Privacy Notice
This Privacy Notice explains how THE-BUNCH LIMITED, a company registered in England and Wales with company number 10303631 and registered office at C/O The-Bunch Limited, Spectrum, Bond Street, Bristol, England, BS1 3LG, trading through the hellobill brand collects, uses and shares personal data when you use hellobill.
Contact us about privacy or data rights at dpo@hellobill.com.
1. Data we collect
We may collect and use:
- account details, such as name, email, phone number and login information;
- household and property information;
- supplier, service and contract information;
- connected-account information you authorise us to access;
- payment, bank verification and mandate information processed through GoCardless or Open Banking services;
- action summaries, Letters of Authority, Tier 3 consent records and action history;
- support, complaints and data rights correspondence;
- device, app, security, log and analytics information;
- marketing preferences;
- AI prompt, output and tool-context information needed to provide the hellobill service;
- aggregated or anonymised insight data.
2. How we use personal data
| Purpose | Data used | Lawful basis | Notes |
|---|---|---|---|
| Account creation and service delivery | account, identity, household and service data | Contract | Needed to provide hellobill. |
| Household setup and membership | household and member data | Contract / legitimate interests | Used to manage shared household administration. |
| Proactive monitoring and reminders | renewal dates, supplier changes, deadlines and watches | Contract / legitimate interests | Creates nudges and suggestions only. |
| Supplier contact and Tier 2 admin | supplier/account data and LoA records | Contract / legitimate interests / consent where required | Requires action approval and scoped authority. |
| Tier 3 switching, cancellation or supplier setup | supplier, tariff, contract, payment setup and action consent data | Contract / explicit action instruction / consent where required | Requires Tier 3 action consent. |
| GoCardless, Open Banking and payment setup | bank/account/payment and mandate information | Contract / consent where required by the flow | Used only for approved payment or supplier setup purposes. |
| AI-assisted service | prompt, action context and limited account/service data where required | Contract / legitimate interests | Anthropic is the active AI model provider for hellobill. |
| Human review and quality control | action details, review indicators and reviewer decision | Contract / legitimate interests | Used for high-risk or gated actions. |
| Security, fraud prevention and audit | logs, device/session data and evidence records | Legal obligation / legitimate interests | Used to protect users and the service. |
| Support, complaints and data rights | correspondence and case information | Contract / legal obligation / legitimate interests | Used to respond to requests and disputes. |
| Marketing and partner offers | contact details, preferences and engagement data | Consent or documented soft opt-in | Enforced through communication preference controls. |
| Aggregated/anonymised insights | aggregated usage and supplier/admin trends | Legitimate interests; not personal data if genuinely anonymised | We do not sell personal data as individual leads. |
3. AI processing
hellobill uses AI-assisted tools to provide the service. Anthropic is the active AI model provider for hellobill. We do not use your personal data for model training or fine-tuning unless this is separately approved, documented and disclosed.
4. Automated processing and human review
hellobill uses automated processing to help identify household admin tasks, categorise actions, prioritise issues, prepare suggestions and decide when human review is needed.
hellobill does not make solely automated decisions that have legal or similarly significant effects on you. Actions that may contact a third party, change a contract, set up a payment arrangement, switch supplier, cancel a service or otherwise materially affect you require the relevant authority, consent and/or human review before they are carried out.
5. Secure authorised access
Where you connect an account, provide authority or approve an action, we may access information from suppliers, councils, government portals or other third-party services. Depending on the service, this access may take place through an API, partner integration, user-authorised account access, secure authorised access method or human-assisted process.
We only use these methods within the scope of your authority and the task you approved.
6. Who we share data with
We may share personal data with:
- suppliers or third parties where you approve an action;
- payment and Open Banking providers such as GoCardless;
- AI model providers such as Anthropic;
- hosting, infrastructure, security and monitoring providers;
- communications, support, analytics and CRM providers;
- professional advisers, insurers, auditors and regulators where needed;
- partners where you enter hellobill through a partner flow and the data sharing has been disclosed.
Our current third-party supplier and subprocessor list is available through our Trust Centre.
7. International transfers
Some suppliers and subprocessors may process data outside the UK. Where this happens, we use appropriate safeguards such as adequacy regulations, approved contractual clauses or other lawful transfer mechanisms where required.
8. Cookies and tracking
Our Cookie and Tracking Notice explains how we use cookies, SDKs, pixels, local storage, analytics and similar technologies.
9. Marketing preferences
Marketing consent is captured through hellobill entry points and managed through our communication preference controls. You can unsubscribe or change your preferences at any time.
10. How long we keep data
We keep personal data only for as long as needed for service operation, payment, action evidence, dispute handling, legal/accounting obligations, security and product improvement.
The exact period depends on the type of data and why we need it. Our usual approach is:
| Data type | Typical retention approach |
|---|---|
| Account and household profile data | While your account is active, then up to 6 years where needed for legal, accounting or dispute purposes. |
| Operational supplier or account data snapshots | While needed for the action or service, then normally up to 12 months unless needed for evidence, dispute or legal reasons. |
| Consent records, Letters of Authority and Tier 3 action evidence | Up to 6 years after the action or account closure, because these records prove authority and help resolve disputes. |
| Payment, GoCardless and Open Banking references | While needed for payment, accounting, scheme, dispute or legal purposes, normally up to 6 years where relevant. |
| Support, complaints and data rights records | Normally up to 3 years after closure of the case, unless needed for a legal claim or regulatory issue. |
| Marketing suppression records | As long as needed to honour your opt-out. |
| Security and session logs | Normally up to 12 months unless needed for investigation, security or legal reasons. |
| Analytics and cookie data | As explained in the Cookie and Tracking Notice and preference centre. |
We may keep anonymised data for longer where it no longer identifies you.
11. Your rights
You may have rights to access, correct, delete, restrict or object to certain processing of your personal data, and to receive a copy of certain data in a portable format.
Contact dpo@hellobill.com to exercise data rights. We may need to verify your identity before responding.
12. Complaints
You can contact us at dpo@hellobill.com. You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk.
The ICO's postal address is: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
The life admin assistant that takes the mental load off your hands, so you can get back to the things you love.