or defence of legal claims.
• Third parties in case of a legal requirement: where disclosure is required by law or in the context of an investigation, regulatory requirement, judicial proceeding, court order or legal process (including to law enforcement or competent authorities).
• Third parties in case of a corporate transaction: as part of any merger, sale, transfer of our assets, investment, acquisition, insolvency or similar event, including while engaging with actual or potential investors.

What happens if we share your information with organisations outside of the UK?

Truecast's databases and file storage are held in Cloudflare's European Union jurisdiction, and our encrypted offsite backups in Microsoft Azure's EU regions (the Netherlands, with a copy in Ireland). The UK recognises the EU as providing an adequate level of protection for personal information.

Cloudflare is a United States company that processes requests across its global network. Requests may be handled in data centres outside the UK and EU, and technical information such as logs may be processed in other countries, including the United States. Microsoft sign-in may also involve processing outside the UK. Microsoft stores our Microsoft 365 email, calendar, booking and meeting content in the United Kingdom, but may process it outside the UK, including in the United States, using the safeguards described under "Booking a call" below.

Whenever we transfer your personal information out of the UK to service providers, we ensure a similar degree of protection is afforded to it, by relying on UK adequacy regulations or by using standard contractual terms approved for use in the UK. For more information about these safeguards, please contact us at support@truecast.co.uk.

How do we protect your personal information?

We put in place appropriate technical and organisational measures to help protect the security of your personal information. However, please note that no system is ever completely secure.

Our safeguards include: sign-in without passwords, using single-use email links, passkeys or your organisation's Microsoft account; encryption in transit and at rest; storing session, sign-in link, invitation and connection tokens only as one-way hashes; separating each firm's records and checking every request against your firm; role-based permissions; and an append-only audit log of changes to client records.

How long do we keep your personal information for?

We only keep your personal information for as long as reasonably necessary for the purposes we collected it for, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may keep it for longer if there is a complaint or we reasonably believe there is a prospect of litigation.

For further information, please contact us at support@truecast.co.uk.

What are your rights in relation to the personal information we hold?

You have a number of rights under data protection laws in relation to your personal information.

You have the right to:

• Request access to your personal information (commonly known as a "subject access request").
• Request correction of the personal information that we hold about you. Your firm's administrator can also correct your name and role.
• Request erasure of your personal information in certain circumstances. We may not always be able to comply, for example where we need to keep an audit record for your firm or for legal reasons; we will tell you if so.
• Object to processing of your personal information where we are relying on legitimate interests. In some cases, we may have compelling legitimate grounds to continue.
• Object at any time to direct marketing.
• Request the transfer of your personal information to you or to a third party, where this right applies.
• Withdraw consent at any time where we are relying on consent.
• Request restriction of processing of your personal information.

If you wish to exercise any of these rights, please contact us at support@truecast.co.uk.

You will not have to pay a fee to exercise your rights. However, we may charge a reasonable fee, or refuse to comply, if your request is clearly unfounded, repetitive or excessive.

What we may need from you. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Time limit to respond. We try to respond to all legitimate requests within one month. Occasionally it could take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Contact us if you have a question or a complaint

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO) (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us first at support@truecast.co.uk.

Updates to this Privacy Notice

We may update this Privacy Notice from time to time and we keep it under regular review. This version was last updated on 25 October 2026.

Children

Truecast is a professional tool for adults. It is not directed at children, and we do not knowingly collect personal information from children as users. Information about a client's children entered by a firm is covered in "Information about advisers' clients" below.

Third-party links

Our website may include links to third-party websites and services. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

Information about advisers' clients

Advice firms use Truecast to hold and model information about their clients, their clients' families and other people connected to them. For that information, and for the audit trail of changes users make to it, the firm is the controller and Wealthcast Ltd is its processor: we hold and process it only on the firm's instructions, under a data processing agreement, and we do not use it for our own purposes. We do not use it to train artificial intelligence models.

If you are a client of a firm that uses Truecast, the firm's own privacy notice explains how it uses your information, and you should contact the firm to exercise your rights. If you contact us, we will pass your request to the firm.

More about specific features

Microsoft sign-in

If you sign in with your organisation's Microsoft account, we request the standard sign-in permissions (openid, profile and email) and no access to your mail, files, calendar or other Microsoft 365 data. Microsoft sends us your name and email address with its confirmation of who you are. We use the email address, where Microsoft has verified it, to match you to your Truecast account, and we do not store your name or email address from Microsoft. We store your organisation's Microsoft tenant ID, your Microsoft account's unique object ID, whether Microsoft verified your email domain, how and when your account was linked, and when you last signed in this way. Personal Microsoft accounts and guest accounts cannot be used.

