Legal

Privacy Policy

Last updated: March 2026  ·  Mortgage Social Pro Limited trading as MortgageSocial ·  UK GDPR compliant

1. Who we are

Mortgage Social Pro Limited trading as MortgageSocial is the data controller for personal data collected through this website and platform.

2. What personal data we collect

• Account data — your full name, email address, mobile number (optional), firm name and FCA reference number
• Billing data — subscription and payment information processed securely by Stripe. We do not store card numbers on our servers
• Content data — posts you generate, approve, edit or schedule through the platform
• FCA compliance audit data — a timestamped record of every post approval, including your name, IP address and device, retained for regulatory purposes under SYSC 9.1
• Usage data — pages visited, features used, login times and browser/device information
• Communications — messages sent to us via the contact form or email

3. Our lawful basis for processing

• Contract performance (Article 6(1)(b)) — to provide the MortgageSocial service, send login links, process subscriptions and generate compliance reports
• Legal obligation (Article 6(1)(c)) — to retain FCA compliance audit records as required by SYSC 9.1 and relevant financial services legislation
• Legitimate interests (Article 6(1)(f)) — to improve the platform, prevent fraud and send service-related communications
• Consent (Article 6(1)(a)) — where you have opted in to rate alert notifications or marketing. You can withdraw consent at any time

4. How we use your personal data

• To create and manage your account
• To send you a secure magic link when you request to log in
• To process your subscription payments through Stripe
• To generate FCA-compliant social media posts using the Anthropic Claude API
• To send your monthly Financial Promotions compliance report (paid plans)
• To send rate alert notifications via email or SMS where you have opted in
• To maintain your FCA post-approval audit trail as required under SYSC 9.1
• To respond to support enquiries
• To improve and develop the platform

5. Third-party processors

We share personal data with the following processors who act on our instructions under data processing agreements:

We do not sell your personal data. We do not use your data for advertising purposes.

6. International data transfers

Some processors are based outside the UK. Where personal data is transferred outside the UK we ensure appropriate safeguards under UK GDPR Article 46, including Standard Contractual Clauses (SCCs) approved by the ICO.

7. Data retention

• Account data — retained for the duration of your subscription and deleted within 90 days of account closure unless legal retention applies
• FCA compliance audit records — retained for a minimum of 6 years from the date of each approved post under SYSC 9.1. These records cannot be deleted within this period
• Billing records — retained for 7 years for HMRC purposes
• Contact enquiries — retained for 2 years
• Marketing consent records — retained until you withdraw consent

8. Your rights under UK GDPR

• Right of access (Article 15) — request a copy of your personal data
• Right to rectification (Article 16) — ask us to correct inaccurate data
• Right to erasure (Article 17) — request deletion. Note: FCA audit records cannot be deleted within the 6-year retention period
• Right to data portability (Article 20) — receive your data in a machine-readable format
• Right to object (Article 21) — object to processing based on legitimate interests
• Right to restrict processing (Article 18) — ask us to limit how we use your data
• Right to withdraw consent (Article 7(3)) — withdraw at any time without affecting prior processing

To exercise any right, email hello@mortgagesocial.co.uk. We will respond within one calendar month as required by UK GDPR Article 12.

9. Cookies

We use essential cookies only — strictly necessary to keep you logged in and maintain your session. We do not use advertising, tracking or analytics cookies and do not share cookie data with third parties for marketing purposes.

10. Security

We implement appropriate technical and organisational measures including encrypted data transmission (HTTPS/TLS), passwordless authentication via magic link, and role-based access controls. In the event of a data breach likely to result in high risk to your rights we will notify you and the ICO within 72 hours as required by UK GDPR Article 33.

11. Compliance disclaimer

12. Changes to this policy

We may update this policy from time to time. Where we make material changes we will notify you by email at least 14 days before the change takes effect. The latest version is always available at mortgagesocial.co.uk/privacy.

13. How to complain

If you have a concern, please contact us first at hello@mortgagesocial.co.uk.

You also have the right to complain to the Information Commissioner's Office (ICO):