Privacy Policy

WorryLess Ltd (company number 17160890, registered in England and Wales) is the data controller in respect of all personal data processed through the Ivy application and the worryless.online website. As controller, WorryLess Ltd determines the purposes and means of processing and is responsible for compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

WorryLess Ltd is not required to appoint a Data Protection Officer under Article 37 UK GDPR at its current stage of operations, as it does not process special category data on a large scale as its core activity and is not a public authority. Nonetheless, a designated privacy contact is maintained to handle all data protection matters.

Controller Contact Details

Where WorryLess Ltd engages third-party organisations to process personal data on its behalf (for example, cloud infrastructure or AI service providers), those parties act as data processors under Article 28 UK GDPR contracts and may not process the data for their own purposes. The identity and role of each processor is set out in Section 9.

This policy applies to the processing of personal data by WorryLess Ltd in connection with: the Ivy application (iOS and Android); the worryless.online website including the waitlist and subscription portal; all communications sent by WorryLess Ltd to subscribers, Ivy users, and waitlist members; and any B2B2C engagement where personal data relating to end users is processed.

This policy applies to three distinct categories of data subject, each with independent rights: subscribers, Ivy users, and trusted contacts. Where the subscriber and Ivy user are the same individual, the distinctions remain relevant to understanding what data is collected and on what basis.

This policy does not apply to personal data processed by third-party platforms (Apple, Google, or OpenAI) under their own privacy terms. Links to relevant third-party policies are provided in Section 9.

WorryLess Ltd does not intentionally collect special category personal data as defined in Article 9(1) UK GDPR. However, the nature of the Ivy service — open-ended voice conversations with older adults — creates a material risk of inadvertent collection. The following sets out how this risk is managed.

5.1 Voice data and biometric classification

Voice data constitutes biometric data under Article 9(1) only where it is processed for the purpose of uniquely identifying a natural person (for example, voice-print authentication). Ivy processes voice input solely to understand and respond to the content of what is said — it does not analyse voice characteristics for identification purposes and does not create or retain voice templates. Accordingly, Ivy's processing of voice input does not constitute processing of biometric data for the purposes of Article 9.

If WorryLess Ltd were in future to implement voice-based authentication, this assessment would require revision and explicit Article 9(2) conditions would need to be established before implementation.

5.2 Inadvertent health and welfare disclosures

Ivy users may, in the course of conversation, voluntarily disclose information concerning their health, cognitive capacity, or personal circumstances. WorryLess Ltd cannot prevent such disclosures. Where they occur: the disclosure is recorded within the conversation transcript as part of ordinary processing; it is not extracted, tagged, or used to build a health profile of the user; the lawful basis for this incidental processing is Article 9(2)(c) UK GDPR (vital interests, where the disclosure relates to safety) and Article 9(2)(f) (establishment, exercise or defence of legal claims), supplemented by substantial public interest grounds under Schedule 1, Part 2, paragraph 6 DPA 2018.

5.3 Financial information

In the course of scam-checking interactions, Ivy users may describe financial transactions or account activity. This information is processed as part of the scam assessment only. Users are directed not to share complete bank account numbers, sort codes, PINs, or passwords with Ivy.

Voice and conversation data is the most operationally significant category of personal data processed by WorryLess Ltd. This section provides a complete account of how it is handled at each stage of processing.

6.1 Real-time voice processing

When an Ivy user speaks, audio is transmitted in real time to OpenAI's API via an encrypted connection for speech-to-speech processing and AI response generation. This processing is managed by OpenAI acting as a data processor under a Data Processing Agreement incorporating IDTA-compliant safeguards — see Sections 9 and 11.

WorryLess Ltd operates under OpenAI's Zero Data Retention (ZDR) configuration. Under ZDR, OpenAI does not persist the content of API requests or responses to storage after the response has been returned — conversation content exists only transiently in memory during inference and is not retained by OpenAI in any form thereafter. Under OpenAI's API terms, input data is not used to train OpenAI's models. These measures significantly reduce the data exposure risk associated with US-based processing and are reflected in WorryLess Ltd's Transfer Impact Assessment for this transfer.

6.2 Raw audio retention

WorryLess Ltd does not retain raw audio recordings of conversations with Ivy. Audio exists only during active transmission to and from the OpenAI API and is not stored on WorryLess Ltd's systems or infrastructure.

