Sign-ups pausedLog in

Explore Zero Debt

Legal

Privacy Policy

This notice explains what personal data Zero Debt collects, how we use it, who we share it with, and the rights you have under UK data protection law, including the UK GDPR and the Data Protection Act 2018.

Last updated 9 October 2026

Legal entity and contact details

The Zero Debt website is operated by CORE ZERO LTD, a private limited company registered in England and Wales (company number 17451720). Registered office: 128 City Road, London, United Kingdom, EC1V 2NX.

For legal, privacy, or service questions, use our contact form.

Who we are

Zero Debt is a UK-based service that provides tools and information to help people understand, plan, and manage debt repayments. This includes public calculators and account-based tools for saving and reviewing plans, with help available through our contact form when needed.

If you create an account, we use your email address to sign you in, help you access your account, and send essential account messages such as verification and password-reset emails.

What we collect

We collect the information needed to run the service, secure accounts, handle billing, and reply to contact requests.

  • Account information such as your email address, generated account reference, account status, verification status, and the preferences you choose. You can find your account reference in Account Settings and use it when contacting support.
  • Profile and preference information such as your chosen currency, theme, reduced-motion setting, marketing preference, and optional display name.
  • Debt-planning data you enter, including debts, bills, payment history, scenarios, snapshots, and related notes. Please do not include health information or other sensitive details, or personal information about other people, in notes or contact messages; the service does not need it.
  • Contact messages, including the information you send us and the details needed to reply.
  • Billing information if you choose a paid plan. Stripe processes payment details for us, and we receive the information needed to manage subscriptions, answer billing enquiries, prevent fraud, and keep required records.
  • Technical and security information such as IP address, device or browser details, and records used to protect the service and investigate misuse.

How we use it

We use personal data to provide the service you ask for, keep accounts secure, operate the website, and meet legal obligations.

  • Contract: to create your account, save your plans, provide calculators and account features, and respond to service requests.
  • Legitimate interests: to secure the service, detect abuse, investigate issues, maintain appropriate records, and keep the platform reliable.
  • Legal obligation: to keep records needed for tax, accounting, fraud prevention, or other legal requirements.
  • Consent: for optional marketing emails if you opt in.

Your email address is the only information you must provide to create an account. Everything else is optional, although some features need the details you choose to enter.

Account emails such as verification, password reset, security, and billing notices are part of the service and are not marketing. Emails about new features and site updates are sent only if you opt in, which is unticked by default at signup. You can turn them off at any time in Account Settings.

Who we share it with

We do not sell personal data. We share data only where it is necessary to run the service or where the law requires it.

  • Hosting, database, and backup providers that keep the website and app running.
  • Stripe for checkout, subscriptions, billing enquiries, and payment-related records.
  • Resend, our email delivery provider, for verification, password reset, and account and service messages.
  • Zoho (Zoho Desk), our support provider, which stores the contact and support requests you send us and our replies, and sends those replies by email.
  • Cloudflare, which carries website traffic to protect and deliver the service and provides Turnstile anti-abuse checks on some forms.
  • Professional advisers, regulators, courts, or law enforcement where disclosure is legally required.

When you pay for a plan, Stripe processes your payment information directly. Zero Debt does not store full payment card details in the app.

Where your data is stored

Our servers and backups are hosted in Germany, within the European Economic Area, which the UK recognises as providing adequate protection for personal data. Support requests are stored by Zoho in its EU data centre.

Stripe (payments) and Resend (email delivery) process data in the United States. Both are certified under the UK Extension to the EU-U.S. Data Privacy Framework, which the UK recognises as providing adequate protection, and their data processing agreements also include the UK International Data Transfer Addendum. Where any other provider processes personal data outside the UK, we rely on UK-approved safeguards such as adequacy regulations or the International Data Transfer Addendum. You can contact us for more information about these safeguards.

How long we keep it

We keep personal data only for as long as it is needed for the purpose it was collected. Our current retention rules include:

  • Active account and planning data is kept while your account remains active.
  • Unverified signups are removed after 2 days if the account is not verified.
  • If you do not use your account for 3 years, we may delete it. We will email you at least 30 days beforehand, and signing in keeps your account. Accounts with a paid plan, or linked to an open support case, dispute, or legal matter, are not deleted this way.
  • Resolved support requests are deleted 12 months after the last activity. Copies in our support provider's backups are removed within a further 90 days. A request linked to an open dispute or legal matter is kept until that matter is closed.
  • Audit logs are kept for 90 days. Server, application and security logs are kept for up to 12 months to protect the service and investigate incidents.
  • Billing and tax records are kept for 6 years from the end of the financial year they relate to, as required by UK tax law.
  • If you have an active Zero Debt Pro subscription, you need to cancel it before deleting your account. Stripe keeps its own billing, tax, and dispute records under its legal obligations.
  • If you delete your account, your user and planning data is removed from active systems, and support requests sent from your account or any email address it has used are deleted from our support system, normally within a day. If you contacted us from a different address, tell us and we will delete those too. Encrypted backups are kept separately for disaster recovery. Deleted data in a backup is not used for normal operations. If we ever need to restore from a backup, we will take steps to make sure deleted accounts are not reinstated. Backup copies expire within 90 days.

Your rights

You can ask to access, correct, delete, restrict, or port your personal data, and you can object to certain processing where the law gives you that right.

You can download a copy of your account and planning data at any time from Account Settings. Where we rely on legitimate interests, you can object to that processing. We will respond to privacy requests within one calendar month and may ask you to confirm your identity before acting on a request.

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automatic security checks, such as rate limits on sign-in attempts, only slow or pause requests and are reviewed by a person if you contact us.

You can also withdraw marketing consent at any time. To make a privacy request, use the contact form.

If you have a concern about how we use your personal data, please contact us first and we will do our best to help. You also have the right to raise a concern with the Information Commissioner's Office at ico.org.uk.

Security

We use technical and organisational measures intended to protect accounts and user data, including authentication controls, security logging, anti-abuse protections, and two-factor authentication for users who choose to enable it. No online service can promise perfect security, so you should also use a strong password, keep your login access private, and enable two-factor authentication if it is appropriate for your account.

Children

Zero Debt is intended for adults aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.

Changes to this policy

We will update this page when the way we use personal data changes, and change the date at the top. If a change is significant, we will tell you before it takes effect.