Privacy Policy

1. Controller

KATZ ELM GROUP LIMITED (registered in England & Wales, no. 15444180, registered office Unit 201, 99 Farringdon Road, London, England, EC1R 3BN) is the controller of personal data processed through Companies House IM. Contact us at [email protected].

2. The law we follow

We process personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018, and, where applicable to data concerning Isle of Man companies and their officers, the Isle of Man Data Protection Act 2018 (which applies GDPR-equivalent standards).

3. Data we process about you (our users)

• Account data — your email address, display name, and organization/team membership.
• Usage data — the companies you follow, your notification settings, and basic logs needed to run and secure the Service.
• Authentication data — sign-in links, sessions, and (if you enable them) passkeys or two-factor settings.
• Billing data — if you add a payment method: your billing name, the identifiers Stripe assigns to your customer and subscription records, your subscription status, and your invoice and payment history. We never see or store your full card number — card details are collected and held by Stripe.

We use this to provide the Service, send the alerts you ask for, secure your account, and (lawful basis: contract and legitimate interests) operate and improve the Service. We process billing data to perform our contract with you, and to meet the legal obligations that apply to invoices and accounting records.

4. Data we process about company officers (register data)

The Service surfaces information published on the public Isle of Man companies register, which can include personal data about directors, officers, and agents (such as names, roles, and addresses as published). Our lawful basis for processing this public-register data is our legitimate interests (and those of our users) in providing a company-monitoring and due-diligence tool. We do not enrich, profile, or combine this data beyond presenting and comparing what the register publishes.

5. Who we share data with (sub-processors)

• Hosting / infrastructure (DigitalOcean) — to run the application and database.
• Email delivery (Amazon Web Services / SES) — to send sign-in links and change notifications.
• Stripe — our payment provider: to take payments, hold your card details securely, issue invoices, and provide the customer portal where you manage your subscription.
• Cloudflare — content delivery, TLS termination, and DDoS/bot protection in front of the Service. Cloudflare processes connection data (including your IP address and the requests you make) on our behalf.

We do not sell personal data. We share data with these providers only as needed to run the Service, under appropriate data-processing terms. If we change providers we will update this list.

6. Where your data is processed

Our providers may process personal data outside the Isle of Man and the United Kingdom. Where they do, we rely on the transfer mechanisms permitted by data protection law — either an adequacy decision covering the destination country, or standard contractual clauses (including the UK International Data Transfer Addendum) in our contracts with them. You can ask us for details of the safeguards that apply.

In particular, Amazon Web Services, Stripe, and Cloudflare are United States providers, and each is engaged under data-processing terms incorporating standard contractual clauses.

7. Retention

We keep account data while your account is active and for a reasonable period afterwards to meet legal and operational needs, then delete or anonymise it. When an account is closed we delete or anonymise its data within 90 days. Cached register data is refreshed and may be removed when a company is no longer followed.

Invoice and payment records are kept for six years to meet tax and accounting obligations. This means that if you ask us to delete your data we will remove your account and usage data, but must retain those billing records for the remainder of that period.

8. Your rights

Subject to applicable law, you have rights to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. To exercise them, email [email protected]. You may also complain to the relevant data-protection authority (the UK Information Commissioner's Office, or the Isle of Man Information Commissioner).

9. Cookies

The cookies we set are described in our Cookie Policy.

10. Changes

We may update this policy; the "last updated" date above reflects the current version.