Privacy Policy & Data Safeguards

1. Information We Collect

We collect only the minimal data strictly necessary to authenticate your request and verify genuine debt obligations with recognized UK providers:

• Authentication credentials: Verified email address or Google OAuth identity token for session persistence.
• Bill metadata: Registered supplier name (e.g., British Gas, Thames Water, Unite Students, Local Council), outstanding amount, and due date.
• Account reference: Account or invoice reference used to direct sponsor payments to the correct customer ledger.
• Technical telemetry: Anonymized SHA-256 IP hashes and user-agent classifications for 15-minute anti-refresh deduplication and UK jurisdiction geo-fencing.

2. Zero-Custody Financial Security

FullyPays is not a payment intermediary, bank, or crowdfunding custodian. We never collect, process, or store credit card numbers, bank debit cards, or banking passwords. Sponsors transfer funds directly to vetted UK utility clearing accounts or guest portals using the requester's reference.

3. Automatic PII Redaction & Public Ledger Masking

Prior to appearing on the public browse feed:

• All personal account numbers are automatically masked (e.g. ****4821).
• Street addresses, flat numbers, and phone numbers are redacted from public summaries.
• Raw statement documents are never served to unauthenticated public visitors.

4. Forensic Fraud Prevention & Hashing

To preserve pilot integrity, statements undergo cryptographic SHA-256 deduplication hashing (market:issuer:amount:reference) and metadata screening to detect altered documents, template generators, and duplicate claims across accounts.

5. Data Retention & Right to Erasure

Requesters retain complete ownership over their submissions. You may withdraw a pending bill at any time from your Dashboard. Withdrawn records are immediately unlisted from the public ledger, and requesters may request permanent deletion under UK GDPR by emailing privacy@fullypays.com.