At a glance
Our application and database are hosted in the UK. Some suppliers process data overseas. Optional analytics and recordings need your consent. You can request access, object or ask for deletion.
A short overview. The full notice follows.
1. Who we are and how to contact us
CHouse.UK is operated by [Operator to be confirmed], registered in England and Wales under company number [number to be confirmed], at [registered office to be confirmed]. We are independent of Companies House and the UK government.
We are the controller for the account, service-operation and public-register processing described in this notice, unless we explain a different role below. Contact [email protected] about privacy, your information or this notice. For account and billing help, use [email protected].
2. Who this notice covers
This notice covers visitors, account holders, team members, people contacting us, client-report recipients and individuals whose information appears in the public register.
A team decides who joins it, what research it shares and which client contacts it adds or sends reports to. Where we process client contact details solely on that team’s documented instructions, we act as its processor and the team is responsible for its controller obligations. Contact the team about its use of your details; you can also contact us for help identifying the relevant organisation.
3. Information you provide
3.1 Accounts and teams
We receive your email address and authentication details needed to create and secure an account. Google sign-in may provide your name, profile photo and Google account identifier. Team details can include its name, logo, company number, membership, invitations and roles.
3.2 Research and delivery settings
We store the work and settings you choose to save, including watchlists, company or officer identifiers, saved searches, Discovery rules, alert choices, notifications, connected-app details and calendar subscription tokens. Imports submit the selected company identifiers or names and chosen matches; the current import flow does not store your original spreadsheet.
3.3 Payments, support and reports
We receive subscription, invoice, payment-status and limited payment-method metadata from Stripe, which processes card details. This can include a provider-generated card fingerprint used to apply a one-time guarantee and prevent abuse. We also process messages you send us and any firm branding, recipient addresses or delivery instructions your team provides for reports.
3.4 Support requests and feedback
When you contact support while signed in, we keep your request, the messages in it and any screenshot you attach, so we can answer and you can see the whole conversation on its page. Please remove private details from screenshots before attaching them. Feedback sent from our feedback form is emailed to our team and is not stored in our database; it includes your email address only if you allow us to contact you about it.
4. Public company and officer information
We obtain company information and linked official documents from Companies House. This may include directors’ and other officers’ names, service addresses, appointments, month and year of birth where published, people with significant control, filing details and published disqualification information. Public information can still be personal information.
We use this information to provide source-linked company research, comparisons, monitoring, change history and alerts. Our basis is our legitimate interest in making public company information accessible and useful for lawful research, balanced against individuals’ rights. Public availability does not remove those rights or permit every possible use.
If an official record is incorrect, Companies House controls correction of the source. You may also contact us about our copy, request correction or restriction, or object to our processing. We assess requests on their facts; we do not assume that publication on the register prevents a request.
5. Website, device and security information
To deliver and protect the service, we process request details, IP addresses, browser and device information, timestamps, company or officer identifiers, diagnostic events and security records. These help us route requests, detect abuse, investigate faults and secure accounts.
Search terms can appear in URLs, browser history and operational logs. Do not include confidential or unnecessary personal information in public search or feedback fields. Optional measurement, described below, is separate from the technical processing needed to run the service.
6. Purposes and lawful bases
6.1 Providing the service
We use account, saved-work and payment information to perform our contract with you or take steps you request before entering one. Where your organisation is the customer, our legitimate interests include managing that business relationship and providing access to its authorised users.
6.2 Research, support and security
Our legitimate interests include providing lawful public-register research, answering requests, preventing misuse, enforcing fair plan limits, applying the Pro guarantee, investigating incidents and establishing or defending legal claims. We consider necessity, proportionality and the effect on individuals.
6.3 Legal obligations
We use and retain information where required for accounting, tax, compliance, court orders or other legal obligations.
6.4 Optional processing
We rely on consent for optional analytics and experience insights, and for promotional communications where consent is required. You may withdraw consent without affecting processing that was lawful before withdrawal. We do not use these optional choices as a condition of public research or account access.
7. Emails, alerts and client reports
We send sign-in, security, billing and other necessary account messages, and the company, Discovery, deadline and summary messages you request. Your alert choices determine eligible delivery; a team-wide rule does not automatically subscribe every member to email.
Product tips and news are promotional communications. We send them only where we have consent or a lawful exception. Where we rely on the products-and-services soft opt-in, we must have collected your details during a sale or genuine negotiations for our similar services and offered a clear opt-out when collecting your details and in every message. The weekly market update requires its own enabled choice.
You can stop promotional emails through Account emails or the unsubscribe link in each message, without signing in. We retain a limited suppression record to respect an opt-out. Necessary service messages are not switched off by a marketing opt-out.
If a team sends you a client report, we process your address, report contents and delivery information to deliver it on the team’s instructions. The sending firm is identified in the message. Receiving a report does not create an account or subscribe you to our marketing. Ask the firm to change its recipient list, or contact us about a delivery or privacy concern.
9. Analytics and experience insights
9.1 Analytics
When you allow Analytics, Google Analytics receives measurement information such as page visits, navigation, engagement, feature use, referrals, broad location and browser or device characteristics, associated with browser identifiers. We use this to understand usage and improve the site. Our page-view implementation omits URL query strings; do not assume that all information visible on a page is anonymous.
9.2 Experience insights
When you allow Experience insights, Microsoft Clarity receives interaction data and page information to provide heatmaps and session replays. This can include clicks, scrolling, pointer movement and content visible on recorded pages. Recording controls can mask fields, but we do not promise that every visible element or URL is excluded.