6.3 Conversation transcripts

A text transcript of each conversation session is stored in WorryLess Ltd's Convex-hosted backend. Transcripts serve three functions: providing Ivy with conversational context in subsequent sessions; enabling subscribers to review recent interactions through the Family dashboard; and supporting WorryLess Ltd's ability to investigate complaints and demonstrate regulatory compliance. Retention of transcripts is governed by the schedule in Section 12.

6.4 Service improvement and anonymisation

WorryLess Ltd uses conversation data to improve Ivy's performance. Before any data is used for this purpose, it undergoes a rigorous anonymisation process designed to meet the ICO's published standard — that is, the risk of re-identification is reduced to a level at which it is no longer reasonably likely. Anonymised data is no longer personal data for the purposes of UK GDPR.

The anonymisation process removes: all names and pronouns that could identify an individual; account and device identifiers; references to specific locations, institutions, or relationships; and any other information that, alone or in combination, could reasonably identify the individual.

Subscribers and Ivy users may opt out of their conversation data being used for service improvement — including in anonymised form — by contacting privacy@worryless.online. Opting out does not affect provision of the service.

7.1 Legitimate Interests Assessment

When relying on Article 6(1)(f), WorryLess Ltd applies a three-part test: (i) identification of a legitimate interest; (ii) necessity — whether processing is required to achieve that interest; and (iii) balancing — whether the interest is overridden by the data subject's interests, rights, or freedoms. Written LIAs are maintained internally for each such processing activity and copies are available to data subjects on request.

7.2 Consent: withdrawal mechanism

Where consent is the lawful basis, it may be withdrawn at any time by: (a) using the unsubscribe link in any marketing email; (b) updating preferences in account settings; or (c) emailing privacy@worryless.online. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal, and does not affect provision of the Ivy service (which is based on contract performance, not consent).

WorryLess Ltd does not sell personal data. It does not share personal data for third-party advertising, data brokering, or commercial profiling. Disclosure occurs only in the following circumstances.

10.1 Trusted contacts

Where a subscriber has designated trusted contacts, those individuals may receive escalation alerts generated by Ivy. Alert content is limited to information reasonably necessary to understand the nature of the escalation. This disclosure is within the scope of the contracted service, and the Ivy user is informed of this feature during onboarding.

10.2 Law enforcement and regulatory authorities

WorryLess Ltd will disclose personal data to law enforcement, regulatory authorities, or courts where required by applicable law, by a court order made under proper legal authority, or by a lawful demand from the ICO. Where legally permitted, WorryLess Ltd will notify the affected data subject of any such disclosure.

10.3 Professional advisers

WorryLess Ltd may disclose personal data to its legal, financial, or insurance advisers where strictly necessary for obtaining professional advice or in connection with legal proceedings. Such advisers are bound by professional duties of confidentiality.

10.4 Business transfers

In the event of a merger, acquisition, asset sale, or other corporate restructuring, personal data may be transferred to the acquiring or successor entity. WorryLess Ltd will provide at least 30 days' written notice to subscribers before any such transfer takes effect, will ensure the receiving entity is bound by obligations no less protective than those in this policy, and will offer subscribers the right to close their accounts and request deletion prior to transfer.

10.5 Emergency services

In circumstances where Ivy identifies an immediate risk to the life or safety of a user or another person, WorryLess Ltd may, where technically feasible, make limited disclosures to emergency services. This processing is based on vital interests under Article 6(1)(d) and, where special category data is involved, Article 9(2)(c) UK GDPR.

Both of WorryLess Ltd's principal infrastructure processors — OpenAI and Convex — are incorporated and operate in the United States. The United States does not benefit from a UK adequacy decision under Article 45 UK GDPR. All personal data transferred to these processors is therefore subject to a restricted transfer under Chapter V UK GDPR, and appropriate safeguards must be in place.

11.1 Transfer mechanism

WorryLess Ltd relies on International Data Transfer Agreements (IDTAs) — the UK mechanism for restricted transfers, issued by the ICO under Section 119A DPA 2018 — as the lawful basis for transfers to OpenAI and Convex. Where a processor has entered into EU Standard Contractual Clauses (SCCs) with WorryLess Ltd, the UK Addendum to those SCCs (issued by the ICO) is applied.

11.2 Transfer Impact Assessments

WorryLess Ltd has conducted Transfer Impact Assessments (TIAs) in respect of transfers to OpenAI and Convex, evaluating the legal environment in the United States (including Section 702 FISA and Executive Order 14086) and the technical and contractual measures in place to protect transferred data. These assessments are maintained internally and updated whenever the legal or operational context changes materially.

