Privacy statement

What we hold, and why

Pegora exists to work out your investment tax and manage your pensions, and it holds only what that takes: your email address (to sign you in — there are no passwords), the details you give us or your documents show (name, date of birth, salary, tax residency, pension and investment records, and your employment history when you share it — employer names and dates), and the conversation history and facts you share with Peggy, our software agent, so she can remember them for you.

PPS and National Insurance numbers are encrypted under an encryption key belonging to you alone before they are stored, and are never displayed back in full. Pension portal usernames are encrypted too, but under our own key rather than yours — the browser extension that fills them in for you has to be able to read them. Documents you upload are read to fill in your records and are not currently retained after reading; if we introduce document storage, this statement will be updated before that happens and stored documents will be encrypted and deletable by you. Our security page sets out exactly what is and is not encrypted.

When an email arrives that we cannot match to any account — a reply from a pension provider that names no case we recognise, for instance — we keep it for up to 30 days so we can work out why the match failed, then delete it automatically.

Who processes it for us

These service providers touch your data, each only for its narrow job:

• Amazon Web Services — runs our servers and database, sends sign-in and reminder emails, and holds the encryption keys described above.
• Anthropic — processes document text and Peggy conversations through its Claude API. Every tax figure is computed by our own rule engine, not by AI.
• Stripe — takes payment for paid plans. Card details go straight to Stripe and never reach us.
• Resend — delivers and receives the correspondence we send to pension providers on your behalf, when you ask us to run a transfer.
• Frankfurter — a public exchange-rate service. It is asked only for a currency and a date; nothing about you is sent.

We do not sell or share your data with anyone else, and there is no advertising or analytics tracking on this site.

Your rights

Under the GDPR you can ask for a copy of everything we hold about you, correct it, or have it deleted entirely. Email us and we will do it — deletion removes your account and every record under it. You can also complain to the Data Protection Commission (dataprotection.ie) if you believe we have handled your data wrongly.

Who is responsible for your data

The trading details for this service are being finalised and will be published here. Until then, requests about your data can be made from the account you signed up with.