Provider identities and their notices are available below and from the prominently linked Tools and providers details before you decide. Google’s notice is at policies.google.com/privacy. Microsoft’s notice is at privacy.microsoft.com/privacystatement. Browser identifiers and recordings should not be treated as automatically anonymous.
10. Who receives information
10.1 Our main service providers
DigitalOcean hosts our application, database and file storage, including support screenshots, in the United Kingdom. Resend delivers our emails. Stripe processes payments and related billing information. Google provides Google sign-in when you choose it and Google Analytics when you consent. Microsoft provides Clarity when you consent.
10.2 Sharing you request
Authorised team members can access research shared with that team. Selected client recipients receive the reports sent to them. Slack, Microsoft Teams, webhook destinations and calendar providers receive information when you configure or use those connections. Review the destination and its own privacy terms before connecting it.
10.3 Other permitted disclosures
Access within our organisation is limited to people who need it for their work. We may disclose necessary information to professional advisers, public authorities or other parties where required by law, to protect legal rights, or as part of a genuine business transfer with appropriate safeguards and notice where required.
11. Processing outside the UK
Our application and database hosting location is the UK. This does not mean every supplier processes information only in the UK. Resend stores service data in the United States, and Google, Microsoft, Stripe and their support or subprocessing operations may process information internationally, including in the United States and the European Economic Area.
Restricted transfers are made only where a lawful arrangement applies, such as UK adequacy regulations or appropriate contractual safeguards, including the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses where relevant. Contact [email protected] for information about a relevant transfer and how to obtain a copy of the safeguards, subject to necessary redactions.
12. How long we keep information
12.1 Account and saved work
We retain account information and saved research while needed to operate the account and provide the requested service. After deletion, we remove or anonymise private saved work, subject to the limited records described below. Public-register information has an independent source and research purpose.
12.2 Billing and legal records
Accounting records are normally kept for six years from the end of the company financial year they relate to, and longer where law requires. We may retain limited records needed for refunds, disputes, fraud prevention, consent evidence and legal claims for the relevant obligation or claim period.
12.3 Support, security and backups
Retention is determined by the purpose and sensitivity of the information, whether a support issue or security investigation remains open, and any legal need to retain evidence. Records are deleted or anonymised when that need ends. Deleted data can remain in isolated backups until the recovery and backup-rotation period ends; it is not used as live account data. Support requests, their messages and attached screenshots are kept while your account exists so the conversation stays available to you, and are deleted when you delete your account.
12.4 Optional measurement
Analytics retention is limited by the reporting periods needed to evaluate site usage and changes, whether identifiable data is still necessary, and the configured deletion controls. Aggregated statistics may be kept where they no longer identify an individual. Microsoft’s standard Clarity retention is 30 days for normal playback data and nine months for click/heatmap data and sessions labelled or favourited for further review.
12.5 Browser storage and followed people
Our consent-choice cookie lasts 180 days. Google publishes a default two-year expiry for its _ga and _ga_* cookies; actual expiry can be shorter because of provider configuration, browser limits or deletion. Clarity uses identifiers including _clck and _clsk, and may use Microsoft-domain cookies; its cookie documentation explains their current purposes. Stored appointment snapshots used for person-following are cleared after 30 days without followers, subject to the retention of separately required history.
13. Security and account deletion
We use appropriate technical and organisational measures, including access controls and measures to protect service communications. No online service can guarantee absolute security. Keep sign-in and private calendar links secure and tell us promptly if they are disclosed.
Self-service account deletion removes private saved work and linked sign-in methods. Limited subscription, deletion, audit or legal records may remain under a retained identifier after account details are removed or replaced. An active paid subscription may need to end before self-service deletion completes; this does not remove your rights to request erasure or cancellation by contacting us.
Deleting your CHouse.UK account does not remove Companies House records, copies held independently by another organisation, or reports and calendar items already delivered or imported. We explain any lawful reason for retaining personal information when responding to a rights request.
14. Your rights and choices
Depending on the processing and applicable law, you may request access to your personal information, correction, erasure, restriction or portability. You can withdraw consent for optional processing at any time. Some rights have conditions and legal exceptions; we will explain these where they apply.
Your right to object
You can object to processing based on legitimate interests, including our use of public-register information about you. Explain the circumstances so we can assess the request. You can always object to the use of your information for direct marketing, and we will stop that use.
Making a request
Email [email protected]. We may request proportionate information to verify identity or locate the records. We respond within the applicable statutory period, normally one month, and explain if a lawful extension or exception applies. Rights requests are normally free; any exceptional fee or refusal must have a lawful basis.
15. Automated tools and information choices
Search filters, Discovery rules, company indicators and alerts apply recorded criteria to register information. They are research tools, not credit or risk scores. We do not use them to make decisions about individuals that produce legal or similarly significant effects.
An email address and the information needed to secure an account are required for account access. Payment information is needed for a paid plan. Optional analytics, experience insights and marketing choices are not required for those services.
16. Complaints and policy changes
Please contact [email protected] if you have a concern so we can investigate. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, and any other supervisory authority available to you by law. You do not have to contact us first.
We update this notice when our processing or legal obligations change. The published version will show its date, and we will highlight material changes where required. A new purpose requiring consent will not be enabled solely by changing this notice.
Privacy questions and requests
Email [email protected] about this notice, your information or your rights.