Privacy notice

Last updated: 21 October 2026

Who we are

Payback is run by Aiman Hassanyeh ("we", "us"). We decide how the personal data described here is used, which makes us the controller under UK data protection law. Contact: aiman.hassanyeh@gmail.com

What Payback does

Payback lets someone (the lender) keep a record of money they have lent to friends or family and what has been repaid. The person who borrowed (the borrower) can see that record, confirm each entry or dispute it. Payback does not hold, send or receive money.

What we collect

If you have an account: your email address, and your name if you sign in with Google. We do not store your Google password.
If a lender has recorded a loan with you: the name and email address the lender entered, the entries (amounts, dates and notes), and your confirmations, disputes and the outcomes, each with the date and time.
To keep the service secure: IP addresses and times of sign-in code requests, used to stop abuse.
Cookies: only the ones needed to keep you signed in. We do not use advertising or analytics cookies.

We do not collect bank or card details.

Why we use it, and our lawful basis

To run your account and show you your records: to provide the service you asked for (contract).
To hold records a lender enters about a borrower, email the borrower a sign-in code and let them confirm or dispute: our legitimate interest, and the lender's, in both people having an accurate, agreed record of a private loan. The borrower can see everything recorded about them and challenge it.
To prevent abuse and keep accounts secure: legitimate interests.
To meet legal obligations, if any arise.

We do not sell your data, use it for advertising, profile you or send you marketing.

Who we share it with

The lender and borrower on a receipt can see that receipt's entries, confirmations and disputes.
Service providers who process data for us: Supabase (database and sign-in), Vercel (website hosting), Resend (email delivery), Google (only if you choose Google sign-in) and Twilio (text messages, only if text codes are switched on).
Some of these providers are based in the United States. Where data leaves the UK, it is protected by the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.
Anyone we are legally required to disclose it to.

How long we keep it

Records, confirmations and disputes are kept while the lender keeps the record, because their purpose is to be a lasting, agreed account of a loan.
If an account is deleted, its data is deleted within 30 days, and removed from backups as they are overwritten.
Sign-in code request logs are kept for 30 days.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable format. Email us and we will reply within one month. Some requests may be limited where the data is part of a record the other person also relies on, for example a confirmed receipt; if so we will explain why.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113.

Age

Payback is not for anyone under 18.

Changes

If we change this notice we will update the date above. For significant changes we will tell account holders by email.