Privacy Policy
This policy explains what personal data Throw collects, why, who we share it with and the rights you have. It applies to the Throw app and to this website.
1. Who is responsible for your data
My Task Master Ltd, trading as Throw (company number 16878946, registered office Flat 93 March Court, Warwick Drive, London, England, SW15 6LD), is the data controller. The person responsible for privacy is Mikael Boecasse. Contact: support@mbo9.com.
2. What we collect
Account details: your name, email address, phone number and the sign-in method you use (email code, SMS code, Apple or Google).
Payout details: the sort code and account number (or equivalent) of the bank account where you want to receive payouts, and the name on it. Other members only ever see the last four digits.
Circle activity: the circles you belong to, contribution amounts and dates, payout order, payment status returned by Yapily, receipts, agreement acceptances, reminders, messages in the circle room, disputes and late-payment decisions.
Fee payments: Stripe stores your card. We keep only a Stripe customer reference, the last four digits and the fee record. We never see or store your full card number.
Identity data: when identity verification is switched on, an image of your identity document, a selfie and the result of the check, processed by Stripe Identity on our behalf.
Device data: a push notification token, your device type and operating system version, app version, crash reports and basic usage events so the app works and we can fix problems.
Support: anything you send us when you contact us.
3. Why we use it (lawful bases)
To run your account and your circles, send codes, reminders and receipts, and initiate the payments you ask for: performance of our contract with you (UK GDPR Article 6(1)(b)).
To verify identity, keep transaction records, prevent fraud and money laundering and respond to lawful requests: our legal obligations and those of our regulated partners (Article 6(1)(c)), and our lawful business need to keep members safe (Article 6(1)(f)).
To secure the service, fix bugs and understand how the app is used in aggregate: our lawful business needs (Article 6(1)(f)). We do not use your data for advertising or profiling that has legal effects on you.
To send you product news by email or push: your consent, which you can withdraw at any time in settings (Article 6(1)(a)). Service messages (a code, a payment result, a reminder that you are due) are not marketing and cannot be switched off while you are in an active circle.
Biometric identity checks are special category data. We process them only with your explicit consent (Article 9(2)(a)) at the moment you start a check, and for preventing unlawful acts where the law allows.
4. Who we share it with
We use a small number of providers who process data on our instructions under written contracts:
Supabase (database, authentication and file hosting) in the European Union, region eu-central-1 (Frankfurt).
Yapily Connect Ltd (payment initiation). Yapily receives your bank and payment details to start a transfer and acts as its own controller for that service under its End User Terms.
Stripe Payments UK Ltd / Stripe Inc. (card fee processing and identity verification).
Twilio (SMS verification codes and WhatsApp messages you ask us to send).
Amazon Web Services (Amazon SES email delivery and secrets storage).
Expo (push notification delivery to Apple and Google).
Apple and Google (Sign in with Apple, Google sign-in and app distribution).
Members of your circle see your name, your payment status in that circle and the last four digits of your payout account. There are no public profiles.
We share data with the police, courts, HMRC or regulators when the law requires it, and with a buyer if Throw is sold, on the same terms as this policy. We never sell your personal data.
5. International transfers
Your data is stored in the EU. Some providers (Stripe, Twilio, Amazon Web Services, Expo, Apple and Google) may process data in the United States. Those transfers are covered by the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or by a UK adequacy decision, together with technical protections such as encryption.
6. How long we keep it
Account data: for as long as you have an account, then 30 days after you delete it so we can undo an accidental deletion and finish any open support case.
Transaction records (contributions, payouts, fees, identity check results and the circle records they relate to): 5 years after the transaction, to meet anti-money-laundering record-keeping duties and our partners’ requirements. In these records your personal details are reduced to what the law requires once your account is deleted.
Identity document images: deleted by our provider once the check is complete and the result is recorded, unless the law requires them to be kept longer.
Support emails: 2 years. Crash and usage logs: 90 days.
7. Your rights
Under UK GDPR you can ask us for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or object to how we use it, and receive a copy in a machine-readable format. You can export your data and delete your account directly from your profile in the app. Where we rely on consent, you can withdraw it at any time.
To use any of these rights email support@mbo9.com. We respond within one month. We may ask you to confirm your identity first. We cannot delete records the law requires us to keep, but we will tell you what we are keeping and why.
You have the right to complain to the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF, ico.org.uk, telephone 0303 123 1113. We would appreciate the chance to fix the problem first.
8. Security
All data travels over encrypted connections and is stored encrypted at rest. Access to your circle data is limited by database rules to the members of that circle. Payout account details are stored in restricted tables that the app can write but not read back in full. Sign-in uses one-time codes or Apple and Google sign-in; we never store a password.
9. Children
Throw is for adults. You must be 18 or over to create an account. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.
10. Cookies
The Throw app does not use cookies or tracking pixels. This website uses no cookies and no analytics.
11. Changes to this policy
We will post any changes here and, for material changes, tell you in the app before they take effect. The date at the top shows when this policy was last updated.
12. Contact
My Task Master Ltd, Flat 93 March Court, Warwick Drive, London, England, SW15 6LD. Privacy contact: Mikael Boecasse, support@mbo9.com.