Legal
Privacy Policy
Last updated: 22 April 2026
1. Who we are
Cambiyo is operated by Fasttrack Pumps Limited (trading as Cambiyo), a company registered in England and Wales under company number 16294467. Our registered office is at Kinetic Business Centre, Theobald Street, Borehamwood, Herts, England, WD6 4PJ.
We are the data controller for personal information collected through cambiyo.app. If you have any questions about this policy or how we handle your data, contact us at privacy@cambiyo.app.
2. What information we collect
We collect the following categories of personal data:
- —Email address: When you join the waitlist or make a pre-launch purchase.
- —Payment information: Stripe processes card details on our behalf. We never see or store your full card number.
- —Referral data: If you were referred by another user, we record the referral code used.
- —Usage and analytics data: Pages visited, time spent, device type, and approximate location via Google Analytics. This is collected in aggregate and linked to your browser, not directly to your name.
- —Communications: Any emails or messages you send us.
3. How we use your information
- —To add you to our waitlist and send you launch communications.
- —To process your pre-launch payment and issue your credit entitlement when the platform goes live.
- —To track referrals and credit you for friends you introduce.
- —To improve the site and understand how users interact with it.
- —To comply with legal obligations, including financial record-keeping.
- —To respond to enquiries or support requests you send us.
4. Legal basis for processing (UK GDPR)
- —Consent: When you submit your email to join the free waitlist, you consent to receive launch updates from us. You can withdraw consent at any time by clicking unsubscribe in any email or contacting us at privacy@cambiyo.app.
- —Contract: When you make a pre-launch purchase, we process your data to fulfil that purchase and deliver the promised credits and benefits at launch.
- —Legitimate interests: We use analytics to understand how our site is used and improve it. We have assessed that this does not override your rights or freedoms.
- —Legal obligation: We are required to retain financial transaction records for up to 7 years under UK tax law.
5. Who we share your data with
We share your data only with trusted third-party processors who act under our instructions:
Stripe
Payment processing. Stripe is PCI-DSS compliant. See stripe.com/privacy.
MailerLite
Email delivery for waitlist communications. See mailerlite.com/legal/privacy-policy.
Supabase
Database hosting and storage. Data is stored on secure cloud infrastructure.
Google Analytics
Anonymised site analytics. You can opt out via Google's opt-out browser add-on or by refusing analytics cookies.
We do not sell your personal data to any third party.
6. International data transfers
Some of our third-party processors operate outside the UK and European Economic Area (EEA), including in the United States. Where data is transferred internationally, we ensure appropriate safeguards are in place — such as Standard Contractual Clauses (SCCs) approved by the UK ICO, or transfers to countries with an adequacy decision. Contact us if you would like more detail on the specific safeguards used.
7. How long we keep your data
- —Waitlist email addresses: Until you unsubscribe or request deletion, or 2 years after our last contact with you — whichever comes first.
- —Payment and transaction records: 7 years from the date of transaction, as required by UK tax law (HMRC).
- —Analytics data: Up to 26 months, in line with Google Analytics defaults.
- —Support correspondence: 2 years from resolution of your query.
8. Your rights
Under UK GDPR, you have the following rights:
- —Access: Request a copy of the personal data we hold about you.
- —Rectification: Ask us to correct inaccurate or incomplete data.
- —Erasure: Ask us to delete your data where we no longer have a lawful basis to hold it.
- —Restriction: Ask us to pause processing while a dispute is resolved.
- —Portability: Receive your data in a structured, machine-readable format.
- —Objection: Object to processing based on legitimate interests (including for direct marketing).
- —Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, email privacy@cambiyo.app. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).
9. Cookies and tracking
We use cookies and similar tracking technologies to operate the site and understand usage patterns. Specifically:
- —Essential cookies: Required for the site to function. These cannot be disabled.
- —Analytics cookies (Google Analytics): Help us understand which pages are visited and how users navigate the site. You can opt out at any time.
By continuing to use the site, you consent to our use of analytics cookies. You can opt out by installing the Google Analytics opt-out browser add-on.
10. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be notified by email to waitlist subscribers or by a prominent notice on the site. The date at the top of this page always reflects the most recent version.
11. Contact us
For any privacy-related queries or to exercise your rights, contact us at:
Fasttrack Pumps Limited (t/a Cambiyo)
Kinetic Business Centre, Theobald Street
Borehamwood, Herts, England, WD6 4PJ