Privacy Policy
Who Hasn't Paid Last updated: 8 November 2026
This Privacy Policy explains how WHO HASNT PAID LIMITED ("Who Hasn't Paid", "we", "us", "our") collects, uses, shares and protects personal information when you use the Who Hasn't Paid mobile app, the website at whohasntpaid.com and related services (together, the "Service").
1. Who we are
WHO HASNT PAID LIMITED is a company registered in England and Wales (company number to be confirmed — incorporation in progress). Our registered office address will be published here once incorporation is complete.
We are the "controller" of your personal data for the purposes of the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and, where it applies, the EU General Data Protection Regulation ("EU GDPR"). For California residents, we are a "business" under the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA").
Contact for all privacy matters: info@whohasntpaid.com
Our registration with the UK Information Commissioner's Office (ICO) is in progress. We will publish our ICO registration number here once issued.
2. What the Service does
Who Hasn't Paid helps groups plan trips together. Users build a shared itinerary, see who owes what, and the app sends reminders ("nudges") to members who haven't paid their share. We link to third-party booking sites (such as Booking.com) through affiliate links. We do not take, hold or process payments. Any booking or payment you make happens directly with the third party.
3. Information we collect
Information you give us - Account details: your name, email address and phone number. - Trip information: trip names, destinations, dates, itinerary items, notes and the members of each trip. - Money tracking: amounts each member owes and whether they have marked a share as paid. We do not collect bank or card details. - Messages and support requests you send us.
Information about other people you add When you create or organise a trip you may add other people by name, email address or phone number. Please only add people who are happy for you to do so (see section 8).
Information collected automatically - Device and app data: device type, operating system, app version, language, time zone and crash logs. - Push notification tokens, so we can deliver nudges and trip updates to your device. - Usage analytics: which screens and features are used, and when, to help us improve the Service. - Affiliate click tracking: when you tap a link to a partner, we and the partner record that the click came from Who Hasn't Paid, so that we can be paid a commission. This may include a click identifier, the date and time and the trip or listing clicked. Partners may tell us that a booking was made and its commission value; they do not give us your card details. - Website data: IP address and basic server logs needed to run and secure our website.
4. How we use your information and our lawful bases
| Purpose | Lawful basis (UK/EU GDPR) |
|---|---|
| Creating and running your account and trips, showing balances, sending nudges and trip updates you or your organiser have set up | Performance of a contract with you |
| Processing details of trip members added by another user, so the organiser can coordinate the trip | Our legitimate interests (and those of the organiser) in running group trips, balanced against members' rights; members can ask to be removed at any time |
| Push notifications | Performance of a contract; and your device permission, which you can withdraw in your device settings |
| Analytics and improving the Service | Legitimate interests; or consent where required by law (for example for non-essential cookies or similar technologies) |
| Affiliate links and commission tracking | Legitimate interests in funding the Service; consent where required for non-essential tracking technologies |
| Customer support | Performance of a contract and legitimate interests |
| Security, fraud prevention and preventing misuse (for example nudge spam) | Legitimate interests |
| Complying with law, tax and accounting obligations, and handling legal claims | Legal obligation and legitimate interests |
| Telling you about new features (marketing) | Consent, or for existing users, legitimate interests in line with the Privacy and Electronic Communications Regulations; you can opt out at any time |
We do not use your personal data for automated decision-making that has legal or similarly significant effects on you.
5. Who we share information with
We do not sell your personal information for money. We share it only as follows:
- Other members of your trip, who can see your name, your share of costs and your paid status, and the itinerary.
- Service providers (processors) who act on our instructions, including:
- Hosting and website delivery: Vercel Inc. (USA), which runs on Amazon Web Services infrastructure.
- Database hosting: Neon (database service operated on Amazon Web Services infrastructure).
- Push notifications: Apple Push Notification service (Apple Inc.), Firebase Cloud Messaging (Google LLC).
- Analytics and crash reporting: our analytics and crash-reporting provider.
- Email and SMS delivery: our email and SMS delivery providers.
- Our email provider for support correspondence: IONOS.
- Affiliate partners such as Booking.com and other travel partners and the affiliate networks that operate their programmes, which receive click data when you follow one of our links. Once you are on a partner's site, the partner's own privacy policy applies.
- Professional advisers, such as accountants and lawyers.
- Authorities, where the law requires it, or to protect the rights, property or safety of our users or others.
- A buyer or successor, if our business or assets are sold or restructured, subject to this Policy.
6. International transfers
We are based in the UK. Some of our providers process data in the United States and elsewhere. Where personal data is transferred outside the UK or the European Economic Area, we make sure appropriate safeguards are in place, such as the UK–US "Data Bridge" and the EU–US Data Privacy Framework (where the provider is certified), the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards.
