Legal
Privacy Notice
Draft: a lawyer will review this before any real money is used. Last updated 31 October 2026.
Who we are
Oxyile Corporation Ltd ("Oxyile", "we") is the data controller for your personal data. We are registered in England and Wales, company number 16642382. Registered with the Information Commissioner's Office (ICO).
Registered office: Flat 5, 27 Richmond Road, Cardiff CF24 3AQ.
Questions about your data: hello@oxyile.com
What we collect
| What | Details |
|---|---|
| Account | Name, email, phone number, date of birth and your addresses for the last 3 years |
| Identity | ID document, selfie video or photo and proof of address. A person checks these. We do not use automated face recognition. |
| Finances (borrowers and guarantors) | Income, rent or mortgage, bills, debt repayments, dependants, and the result of our affordability check |
| Investor checks | Your investor statement, the figures in it, your quiz answers and the warnings you acknowledged |
| Loans and payments | Loan details, encrypted bank details, Direct Debit mandates and repayment records |
| Messages | Chat messages, feed posts, support chats, contact forms and complaints |
| Security | Scrambled (hashed) internet address, a device code, your browser type and sign-in records |
| Arena | Your name, email, date of birth, game profile, progress and posts |
| Job applicants | Name, email, phone, LinkedIn profile, CV and a score of how well your CV matches the job |
| Waitlist | Name, email, phone, address, whether you want to borrow or invest, your source of income, income bracket, the amount and reason you have in mind, your answers to our questions and, if you press Use Current Location, your location |
Most of this comes from you. Some comes from people connected to a loan, such as a borrower who names you as their guarantor. Oxyile is not connected to a credit reference agency, so no credit search is made today.
Why we use it, and our lawful basis
| Why | Lawful basis |
|---|---|
| Create and run your account, loans, guarantees and investments | Contract |
| Confirm who you are and prevent fraud and money laundering | Legal obligation; legitimate interests (keeping everyone safe from fraud) |
| Check a borrower can afford a loan | Contract; legitimate interests (lending responsibly) |
| Check an investor understands the risks and is the right type of investor | Legitimate interests (protecting investors); legal obligation where the rules apply to us |
| Keep accounts secure: sign-in, new-device alerts and limits on repeated attempts | Legitimate interests (security) |
| Answer questions and handle complaints | Contract; legitimate interests; legal obligation where the rules apply to us |
| Send service emails and notifications | Contract |
| Send waitlist updates | Consent, which you can withdraw at any time |
| Consider a job application | Steps before a contract; legitimate interests (hiring) |
We do not ask for special category data such as health details. Please leave it out of messages and forms. Your selfie and ID are compared by a person, not by technology that identifies people from their features.
Automated decisions
Our affordability check is automatic: it compares your income and costs with the repayments, and it can pass you, send your application to our team, or refuse it. A refusal stops the application going further.
You have the right to a person looking at this decision. Press Ask a person to review on the result screen, or email hello@oxyile.com. You can explain your situation and challenge the result. A member of our team will decide and tell you the outcome.
Two other checks are automatic. Our investor test is marked by software, and you can try again if you do not pass. Software also scores how well a CV matches a job, to help our team sort applications, but a person makes every hiring decision.
Who we share it with
We use these suppliers, who only act on our instructions:
| Supplier | What for |
|---|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Website hosting |
| Resend | Sending email |
| Microsoft 365 | Our company email |
| GoCardless | Direct Debit payments |
| getAddress, postcodes.io, Zippopotam.us and OpenStreetMap Nominatim | Finding an address from what you type |
| Your browser's notification service | Push notifications, only if you turn them on |
We record a fingerprint of some signed agreements on the Polygon public blockchain. A fingerprint is a code that proves a document has not changed. It contains no personal data, and it cannot be removed.
People on a loan see what they need: for example, an investor sees an anonymous label when browsing loans, and a guarantor sees the loan they are guaranteeing. We also share data when the law requires it (for example with the police, HMRC, courts or regulators), with professional advisers, and with a buyer if our business is ever sold. We do not sell your data.
International transfers
Some suppliers may store or access data outside the UK. When they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum. Ask us for a copy of these safeguards.
How long we keep it
| Data | How long |
|---|---|
| ID and money-laundering checks | 5 years after we stop working with you |
| Agreements, repayments, affordability and investor records | 6 years after the agreement ends |
| Complaints | 5 years after the complaint closes |
| Messages and support chats | 6 years if linked to a loan, otherwise 2 years |
| Security records | 12 months |
| Waitlist | Until you ask to leave, or 2 years after you join |
| Job applications | 12 months after our decision |
Your rights
You can ask for a copy of your data, ask us to correct it, delete it or limit how we use it, object to how we use it, and ask for it in a portable form. You can withdraw consent at any time. Some rights are limited, for example when the law says we must keep a record. Email hello@oxyile.com. It is free, and we normally reply within one month.
Complaints
Please tell us first, so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
Cookies, age and changes
We only use the cookies and browser storage the site needs: see our Cookie Notice. Our Android app shows this same website and collects nothing extra. Oxyile is for people aged 18 or over. If this notice changes, we will update the date at the top and tell you about anything important.