Privacy Policy

FIRMATLAS LTD, company number 17434605, registered in England and Wales at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ, determines the purposes and means of the FirmAtlas processing described here. Contact support@firmatlas.co for privacy questions or requests, including about a company or person appearing in a report.

This notice covers website visitors, account holders, buyers, support contacts and people identified in business records. It describes processing; accepting our terms is not blanket consent to marketing, tracking or every use of personal data.

Account and support information includes names, email addresses, authentication identifiers, preferences and messages you send. Purchase information includes plans, payment status, billing details, invoices and checkout identifiers. Payment providers handle payment-card details; FirmAtlas does not store full card numbers.

Service information includes searches, companies viewed or saved, purchased and generated reports, prompts or inputs you submit, sharing actions and account activity. Technical information can include IP address, device/browser details, timestamps, URLs, referrers, language, approximate country, security logs and identifiers associated with analytics or advertising where enabled.

Business records may include identifiable officers, directors, representatives, owners, sole traders and publicly recorded business addresses or contacts, together with dated roles and other information relevant to a corporate function. A business address or work email can still be personal data. Historical and derived records can differ from the latest official entry.

We obtain information from you and your use of the Service; authentication and payment providers; official company registers, filing and open-data services identified in our country source schedule; permitted data providers; and identified company websites, issuer publications and other public evidence. A public source is not permission for unrestricted use of personal data.

We process information necessary to create accounts, fulfil purchases, provide reports and requested features, manage subscriptions and respond to support under our contract with you, or to take requested steps before a contract. Where the account belongs to an organisation, necessary business-contact processing may instead rely on legitimate interests in operating that relationship.

Security, preventing fraud and abuse, enforcing lawful licence restrictions, improving service reliability and establishing or defending claims may rely on legitimate interests, where necessary and balanced against the affected person’s interests and rights. Accounting, tax, lawful authority requests and other mandatory records may rely on legal obligations.

Where lawful and necessary, publishing and analysing identifiable public business-role information relies on legitimate interests in providing reliable access to business information and supporting company research. This requires purpose, necessity and balancing assessments; it is not an automatic exemption for public records. Applicable restrictions, minimisation, accuracy, transparency and objections must be considered.

Where law requires consent for marketing, advertising technologies or optional processing, that processing requires separate consent. Consent may be withdrawn without affecting the lawfulness of prior processing. We do not rely on consent merely because a person’s information appears in an official register or because a visitor accepts our terms.

We use providers for hosting, databases, authentication, private document storage, payments, transactional email, AI processing, monitoring and analytics. The implementation includes Vercel, Supabase, Cloudflare, Stripe, Resend and OpenAI for the relevant functions, and Google where you choose Google sign-in. A merchant of record, if expressly identified at checkout, also handles the disclosed sale and payment processing.

Where enabled, Seline receives service analytics and account identification events, and Meta receives browser or server advertising and conversion events, which may include event details, device information, advertising identifiers and matching information such as hashed contact details. Hashing does not necessarily make personal data anonymous. The legal basis and required device-storage consent depend on the actual processing, not simply its label as analytics.

With your analytics consent, PostHog receives page views and selected product actions, browser/device details, language and market information, and an account identifier after verified sign-in. This integration uses PostHog US Cloud. It filters email addresses, names, raw search text, URL query strings and private report-sharing tokens from events. Session recording and automatic interaction capture are disabled in this integration. Analytics can be declined separately from advertising through Cookie settings.

Customers and authorised recipients can receive public business-record information as part of company profiles, reports, enabled exports or expressly licensed APIs. Providing paid access to those records can involve disclosure of personal data about recorded people. It does not make those people customers or mean they consented to the disclosure. We do not treat account/payment data as a company-data product.

Relevant information may be shared with professional advisers, courts, regulators or authorities where lawful and necessary, or parties to a business transfer subject to lawful safeguards. Providers and customers may be processors or separate controllers depending on what they actually do; their independent processing can be covered by their own notices.

Generating or extracting a report can send relevant company records, document text, your instructions and research context to an AI provider and store the resulting report and processing metadata. Avoid submitting unnecessary personal information, confidential third-party data or sensitive categories. AI and identity matching can be inaccurate; contact us about an affected person or a disputed derived statement.