7. How long we keep information
- Account data: for as long as your account is active, and deleted within 30 days of you deleting your account, except where we need to keep some information for the reasons below.
- Trip data: for as long as the trip exists in the app. Organisers can delete a trip. Trips are deleted automatically 24 months after the trip's end date unless a member is still using them.
- Details of people added to a trip who never create an account: deleted when the trip is deleted, or sooner on request.
- Push tokens: until you log out, uninstall the app or the token expires.
- Analytics data: kept in identifiable form for up to 26 months.
- Affiliate click and commission records: up to 6 years, for accounting and tax purposes.
- Support emails: up to 2 years after the issue is resolved.
- Backups are overwritten on a rolling basis, normally within 35 days.
8. Adding other people and nudges
When you add someone to a trip, you are responsible for making sure they are happy for you to share their contact details with us and to receive trip messages and reminders. Every nudge we send says who it is from and lets the recipient stop further nudges or ask to be removed. Anyone who receives a message from us can contact info@whohasntpaid.com to have their details removed.
9. Your rights (UK and EU)
You have the right to: - access the personal data we hold about you; - have inaccurate data corrected; - have your data erased; - restrict or object to our processing (including objecting at any time to processing based on legitimate interests and to direct marketing); - data portability; and - withdraw consent at any time, where we rely on consent (this does not affect processing already carried out).
To exercise any right, email info@whohasntpaid.com. We will respond within one month. We may need to confirm your identity first.
Complaints: You have the right to complain to the UK Information Commissioner's Office (ico.org.uk, telephone 0303 123 1113). If you are in the EU, you may also complain to your local data protection authority. We would appreciate the chance to deal with your concerns first.
EU representative: Where required under Article 27 EU GDPR, details of our EU representative will be published here once appointed.
10. Additional information for US and California residents
In the past 12 months we have collected the following categories of personal information: identifiers (name, email, phone number, device identifiers, push tokens, IP address); commercial information (trip details, amounts owed or paid, affiliate clicks and bookings); internet or other electronic network activity (app and website usage); and inferences we may draw about your use of the Service. We collect it from you, from other users who add you to a trip, from your device and from affiliate partners, for the purposes described in section 4. We do not collect sensitive personal information as defined by the CCPA.
We do not sell personal information for money. Some affiliate tracking or analytics could be treated as "sharing" for cross-context behavioural advertising under the CCPA. You can opt out by emailing info@whohasntpaid.com with the subject "Do Not Sell or Share", or by switching off tracking in the app's settings where available. We honour Global Privacy Control signals on our website.
California residents have the right to know what personal information we collect, use and disclose; to delete it; to correct it; to opt out of sale or sharing; to limit the use of sensitive personal information (we do not use it); and not to be discriminated against for exercising these rights. You may use an authorised agent. To make a request, email info@whohasntpaid.com. We will verify your request using information we already hold and respond within 45 days.
Residents of other US states with privacy laws (such as Virginia, Colorado, Connecticut, Utah and Texas) have similar rights and can exercise them the same way. If we decline your request, you can appeal by replying to our decision.
11. Children
The Service is not intended for children. You must be at least 16 years old to use Who Hasn't Paid (and at least 13 in the USA, subject to any higher age required where you live). We do not knowingly collect personal information from children under 13, or from children under 16 in the UK and EU. If you believe a child has given us personal information, contact us and we will delete it.
12. Security
We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls and use of reputable hosting providers. No system is completely secure, so please use a strong password and keep your device secure.
13. Cookies and similar technologies
See our Cookie Notice (also set out in section 14) for how we use cookies on our website and similar technologies in our app.
14. Cookie Notice
Our website at whohasntpaid.com currently uses only strictly necessary technologies needed to deliver the site securely. It does not set advertising cookies.
If we add analytics or affiliate tracking cookies to the website, or similar technologies in the app (such as software development kits that read device identifiers), we will ask for your consent before using any that are not strictly necessary, as required by the Privacy and Electronic Communications Regulations and EU ePrivacy rules, and we will update this notice with a list of what they are, who sets them and how long they last. When you follow an affiliate link to a partner such as Booking.com, the partner may set its own cookies on its site, governed by its own cookie policy.
You can control cookies through your browser settings and the in-app privacy settings.
15. Changes to this Policy
We may update this Policy from time to time. We will post the new version here with a new "Last updated" date and, where changes are significant, tell you in the app or by email.
16. Contact us
WHO HASNT PAID LIMITED Email: info@whohasntpaid.com