Privacy notice

This notice explains what personal data CompanySight (“we”, “us”) collects when you use companysight.co.uk, why, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are the data controller. Contact us at corrections@example.com.

What we collect

• Account data — when you sign in with Google (or another sign-in provider we offer), we receive and store your name, email address and the provider’s account identifier. If you sign in with an emailed link, we store your email address and a short-lived, single-use sign-in token. We do not store your profile photo or the provider’s access tokens.
• Sign-in sessions — a session record and an essential, http-only session cookie that keeps you signed in.
• Organisation data — your organisation’s name, billing email address and its members’ roles.
• Subscription data — if you subscribe to Pro, your Stripe customer and subscription identifiers, plan, status and renewal/cancellation dates. Card details are collected and held by Stripe; they never reach our servers.
• API keys — a one-way hash of each key you create, its name and when it was created and last used.
• Analytics — only if you consent through the cookie banner, privacy-friendly usage statistics. You can change your choice at any time via “Cookie settings” in the footer.
• Server logs — IP address, browser and requested URL, kept briefly for security and troubleshooting.

Company data

Company information on this site comes from Companies House under the Open Government Licence v3.0. We show company data only and do not publish directors’ personal details. To report an error or request a removal, see Corrections & removal requests.

Why we use it (lawful bases)

• To provide your account and Pro subscription — performance of a contract.
• To take payments, keep accounting records and meet tax obligations — contract and legal obligation.
• To keep the service secure, prevent abuse and enforce rate limits — legitimate interests.
• Analytics — your consent, which you can withdraw at any time.

We do not sell your personal data or use it for advertising profiles.

Who processes it for us

• Google — sign-in (Google account authentication).
• Stripe — payments, subscriptions, invoices and the billing portal.
• Resend — sending sign-in links and account emails (subscription confirmation, payment problems).
• Hetzner — hosting of our servers and database (EU data centres).
• Cloudflare — DNS, content delivery and security in front of the site.
• Companies House — the source of the company data we publish (we send them no personal data about you).

Some of these providers may process data outside the UK. Where they do, transfers rely on UK adequacy regulations or the UK International Data Transfer Addendum / Agreement.

How long we keep it

• Account data — while your account is open; deleted within 30 days of a deletion request.
• Subscription and invoice records — 6 years after the end of the financial year they relate to (UK tax law).
• Sessions — up to 30 days of inactivity. Revoked API keys — deleted with your account.
• Server logs — up to 30 days.

Your rights

You can ask to access, correct, delete or export your personal data, object to or restrict its use, and withdraw consent. Email corrections@example.com; we reply within one month. You can cancel a subscription at any time from your account page. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office (ico.org.uk).

Cookies

We use an essential session cookie when you sign in, essential security cookies for sign-in and payment (including Stripe’s fraud-prevention cookies on the checkout page), and analytics cookies only with your consent.

Changes

We will update this notice when our practices change and show the date of the latest version above.