A report-sharing link can make that report accessible to anyone holding the link. Use sharing with care and revoke the link through the available sharing controls when no longer needed. Access controls on a private archive do not mean every authorised report output is private to its purchaser.

FirmAtlas outputs support human research; they are not intended to make solely automated decisions about a person with legal or similarly significant effects. We do not assert that this purpose alone exempts our processing or a customer’s processing from applicable automated-decision or profiling rules.

Authentication, security, checkout recovery and requested preferences use cookies or similar storage. Examples include authentication cookies, the fa_checkout purchase-recovery cookie and the fa_language cookie or stored language preference. Their purpose is to operate the requested features.

The fa_analytics_consent cookie remembers your PostHog analytics choice for up to six months. PostHog identifiers use cookies or local storage only after you allow analytics. Declining or withdrawing this choice stops PostHog collection and clears its analytics identity and persistence on this browser.

Advertising and identified analytics can also involve storage, including Meta _fbp/_fbc identifiers, the fa_visitor visitor identifier and identifiers used by Seline. Where consent is legally required, these technologies require a separate opt-in; a privacy-policy link or continued browsing does not supply it. Any applicable statistical or preference exception must meet its own conditions and does not automatically cover advertising or cross-service profiling.

Browser controls can restrict device storage but may not stop server-side processing already associated with your account. Contact support@firmatlas.co to raise an objection or withdraw a consent you have given. Refusing optional processing must not remove access to a service that does not require it. Specific technology lifetimes and choices depend on the feature and provider configuration.

Our providers and recipients may process information in the United Kingdom, European Economic Area and other countries, including the United States. A company dataset’s country is not necessarily the location of its storage or AI processing.

Where a restricted international transfer occurs, the applicable data-protection law requires an appropriate mechanism, such as an applicable adequacy decision or approved contractual safeguards and required additional assessments or measures. Contact support for information about the safeguards applicable to your data or a copy where available. This notice is not itself a transfer agreement.

Retention depends on the purpose and type of information: account and purchased-access records while needed to provide and support the relationship; purchase and accounting records for applicable legal periods; security and claim evidence for necessary investigation or limitation periods; and prompts, document processing and reports while needed for the requested feature, lawful reuse or support.

Public-record retention depends on research relevance, current and historical corporate roles, source conditions, accuracy, objections and legal restrictions. A historical archive, private storage or public origin does not authorise indefinite personal-data retention. When information is no longer needed, it should be deleted or anonymised, subject to lawful holds and controlled backup retention.

Source withdrawal and privacy restrictions can require removing or restricting archived and derived copies, not merely changing a public page. Contact us for an assessment concerning a particular record. This notice does not promise a fixed lifetime for every dataset or an immutable permanent archive.

Depending on applicable law, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing, withdraw consent and exercise rights concerning automated decisions. Direct-marketing objections must be respected. Other rights may have lawful exceptions, including legal obligations and establishing or defending claims.

Email support@firmatlas.co with the relevant record or account and the request. We may need proportionate identity verification and will respond within applicable statutory deadlines; UK/EU GDPR requests are generally handled within one month, with lawful extensions explained where necessary. Requests concerning register information can be made without an account or purchase.

Correction at an original register may also be needed, but is not a precondition for asking FirmAtlas to address its own processing. We must consider source copies, exports under our control and derived outputs where relevant. Rights do not depend on whether another company published the information first.

You may complain to the UK Information Commissioner’s Office at ico.org.uk or the competent data-protection authority where you live or where a relevant infringement occurs. Contacting FirmAtlas first is optional. This notice does not waive your rights.

Account, authentication and payment information needed to provide a requested feature is required for that feature; without it we may be unable to create an account, fulfil a purchase or respond to a request. Optional preferences or consents are not automatically conditions of purchase.

FirmAtlas is intended for adults and is not directed to children under 18. If a public document unexpectedly contains a child’s information or unnecessary sensitive information, report it for review. An adult-only customer policy does not remove duties concerning personal data found in source records.

We use technical and organisational controls appropriate to the processing, including access restrictions for private archives and account-dependent features. No online service guarantees absolute security. Suspected disclosure of restricted data or a security issue can be reported to support@firmatlas.co.

We may update this notice as purposes, providers or law change. Material changes require additional information or consent where applicable; posting a notice does not retrospectively authorise processing. The version displayed identifies this text. Our country source schedule explains dataset rights separately from personal-data law.