If you are an administrator and you approve Truecast for your organisation, we record the organisation's tenant ID, which Truecast firm it is linked to, which Truecast user started the approval and whether it was granted, declined or failed.

AI assistant connections

If you connect an AI assistant or other AI software (for example Microsoft 365 Copilot, or a report-writing application) to Truecast, it can use Truecast within the permissions you approve. It can read the client information and projections needed to answer your request, read client report content and charts if you allow it, save what-if scenarios, and prepare draft client records and proposed updates. Nothing it prepares changes a client's record or plan until a user reviews and saves or applies it in Truecast.

We store the connection record and hashed connection credentials. For each request our log records the tool used, the user and firm, the connection, the outcome, how long it took and when it happened. The log does not contain the content of the request or the result. Drafts, scenarios and notes that the assistant saves in Truecast are kept as part of the firm's client records. The rest of your conversation with the assistant is not sent to Truecast.

The AI assistant is provided to your firm by its own provider under your firm's agreement with that provider. The provider receives the results and handles them under your firm's settings and its own terms. Disconnecting stops further requests but does not delete results already in a conversation; use your AI provider's controls for those.

Truecast supplies its own report content and charts. Any extra wording or changes come from your AI app.

Where your data is stored

Truecast runs on Cloudflare, in an account separate from the Wealthcast consumer app. Its databases and file storage are created in Cloudflare's EU jurisdiction, which is intended to keep the stored records in the EU. Cloudflare may still process requests through its global network, and technical metadata such as logs can have a different location. We do not describe Truecast as an EU-only processing service. Encrypted offsite backups are held in Microsoft Azure in the EU (the Netherlands, with a copy in Ireland).

Staff support access

Our support tools show firm details, settings and branding; users' names, email addresses and roles, how and when they last signed in, how many passkeys they have and their invitations; counts of records; and activity logs that identify records by reference number; and problem reports. Apart from any client details left in a problem report, they do not show the content of client records, and they cannot be used to sign in as you. Our staff can use them to set up, rename, suspend and reinstate firms, publish firm branding, suspend and reinstate users, end a user's sessions, remove a user's passkeys, manage invitations and manage which of our staff have access. Actions our staff take are recorded; when a passkey is removed, the record keeps its credential ID, nickname, authenticator type and dates. Our staff access client information only where needed to operate, secure or restore Truecast, to investigate a problem a firm has reported, or to comply with the law.

Order Forms and notice records

A firm agrees to the Truecast Terms of Service and Data Processing Agreement by signing an Order Form with us. We keep the signed Order Form, including the name, role and contact details of the person who signed it and of the person the firm names to receive notices, so we can show what the firm agreed to and when. When you first sign in, and when we make an important change to this Privacy Notice, Truecast shows a banner linking to it. The banner never stops you using Truecast. If you close it, we record the version of the notice it referred to and when you closed it, so we do not show it again. If someone accepted our Terms in Truecast before we moved to signed Order Forms, we keep that record with our contract records. We rely on legitimate interests for this: keeping a record of our agreement and of the information we have given you.

Booking a call

If you book a call using Book a call or the calendar on our Contact page, Microsoft Bookings collects the details you enter: your name, email address, time zone and chosen time, your firm's name and size, your role and anything you tell us you would like to see. Bookings sends your confirmation from bookings@truecast.co.uk and adds the call to our calendar. Truecast adds nothing about you, your firm or your clients to the booking page. Please do not include information about your clients in your booking.

The call takes place on Microsoft Teams, which handles the name you join with, audio and video during the call, any meeting chat, and attendance details.

The calendar on our Contact page is Microsoft's own booking page shown inside our website. Microsoft may set its own cookies in it, under Microsoft's own privacy statement.

We use these details to arrange and hold the call and to follow up with you about Truecast. We rely on legitimate interests for this: promoting and running our business.

Microsoft provides Microsoft Bookings and Teams to us as our service provider. For the limited service data it uses for its own business operations, Microsoft is an independent controller. We keep booking details, calendar entries, booking emails and meeting chat in Wealthcast Ltd's Microsoft 365 account as correspondence, for 2 years after our last contact. Microsoft stores them in the United Kingdom. Microsoft and its subprocessors may access or process them from other countries, including the United States, to provide and support the service. For those transfers, Microsoft uses the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum, and it is also certified to the UK Extension to the EU-U.S. Data Privacy Framework.