Privacy notice

This explains what we collect, why, how long we keep it and what you can ask us to do with it. It is written to be read, not to be survived.

Draft, pending legal review. This notice describes what the software actually does today, but it has not yet been checked by a solicitor and the company details below are incomplete. Do not treat it as final.

Who we are

LawrenceWave is a trading name of Lawrence Wave Ltd, a company registered in England and Wales (company number 16690732), registered office 128 City Road, London, United Kingdom, EC1V 2NX. We are the data controller for the information described here. For anything in this notice, contact [email protected].

What we collect, and why

Your account: Email address, display name, and first and last name. Your sign-in credentials are held by Microsoft Entra External ID and never reach us — we store an identifier for your account, not a password. Needed to give you an account at all: performance of our contract with you.
Country of domicile: Self-declared. Used to decide which offers and markets are available to you, and to meet our own regulatory obligations. Legal obligation and legitimate interests.
Trading experience: Months of crypto and FX experience, declared by you. Used to decide beta eligibility. Legitimate interests, and your consent when you apply.
Beta applications: What you declared at the time you applied, the decision, and the version of the eligibility wording you agreed to. Kept as a record of what was claimed and decided, because a decision that cannot be explained later is not a decision anyone should rely on. Legitimate interests.
Subscription and billing: Your subscription state, what you are entitled to, and identifiers that link you to our payment processor. We never see or store your card details — those go directly to Stripe. Performance of contract, and legal obligation for records we must keep.
Problem reports: What you wrote, the page you were on, and your browser's user-agent string. Used to reproduce and fix the problem. Legitimate interests.
Investor enquiries: Name, email, organisation, country and your message, when you use the investor form. Legitimate interests, and consent where you tick to be contacted.
Technical data: Your IP address is used to rate-limit abusive traffic and, through Cloudflare Turnstile, to tell people from bots. Not used to profile you. Legitimate interests.
How you reached us: If you arrive from one of our ads, the link carries an identifier for that click, and we store it with your application so we can tell Google that the advertising worked. It identifies the click, not you, and we send Google nothing else about you — no email address, no name. There is no advertising code on this site, and we set no cookie for this. Legitimate interests.

How long we keep it

Your account and its history: while you have an account, and for as long afterwards as our tax and accounting obligations require.
Beta applications that were waitlisted: two years, then reviewed.
The wording you agreed to: kept as long as any record referring to it exists, because evidence that points at deleted wording proves nothing.
Investor enquiries: until the enquiry is closed and any follow-up you consented to has run its course.
Advertising click identifiers: deleted 90 days after the click. Google stops recognising one at that age, so we erase it rather than keep a record of which advertisement you clicked. Your application is unaffected; all that remains is that it came from an advertisement, which does not identify you.

Who else processes it

We use suppliers who process data on our behalf, under contract, and only on our instructions:

Microsoft — identity (Entra External ID) and hosting (Azure).
Cloudflare — traffic protection and the bot challenge on our forms.
Stripe — payments. Stripe is a controller in its own right for the payment data it holds.
Resend — the emails we send you about your account.
Google — advertising. We report to Google that a click on one of its ads led to an application, using the identifier described above. Google receives no other information about you from us.

Some of these process data outside the UK. Where they do, transfers rely on the safeguards those suppliers provide, such as the UK addendum to the standard contractual clauses.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict or object to what we do with it, or to receive it in a portable form. Where we rely on your consent, you can withdraw it at any time — that does not undo what was done before you withdrew it. Ask at [email protected].

Some records we cannot simply delete on request: what you declared when you applied for beta access, and the records our tax obligations require us to keep. Where that applies we will say so and explain why.

If you think we have handled your data badly, please tell us first — but you can also complain to the Information Commissioner's Office.

Cookies

We use cookies that are necessary for the site to work: keeping you signed in, and protecting forms against cross-site request forgery. We do not use advertising cookies, and we do not track you across other websites.

Last updated: 19 August 2026.