Privacy Notice

Who we are

Grelvio is operated by R.G.B FINANCIALS LTD (“Grelvio”, “we”, “us”), which runs the Grelvio app and website and is the controller of the personal data described in this notice. R.G.B FINANCIALS LTD is registered in England and Wales, company no. 16599011. Registered office: 56 Christie Lane, Salford, England, M7 3BN. Grelvio is a brand and technology platform; it is not a bank and is not itself the authorised provider of the regulated payment or electronic money services behind your account.

Some parts of the service are delivered by other organisations, and their data protection role differs. The authorised payment or electronic money provider behind your account decides how to use the data it needs for its own regulated obligations and is a controller for that data, so its own privacy notice applies in addition to this one. Identity-verification, screening, hosting, communications and AI technology suppliers generally process data on our instructions under contract. Where a supplier also uses data for its own legal or regulatory purposes, it acts as a controller for that use. We identify the relevant provider where we are required to do so, in the app at the point the service is used.

You can contact us about privacy at eliezer@grelvio.com or through the support chat in the app.

The data we process

Depending on how you use Grelvio, we process:

• Identity and verification data: your name, date of birth, nationality, address, identity document images, selfie or liveness checks, and the result of sanctions, PEP and anti-money-laundering screening.
• Account and transaction data: balances, account and payment details, beneficiaries, payment instructions, currency exchanges, standing orders, statements and card activity.
• Contact and profile data: email address, phone number, language and app preferences.
• Device, session and security data: IP address, device and browser information, authentication and passkey/two-factor events, session and login history, and security or fraud signals.
• Support and communications data: messages you send to support, bug or problem reports, and records of emails and notifications we send you.
• AI interaction data: the messages, voice recordings and transcriptions you provide to the in-app AI assistant, and the account context supplied to it so it can answer your questions.
• Compliance and audit data: records of approvals, consents, admin actions and other events we are required to log.

Why we use it and our lawful bases

• To provide the account and process payments you ask for — performance of a contract with you.
• To verify your identity, screen for financial crime, keep audit records and respond to regulators — compliance with a legal obligation, and our legitimate interests in preventing fraud and misuse. Identity checks can involve a facial image used to confirm that you are the person shown on your document, and financial-crime screening can reveal information about alleged or actual offences. Where that kind of data is processed, an additional condition under UK data protection law must apply — for example the prevention or detection of unlawful acts, or another substantial public interest condition — and, where that condition requires it, an appropriate policy document. You can ask us which condition applies to a specific check.
• To keep the service secure, prevent fraud, investigate misuse and enforce our terms — our legitimate interests in protecting customers and the platform.
• To operate AI features, support, service messages, and to improve reliability and usability — our legitimate interests in running and improving the service, or performance of the contract where the feature is part of the service you asked for.
• To send optional communications where consent is required — your consent, which you can withdraw at any time.

Automated decisions and AI

Identity, sanctions and fraud checks involve automated processing, and a check can lead to your application being declined, or a payment being delayed or blocked. Where a decision that produces a legal or similarly significant effect is made solely by automated means, you can ask for human review, express your point of view and contest the decision by contacting us.

Where solely automated decision-making producing legal or similarly significant effects applies to you, we will provide the information required by UK data protection law and you will have the right to obtain human intervention, express your point of view and contest the decision.

The in-app AI Money Assistant provides assistance: it explains information and can prepare an action for you, and a payment you instruct through it is carried out only after you confirm it while signed in and authenticated in the app. AI output can be incomplete or inaccurate and is not personal financial, tax or legal advice. Your messages, any voice recording or transcript, and the account context needed to answer your question are sent to our AI and speech service providers, which process them on our instructions under contract; these providers may process data outside the UK, and the transfer section below applies.

Who we share data with

We share personal data only where necessary, with: the authorised payment or electronic money provider behind your account; identity verification and financial-crime screening providers; cloud hosting, database, email delivery and error-monitoring providers acting on our instructions; AI model and speech providers that process your assistant interactions under contract; professional advisers; and regulators, law enforcement or courts where we are legally required to do so.

We do not sell your personal data, and we do not share it for third-party advertising.

International transfers

Some of our providers may process data outside the UK. Where personal data is transferred outside the UK, we use a lawful transfer mechanism under UK data protection law, such as UK adequacy regulations or appropriate contractual safeguards, as applicable, together with additional measures where needed. You can ask us for details of the safeguards in place.

How long we keep it

We keep personal data for the periods required by applicable law, including anti-money-laundering and payment record-keeping requirements where they apply — such requirements commonly call for records to be kept for five years after the end of a customer relationship — and otherwise only for as long as necessary for the purpose the data was collected for. Security, audit and fraud-prevention logs are kept for as long as needed to investigate and evidence incidents. Support conversations and AI interaction records are kept no longer than necessary unless they form part of a compliance or dispute record.

How we protect it

Access to customer data is restricted and logged, and traffic between your device and our systems is encrypted in transit. Strong authentication is required to sign in and to approve a payment you instruct. One-time codes are verified on our servers and are not stored in the app, and passkey private keys stay on your device. Some information is stored on your device so the app can work — for example a session credential, your language and display preferences, and a cached copy of recent account information; if you use the merchant till, the till key you enter is stored in that browser. Signing out and clearing your browser data removes this. Identity documents and payment infrastructure data are held by the provider that carries out the check or holds the funds, under that provider's own controls, and the precise split depends on the service concerned. No security measure can remove all risk.

Your rights

Under UK data protection law you have the right to access your data, to have inaccurate data corrected, to erasure, restriction or objection in certain circumstances, to data portability, to withdraw consent where processing is based on consent, and to object to direct marketing at any time. Some rights are limited where we must keep records to meet legal or anti-money-laundering obligations.

To exercise any right, contact us at eliezer@grelvio.com or through the support chat in the app. We will respond within one month, and will tell you if we need longer.

Complaints

If you are unhappy with how we handle your personal data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, or at ico.org.uk.

Cookies and similar technologies

We use cookies and local storage that are strictly necessary to sign you in, keep your session secure, remember your language and protect against abuse. We do not use them for advertising.

Changes to this notice

We update this notice when our services or obligations change. Where a change is significant, we will tell you in the app or by email.