Legal

Privacy Policy

Last updated: 12 August 2026

A note on our name. MyPholyo is a trading name of The Portfolio Method Ltd. We previously operated under The Portfolio Method name; the company, the service and your rights are unchanged.

This policy explains what personal data MyPholyo collects, why we collect it, who we share it with, how long we keep it, and the rights you have. It covers our website at mypholyo.com, the MyPholyo web application at app.mypholyo.com, and our iOS and Android applications. We aim to keep personal data to a minimum and we do not sell it.

Who we are

MyPholyo is the trading name of The Portfolio Method Ltd. The Portfolio Method Ltd is the data controller for the personal data described in this policy.

The Portfolio Method Ltd, trading as MyPholyo
Company number: 17056804
71–75 Shelton Street, Covent Garden
London WC2H 9JQ, United Kingdom
Email: hi@mypholyo.com
Telephone: 020 4628 1823

For any privacy question, or to exercise your rights under data protection law, contact us at hi@mypholyo.com.

The data we collect

On the website (mypholyo.com)

Waitlist and marketing: the email address and any other details you choose to give us when you join a waitlist, request information or sign up to receive updates. You can unsubscribe from marketing emails at any time.
Website analytics: where consent is required, we use Google Analytics only if you consent, to understand how people find and use the site. If you do not consent, optional analytics do not run.
Technical data: basic information needed to serve the site securely, such as server request logs held by our hosting provider.

In MyPholyo (web, iOS and Android)

Account and sign-in: your email address and, if you choose Apple or Google sign-in, the verified account identifier and profile details that provider shares with us. We use these details to create or access your account and contact you about it.
Mapper and product data: the answers, rates, check-ins, goals, wins, income streams, notes and other information you enter, together with reports, insights and other outputs generated from that information.
Billing: if you start a trial or subscription on the web, Stripe handles payment details. Where a purchase is offered through a mobile app, the relevant app-store payment provider handles the payment. We do not receive or store your full card number from those providers; we receive subscription status and limited billing information needed to provide and administer your access.
Support and feedback: messages, screenshots or other information you send to us, together with the email address or account details associated with the request.
Push notifications: if you enable notifications in a mobile app, a device push token and related technical information are processed by the relevant mobile-platform notification service so the notification can be delivered. You can turn notifications off at any time in your device settings.
Technical and usage data: basic information needed to operate and secure the service, such as request logs. Only with your consent, we use privacy-focused product analytics (PostHog) and error diagnostics (Sentry) in the browser and mobile apps. We disable session recording, autocapture, performance tracing, and the collection of form bodies, free text, cookies, headers or URL query strings.

For server and edge diagnostics needed to operate and secure the service, we aim to process technical events without account identity or request contents wherever practicable.

How we use personal data and our legal bases

Under the UK GDPR, we rely on the following legal bases where applicable:

To provide MyPholyo: to create and manage your account, process the information you submit, generate reports and insights, and deliver the features you use. Our legal basis is performance of our contract with you.
To take and administer payment: to manage subscriptions, trials, cancellations and refunds. Our legal bases are performance of our contract and, where relevant, compliance with legal obligations such as tax and accounting requirements.
To keep the Services secure and improve them: to prevent abuse, troubleshoot problems, protect our systems and understand how features are performing. Our legal basis is our legitimate interests, balanced against your rights and interests.
For optional analytics, push notifications and marketing: where consent is required, we rely on your consent. You can withdraw consent at any time without affecting processing that took place before withdrawal.
To comply with law and protect legal rights: where necessary to meet a legal obligation or to establish, exercise or defend legal claims.

AI processing

To generate MyPholyo reports, insights, recommendations and coaching content, information you provide may be processed by artificial-intelligence systems, including large language models. This processing takes place server-side through service providers acting on our instructions. We do not intentionally send your information directly from the app on your device to a model provider. AI-generated output can be incomplete or inaccurate and should be used with appropriate judgement.

Who we share personal data with

We share personal data only where needed to operate MyPholyo, provide the service you request, comply with law or protect our rights and users. Our service providers are required to handle personal data only for the agreed purposes and subject to appropriate contractual protections.

cloud hosting, database and infrastructure providers that run the website and applications and store data;
our email marketing platform (Kit), where you have joined a waitlist or subscribed to marketing communications;
payment providers, including Stripe for web payments and, where applicable, the relevant mobile app-store payment provider for purchases made through an app;
email and communications providers used to send sign-in messages, service communications and respond to support requests;
Apple or Google where you choose one of them to verify your identity or sign you into MyPholyo;
Apple, Google or other relevant mobile-platform services where needed to deliver push notifications you have enabled;
AI/model providers used to generate reports, insights and other AI-powered features;
Google Analytics for website analytics, where you consent;
PostHog for product analytics in the app, only if you consent; and
Sentry for scrubbed server diagnostics and, only if you consent, browser and mobile-app diagnostics.

We do not sell your personal data or share it with third parties for their own advertising purposes. We may disclose personal data where required by law, a court or regulator, or where reasonably necessary to protect our legal rights, our users or the public.

International transfers

Some of our service providers may process personal data outside the United Kingdom, including in the United States or the European Economic Area. Where personal data is transferred internationally, we use appropriate safeguards required by applicable data protection law, such as an adequacy decision or approved contractual safeguards, including the UK International Data Transfer Addendum where appropriate.

How long we keep personal data

We keep account and product data for as long as your account is active and for a limited period afterwards where needed to allow reactivation, resolve disputes, maintain security, or meet legal, tax and accounting obligations. We keep marketing and waitlist information until you unsubscribe, ask us to delete it, or it is no longer needed. We delete or anonymise personal data when it is no longer required for the purpose for which it was collected, subject to any legal retention requirement.

Information about cookie and similar-technology lifetimes is available in our Cookie Policy.

Your rights

Subject to applicable law, you may have the right to ask us to access the personal data we hold about you, correct it, delete it, restrict or object to how we use it, or provide it in a portable format. Where we rely on consent, you can withdraw that consent at any time without affecting earlier processing.

To exercise a privacy right, email hi@mypholyo.com. We may need to verify your identity before completing a request.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data-protection regulator, or to another competent data-protection authority where applicable.

Children

MyPholyo is intended for adults aged 18 and over. If you are under 18, you should not create a MyPholyo account or provide personal data through the app. If we learn that we have collected personal data from a child in circumstances where we should not have done so, we will take appropriate steps to delete it.

Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. No online service can guarantee absolute security, but we review and improve our security measures as the service evolves.

Changes to this policy

We may update this Privacy Policy as MyPholyo evolves, our providers change, or legal requirements change. We will update the date at the top of this page and, where a change is significant, provide appropriate notice on the website, in the app or by email.

Contact

Questions, requests or complaints about privacy can be sent to: