1. Who is responsible
CompanyProof is operated by Global Data Intelligence Limited, registered in England and Wales under company number 09410808. Our registered office is Artisans’ House, 7 Queensbridge, Northampton, Northamptonshire, United Kingdom, NN4 7BF.
We act as a controller for website, account, billing, security, enquiry and business-relationship information, and for independently sourced company intelligence whose collection and supply we determine. Where we process personal data in customer submissions on that customer’s documented instructions, we act as a processor under the Data Processing Agreement. The role depends on the particular processing.
Contact our privacy team and identify CompanyProof, or write to our registered office. You do not need an account, a paid plan or a particular form to exercise a privacy right.
2. Information and sources
We receive information from you, your organisation’s administrator, your selected identity provider, payment and delivery providers, and your use of the site. Company intelligence can come from official registries, tax authorities, public filings and identified business-information sources used by our company-data service.
Directors’, officers’ and shareholders’ names and professional roles can be personal data even when published in an official register. Individuals identified in those records can exercise rights without being customers. A customer using the records is responsible for its own purposes, lawful basis and notices.
| Category | Examples |
|---|---|
| Account and organisation | Name, business email, company, country, role, intended use, account and identity-provider identifiers, organisation membership and sign-in metadata. |
| Submissions and results | Pasted text, company identifiers, assertions, questions, selected context, returned records, source links, verdicts, timestamps and saved evidence. |
| Payments and administration | Stripe customer, transaction and subscription references, plan, invoice and tax details, credit usage and billing correspondence. Stripe collects card information; CompanyProof does not receive full card numbers or security codes. |
| Enquiries and communications | Name, email, phone where supplied, company, role, message, requested workflow, support correspondence and transactional email delivery metadata. |
| Security and operation | Request time, browser/device and session information, hashed network or user identifiers, rate-limit counters, audit events and errors. Infrastructure providers process network information to deliver and protect the service. |
| Optional analytics | Consented page and interaction events, session identifiers, campaign tags, referrer hostname and limited event properties. First-party journey records exclude names, emails, raw IP addresses and full referrer URLs. |
3. Purposes and lawful bases
Where UK or EU data-protection law applies, we rely on the bases below for processing for which we are a controller. Where the contract is with an organisation rather than the individual, legitimate interests normally supports managing that business relationship. We balance those interests against individuals’ rights and reasonable expectations.
When we act as a processor, the customer determines the lawful basis and gives instructions. Its contract with us is not, by itself, a lawful basis to process another person’s information.
| Purpose | Lawful basis and relevant interest |
|---|---|
| Accounts and requested services | Contract with the individual where applicable; otherwise legitimate interests in providing the organisation’s requested service. |
| Billing, subscriptions and disputes | Contract or legitimate interests in administering the relationship; legal obligation for required accounting and tax records. |
| Security, fair use and abuse investigations | Legitimate interests in protecting systems, preventing fraud and maintaining availability; legal obligation where a specific duty applies. |
| Enquiries, onboarding and support | Steps requested before a contract where applicable, or legitimate interests in responding and supporting the customer. A contact request is not consent to unrelated marketing. |
| Independently sourced company intelligence | Legitimate interests in accurate business information and verification, subject to source permissions, necessity and balancing individuals’ rights. |
| Optional first-party, Google and HubSpot site analytics | Consent. Refusal or withdrawal does not prevent essential service functions. |
| Marketing communications, if offered | Consent where required, or a lawful business-marketing basis where permitted. Objections and opt-outs are honoured; service messages remain separate. |
| Legal compliance and claims | Legal obligation where applicable; otherwise legitimate interests in establishing, exercising or defending legal claims. |
4. Submitted text, AI and your integrations
Text checking sends relevant text and company context to the Regis AI service to identify factual assertions and retrieve supporting evidence. Structured verification and profile routes send the company identifiers and request details needed for the lookup. The service can retain a submitted answer with saved evidence.
Only submit what is needed for the business check. Remove passwords, full payment details, health information, identity-document images, unrelated private correspondence and other sensitive content. Public company information may still be subject to data-protection law.
We do not obtain a right through the service terms to train general-purpose models on your Customer Content. Processing by underlying AI providers must follow the applicable provider and processing arrangements. Obtain the written processing schedule if your workflow requires a specific no-training, retention or regional commitment; these are not established merely by an API call.
When you connect your own AI agent, use MCP or configure a webhook, the provider or destination you select may receive queries and results. Its own privacy terms govern its independent use. Revoking access does not retrieve copies already received.
CompanyProof returns information and verdicts; it does not itself approve payments, deny credit or make solely automated decisions producing legal or similarly significant effects on individuals. Customers are responsible for consequential decisions they build around the output and any required safeguards.
6. International processing
The operator is based in the United Kingdom. Providers may process data in the United States, the EEA and other locations under their service arrangements. Published upstream provider information also identifies Germany and support in Moldova. This does not mean CompanyProof data is stored only in those locations.
Self-service CompanyProof does not promise UK-only or EU-only storage. Primary, backup, log-storage and support-access locations for an enterprise workflow should be recorded in its processing schedule. The provider register distinguishes provider information from account-specific settings that require confirmation.
A restricted international transfer requires an appropriate mechanism before it occurs: for example, a valid adequacy decision or applicable standard contractual clauses with the UK Addendum or an International Data Transfer Agreement, together with assessment and supplementary measures where required. Headquarters, a certification logo or this notice alone is not a safeguard.
Contact our privacy team to request the applicable locations and safeguards, or copies of relevant transfer terms with unrelated confidential material redacted.
7. Retention, deletion and records
We retain identifiable information for its stated purpose and apply the periods or criteria below. A legal hold can extend normal retention only for relevant records. Information kept solely for law or a substantiated dispute is restricted to that purpose.
Expiry of a session, token or recovery link does not necessarily mean immediate deletion of every underlying record. Short-lived records are cleaned up through service activity or scheduled maintenance. Provider backups and logs have separate lifecycles; this notice does not promise a fixed backup-erasure deadline.
Account deletion and subscription cancellation are different requests; you may request both together. Ask us to confirm any export, pending billing issue, lawful retention and deletion completion. For processing on a customer’s behalf, the customer chooses return or deletion under the DPA.
| Record | Period or deletion criterion |
|---|---|
| Account and organisation information | While used to provide the account. On verified closure, remove operational information when return/export instructions and necessary closure steps are complete; retain only what another stated purpose requires. |
| Saved proofs, claims, monitoring and webhooks | For the active customer evidence workflow, then according to return/deletion instructions and an agreed retention schedule. Retaining a tax or contractual record does not justify retaining every submitted text. |
| Public text-check recovery | Recovery access expires after 24 hours. Expired completed responses are cleaned up by the service; independently saved evidence follows its own retention. |
| Guest-to-account save handoffs | Handoff links and records expire after seven days, with expired records removed during cleanup. |
| First-party journey events | 180-day retention window; expired records are removed during event processing and scheduled maintenance. |
| Transactional email payloads | Recipient details and payloads become eligible for redaction after 90 days under delivery-queue cleanup rules. Minimal delivery and billing records can remain for their separate purpose. |
| Enquiries and support | While the enquiry, documented follow-up, customer relationship or support issue remains active. After closure, review and remove personal information no longer needed for a specific dispute or legal duty. |
| Billing and tax records | Normally six years from the end of the relevant company financial year, or longer where a specific legal obligation or legal hold requires it. |
| Security and fair-use records | Short-lived counters support the relevant usage window; counters inactive for seven days are eligible for cleanup. Incident and audit records follow the particular investigation, access-control or legal-claim need. |
| Marketing preferences | Until withdrawal or objection, as applicable. Minimal suppression information can remain to ensure an objection is respected. |
8. Cookies and analytics choices
Optional Google Analytics, HubSpot site analytics and first-party journey measurement are enabled only after a current analytics choice. Essential-only access keeps authentication, fair-use protection, enquiry handling and payments available. Change your choice below; withdrawal clears optional first-party storage we control and reloads the page.
The cookie policy describes the technologies, purposes and lifetimes. Browser and network identifiers used for the three-question daily public allowance support service protection, not advertising. Refusing analytics does not prevent a requested enquiry from being stored and routed to our CRM.
Our first-party journey events exclude submitted text, account emails, payment tokens and URL query strings. We configure Google page information to omit query strings, and do not initialise HubSpot on a URL containing a query or fragment. Third-party trackers can collect browser, network and interaction information under their own notices. Do not put personal information in campaign tags.
Current choice: Not selected
9. Your rights
Depending on applicable law and lawful basis, you may request access, correction, erasure, restriction, portability or information about processing. You may object to legitimate-interest processing on grounds relating to your circumstances. You may object to direct marketing at any time and withdraw consent without affecting processing that was lawful before withdrawal.
Email our privacy team or write to our registered office with enough information to locate the account or company record. We may request proportionate identity or authority verification. Do not send an identity document unless asked through a suitable channel.
For UK/EU rights requests we respond without undue delay and normally within one month, subject to applicable identity, clarification and extension rules. If an extension is permitted for complexity or volume, we explain the reason and timing. Requests are normally free; any lawful exception or refusal will be explained, including complaint rights.
When a customer controls the record, we will identify or assist that customer where appropriate. You may also seek correction from the underlying registry; a request to us is assessed independently.
Other jurisdictions may provide additional rights, such as an authorised-agent request, appeal of a refusal, or opt-out of sale or sharing. Where applicable, use the same privacy address to exercise them. We do not use CompanyProof account or enquiry data for cross-context behavioural advertising; separately licensed professional records require assessment under applicable law.
10. Complaints
Email our privacy team with “CompanyProof privacy complaint” in the subject, or write to our registered office. No special form is required. We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and communicate the outcome.
You may also complain to the UK Information Commissioner’s Office or the competent authority where you live, work or consider an infringement occurred. Contacting us does not remove that right.
11. Children and changes
The service is intended for adults acting for businesses and is not directed at children. Contact us if you believe a child’s information has been submitted without an appropriate basis.
We update the date of this notice when it changes and provide additional notice where required. An updated notice does not create consent to a new purpose or retrospectively expand permitted uses.
Artisans’ House, 7 Queensbridge, Northampton, Northamptonshire, United Kingdom, NN4 7BF
Privacy: Email our privacy team
Contracts and support: Email our support team