Privacy notice
Draft for UK GDPR. Replace controller placeholders before go-live.
Data controller: [YOUR BUSINESS NAME]
Contact: [YOUR CONTACT EMAIL]
Address: [YOUR UK ADDRESS]
What we collect
- Your account email and sign-in session data
- Company numbers you choose to watch, and cached public Companies House data for those companies (profiles, filing history, officers, persons with significant control)
- Billing identifiers if you subscribe (via Stripe; we do not store full card numbers)
- Basic technical logs needed to operate the service
Personal data from Companies House
Officer and PSC records on the public register can include personal data (for example names). When we store or show that data to you as part of monitoring, we become a controller of that personal data for that purpose. We process it to provide the monitoring service you requested (legitimate interests / contract), not to market to those individuals.
Why we process data
- To create and secure your account (magic-link sign-in)
- To monitor companies you watch and send service digests
- To bill paid plans and enforce plan limits
- To keep the service secure and reliable
Lawful bases
Contract (providing the service you signed up for) and legitimate interests (securing the service, preventing abuse). Marketing emails are not sent. Service emails include an unsubscribe link for digests.
Processors
- Cloudflare (hosting / Workers / D1)
- Stripe (payments), when enabled
- Email delivery provider (when configured; stubbed in development)
- Companies House (source of public register data)
Retention
Account data is kept while your account is active. You may request deletion by emailing the controller contact. Cached Companies House snapshots and events may be deleted or anonymised when no longer needed for the service.
Your rights
Under UK GDPR you may have rights of access, rectification, erasure, restriction, objection and data portability, and the right to complain to the ICO (ico.org.uk).
International transfers
Infrastructure may process data in the UK/EU or other regions used by listed processors. Appropriate safeguards should be confirmed at go-live.