In the case of OpenAI, the implementation of Zero Data Retention (ZDR) is a material supplementary measure noted in the TIA: conversation content is not persisted by OpenAI after inference, which substantially limits the window of exposure to any third-party access demand.

11.3 Supplementary measures

• All data transmitted to processors is encrypted in transit using TLS 1.2 or higher
• Data at rest within Convex is encrypted using AES-256
• Access to personal data within processor systems is restricted by role-based access controls
• WorryLess Ltd does not transmit any data to processors beyond the minimum necessary for each processing operation

Copies of the relevant IDTAs or UK Addenda are available to data subjects on written request to privacy@worryless.online.

WorryLess Ltd implements technical and organisational measures appropriate to the risk presented by its processing activities — as required by Article 32 UK GDPR. Given that the service processes conversation data of older adults, including potential disclosures of financial and welfare information, the risk profile is considered moderate-to-high.

13.1 Technical measures

• Encryption in transit: All data transmitted between the application, backend, and processors is encrypted using TLS 1.2 as a minimum
• Encryption at rest: All personal data stored within Convex is encrypted at rest using AES-256
• Authentication: Account access requires email/password credentials; passwords stored as salted cryptographic hashes — never in plain text
• Access controls: Access to personal data is restricted to personnel with a documented operational need, implemented through role-based access controls
• Dependency management: Application dependencies are regularly audited for known vulnerabilities using automated scanning
• Penetration testing: WorryLess Ltd commissions penetration testing of its application and infrastructure before significant releases

13.2 Organisational measures

• Personnel with access to personal data receive data protection training appropriate to their role
• A written incident response procedure is maintained and tested
• Processor contracts are reviewed for security obligations before engagement
• Internal access to production data is logged and periodically reviewed

13.3 Personal data breach response

In the event of a personal data breach, WorryLess Ltd will: (a) contain the breach and assess its scope as rapidly as possible; (b) notify the ICO within 72 hours of becoming aware, where the breach is likely to result in a risk to the rights and freedoms of natural persons — as required by Article 33 UK GDPR; and (c) notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms — as required by Article 34 UK GDPR. All breaches, including those not requiring ICO notification, are documented in WorryLess Ltd's breach register.

Article 35 UK GDPR requires a Data Protection Impact Assessment (DPIA) before commencing processing likely to result in a high risk to the rights and freedoms of natural persons. The ICO's screening criteria include: processing of personal data of vulnerable individuals; systematic monitoring; large-scale processing of sensitive data; and use of new technologies.

WorryLess Ltd's processing activities engage several of these criteria: the Ivy service processes voice and conversation data of older adults using AI inference technology that may include sensitive disclosures. Accordingly, WorryLess Ltd has completed — and maintains — a DPIA covering core Ivy processing operations.

The DPIA is reviewed annually and following any material change to processing operations, the technology stack, or the applicable legal framework. The ICO was not consulted under Article 36 UK GDPR as residual risks were assessed as manageable through the mitigations identified.

All data subjects — subscribers, Ivy users, and trusted contacts — have the rights set out below under UK GDPR. WorryLess Ltd will respond within one calendar month of receipt. Where a request is complex or numerous, this period may be extended by a further two months, with notification provided within the initial month.

Requests should be submitted to privacy@worryless.online. WorryLess Ltd may request evidence of identity before processing, proportionate to the sensitivity of the data involved. No fee is charged unless a request is manifestly unfounded or excessive.

15.1 Rights of Ivy users independent of subscribers

Where the subscriber and Ivy user are different individuals, each holds their rights independently. An Ivy user does not require the subscriber's permission to submit a Subject Access Request or any other rights request in respect of their own personal data. WorryLess Ltd will respond directly to the data subject concerned, subject to identity verification.

15.2 Rights of trusted contacts

Trusted contacts are data subjects in their own right in respect of the contact details held by WorryLess Ltd. They may submit erasure requests or other rights requests at any time. Where a trusted contact requests erasure, WorryLess Ltd will notify the relevant subscriber that the trusted contact designation has been removed.

16.1 Nature of Ivy's outputs

Ivy's responses are generated by an AI language model. They constitute guidance and information — not determinations, decisions, or binding assessments. A scam assessment generated by Ivy (‘this message has the characteristics of a phishing attempt’) is a recommendation that a user may act on or disregard. It does not produce legal effects, restrict access to services, or affect the user's rights or obligations. Accordingly, Ivy's outputs do not constitute automated decision-making within the scope of Article 22 UK GDPR.

