Data sharing

Who we share your data with

Nothing about you goes anywhere until you say so. This page lists every outside party, what they get, why they get it and who is responsible for it afterwards — including where we earn a fee. If a partner isn't connected yet, we say that instead of implying otherwise.

See also how BILLOCKS works for the order things happen in, and AI and your documents for how a bill gets read.

Energy suppliers (Power NI, Budget Energy, firmus energy, Energia, Bord Gáis Energy and others)

The company that would supply your gas or electricity

Only when you send it — we never post on your behalf

What they get: Name, email address and mobile number
Address and postcode
Current supplier, meter or keypad number and meter type
How you want to pay, and the account holder's name
Why: So the supplier can set up the tariff you chose without you typing everything again.
Your permission: Your explicit approval on the summary screen, for that supplier and that deal. We ask again for each new application.
Who's responsible after: The supplier. From the moment you send the application, they are the data controller for it and their own privacy notice applies.
What we earn: Some suppliers pay us a fee when a switch completes. It never changes the order deals are shown in, and it is set out on our How we make money page.
If you don't finish: Nothing goes to the supplier. What you typed stays in your own filing cabinet so you can pick it up later, and you can delete it whenever you like.
Worth knowing: We never post to a supplier's form on your behalf. We open their site and lay your details out for you to place, so nothing leaves us until you press their button.

Energy suppliers — applications we lodge for you

Supplier switching queue handled by our own office

Only when you send it — we never post on your behalf

What they get: Name, contact details and address
Meter number and current account number
Chosen supplier, tariff and preferred start date
Why: To lodge the switch you asked for and follow it through to completion.
Your permission: The sharing consent you tick when you confirm the application, kept separately from marketing consent.
Who's responsible after: Us until we hand the application over; the supplier from the point they receive it.
What we earn: Same as above: a completion fee from some suppliers, never a ranking factor.
If you don't finish: The draft stays with us and nothing is lodged. Ask us and we'll delete it, or close your account and it goes with everything else.
Worth knowing: There is no automated supplier API in place today. Applications go into our own operations queue and are lodged by a person, which is why a status can take a day or two to move.

Insurance and broadband quote partner

Regulated comparison panel for car, van, home and travel cover and breakdown

Not connected yet — nothing has been shared

What they get: Nothing yet — no data has been sent to a quote partner
When it goes live: the details you enter on the quote form only
Why: To return real quotes from a panel of providers rather than indicative prices.
Your permission: Explicit approval before the first handoff, on the screen where you choose to see prices. Until that exists in the product, nothing is shared.
Who's responsible after: The panel operator and the chosen insurer, under their own privacy notices, once a quote is requested.
What we earn: A referral fee is expected when a policy is taken out. Insurance comparison here is information, not advice, and we never say a policy is best or right for you.
If you don't finish: The form stays with us, and only with us.
Worth knowing: The screen says the partner is still being connected. We record that you asked to see prices so we can measure demand — that record stays inside BILLOCKS.

TrueLayer

FCA-authorised Open Banking provider (account information only)

Off unless you switch it on

What they get: The bank you choose, and the permission itself
Coming back to us: account names, balances and transactions
Why: So Bully can spot subscriptions, price rises and money leaks in what you already pay.
Your permission: A separate Open Banking consent, given at your bank, valid for 90 days and withdrawable at any time from Money settings. Never bundled with anything else.
Who's responsible after: TrueLayer as the regulated provider of the connection; we remain controller of what we store and what we work out from it.
What we earn: No commission. We pay for the connection.
If you don't finish: An abandoned connection leaves only a record of the attempt. No account data arrives without a completed permission.
Worth knowing: Read-only. There is no payment permission, so nothing can move money. Disconnecting deletes the tokens and the transactions we pulled.
Their notice: https://truelayer.com/privacy/

Skyscanner

Flight price feed

Live — data goes to them today

What they get: Route, dates, cabin class and number of travellers
No name, no contact details, nothing that identifies you
Why: To show real fares instead of indicative pricing.
Your permission: None needed: the search carries no personal data.
Who's responsible after: Skyscanner, for the search request itself.
What we earn: A booking fee may be earned on completed bookings.
If you don't finish: Nothing to abandon — the search is not tied to you.
Worth knowing: Traveller names stay with us and are never sent with a price search.
Their notice: https://www.skyscanner.net/privacy-policy

Lovable AI gateway (Google Gemini)

Processor that reads documents and answers questions

Live — data goes to them today

What they get: The bill, statement or policy image or text you gave us
For questions: a summary of your own details and the last few messages
Why: Reading a bill so you don't have to type it, and answering what you ask.
Your permission: Your consent to process the documents you upload or email in, given when you upload and set out on the AI and documents page.
Who's responsible after: Us. The gateway is a processor acting on our instructions.
What we earn: None. We pay for it.
If you don't finish: A failed read is discarded and we ask you instead of guessing.
Worth knowing: Your data is not used to train models. Full detail on our AI and documents page.
Their notice: https://ai.google.dev/gemini-api/terms

Transactional email provider

Processor that delivers our emails

Live — data goes to them today

What they get: Your email address
The content of the message — your name, a reference, an amount
Why: Sign-in links, switch confirmations and the alerts you asked for.
Your permission: Service messages about your own deal are part of running your account; marketing needs your separate consent and can be withdrawn in one tap.
Who's responsible after: Us. The provider is a processor.
What we earn: None.
If you don't finish: Not applicable.
Worth knowing: Sending is skipped rather than retried elsewhere if the provider is unavailable.

Our database, storage and authentication platform

Processor that hosts everything above

Live — data goes to them today

What they get: Everything we hold, because this is where it lives
Why: Running BILLOCKS.
Your permission: Part of providing the service you asked for.
Who's responsible after: Us. The platform is a processor and does not use your data for itself.
What we earn: None.
If you don't finish: Not applicable.
Worth knowing: Encrypted in transit and at rest, private document storage with per-customer folders, and row-level rules so one account can never read another's data.

Want a copy of what we hold, or want it gone? Make a request.