16.2 Profiling

WorryLess Ltd does not use personal data to build behavioural, commercial, or predictive profiles of users for purposes beyond service delivery. Usage analytics collected by Convex are used in aggregate to understand product performance — they are not used to profile individual users or to make decisions about them.

16.3 AI transparency

Consistent with the ICO's AI Auditing Framework and the principles of transparency and explainability, WorryLess Ltd acknowledges that: (a) Ivy's responses are AI-generated and may occasionally be inaccurate; (b) Ivy is not a substitute for professional legal, financial, or medical advice; and (c) users are always free to disregard Ivy's guidance and seek human assistance.

WorryLess Ltd's service is designed for, and primarily used by, older adults who may meet the FCA's definition of a vulnerable customer — that is, someone who, due to their personal circumstances, is especially susceptible to harm. While WorryLess Ltd is not an FCA-regulated firm, the FCA Consumer Duty and associated Guidance for Firms on the Fair Treatment of Vulnerable Customers inform our approach to data protection for this population, consistent with the accountability principle in Article 5(2) UK GDPR.

17.1 Principles applied

• Transparency in accessible form: This policy is published in plain English with a clear structure. A summary version and a printed copy are available on request at no charge.
• Independent rights: Ivy users are treated as full data subjects with independent rights — not as dependants of the subscriber. The Family dashboard is disclosed to Ivy users during onboarding; it does not operate covertly.
• Consent to monitoring: Where a subscriber accesses conversation history through the Family dashboard, the Ivy user will have been informed of this feature. WorryLess Ltd does not facilitate undisclosed surveillance of one individual by another.
• Safeguarding threshold: Where Ivy's processing identifies information suggesting a user is at risk of abuse, financial exploitation, or serious self-harm, WorryLess Ltd may alert trusted contacts or, in extremis, relevant authorities. The lawful basis for such disclosure is vital interests (Article 6(1)(d)) and, where applicable, the safeguarding of individuals at risk condition under Schedule 1, Part 2, paragraph 18 DPA 2018.

The worryless.online website uses cookies and similar technologies. The Ivy application uses device identifiers for equivalent purposes. This section constitutes WorryLess Ltd's cookie disclosure under Regulation 6 of the Privacy and Electronic Communications Regulations 2003 (PECR), as amended.

PECR requires informed consent before non-essential cookies are set. WorryLess Ltd obtains this consent through a cookie preference mechanism presented on first visit to worryless.online. Consent is recorded with a timestamp and is refreshed at least annually.

Electronic marketing communications are sent only where: (a) the recipient has provided prior consent under Regulation 6 PECR; or (b) the soft opt-in under Regulation 22 PECR applies (existing customer, similar products/services, opt-out opportunity given at collection and in each communication). WorryLess Ltd does not engage in SMS marketing without explicit consent.

WorryLess Ltd's service is designed for adults aged 18 and over. Both the subscriber role and the Ivy user role are restricted to adults. WorryLess Ltd does not knowingly collect personal data from individuals under the age of 18.

If WorryLess Ltd becomes aware that personal data has been provided by a person under 18, it will delete that data promptly and close any associated account. In practice, given the nature and purpose of the service, no basis for retaining data of a person under 18 is anticipated. If you believe personal data of a person under 18 has been processed by WorryLess Ltd, please contact privacy@worryless.online immediately.

WorryLess Ltd reviews this policy at least annually and following any material change to its processing operations, technology stack, or the applicable legal framework.

20.1 Material changes

A change is material if it: introduces a new processing purpose; identifies a new category of personal data; adds a new processor or third-party recipient; changes the lawful basis for an existing processing activity; alters a retention period; or affects the rights of data subjects in any meaningful way. Material changes will be notified to all subscribers by email not less than 30 days before the change takes effect. Where a material change requires fresh consent, existing consent will not be treated as covering the new processing.

20.2 Non-material changes

Corrections to typographical errors, clarifications that do not alter the substance of the policy, and updates to contact details are non-material changes. These will be made without individual notification, though the ‘Last updated’ date will be revised.

20.3 Continued use

Continued use of the Ivy service following notification of a material change does not constitute consent to new processing. Where a change requires consent, that consent will be sought separately and explicitly.

WorryLess Ltd is committed to handling all data protection queries and complaints promptly, transparently, and in accordance with its obligations under Article 12 UK GDPR.

This policy is governed by the laws of England and Wales. Any dispute arising in connection with this policy is subject to the exclusive jurisdiction of the courts of England and Wales.