Privacy Policy

Last updated: 7 September 2026

1. Introduction

CompanyTrack respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, store, and share personal data when you use our website and services, and tells you about your privacy rights and how the law protects you.

This policy covers two groups of people: users of CompanyTrack (visitors and account holders), and people who appear in the information we publish — company directors, officers, persons with significant control (PSCs), and shareholders whose details appear on the UK public register. If you are a director or officer and want to know how we handle your information, see Section 4.

Please read this privacy policy together with our Terms of Service. This privacy policy supplements our other policies and is not intended to override them.

This policy covers the CompanyTrack website and API. Our browser extension is covered separately, because it collects no data at all — see the browser extension privacy notice.

2. Who We Are

Team Dimensions Ltd, trading as CompanyTrack, is the data controller responsible for your personal data (referred to as "we", "us", or "our" in this policy).

Contact details:

• Company name: Team Dimensions Ltd (registered in England and Wales, company number 08348964)
• Registered address: 128 City Road, London, EC1V 2NX, United Kingdom
• Email: info@companytrack.com
• ICO registration number: ZC238097

If you have a concern about how we handle your personal data, you have the right to complain to us, and we will look into it. You also have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the opportunity to address your concerns before you approach the ICO, so please contact us first.

3. Data We Collect About You (Users)

Personal data means any information about an individual from which that person can be identified. If you use CompanyTrack, we may collect, use, store, and transfer the following kinds of personal data:

3.1 Information You Provide

• Identity Data: first name, last name, and username.
• Contact Data: email address.
• Financial Data: payment card details (processed securely by our payment provider, Stripe — we do not store your full card details).
• Transaction Data: details of subscriptions and payments made through CompanyTrack.
• Profile Data: your account preferences, saved searches, watchlists, notes, and alert settings.

3.2 Information Collected Automatically

• Technical Data: IP address, browser type and version, time zone, operating system, device type, and platform. For visitors without an account, we store IP addresses briefly to meter free daily usage and prevent abuse, and we log IP addresses and user-agent details when requests are blocked for security reasons (for example rate limiting or bot protection).
• Usage Data: information about how you use CompanyTrack, including pages viewed, features used, search queries, and the company and director profiles you view. For signed-in users we keep a log of searches and profile views linked to your account, which we use for product analytics, metering, abuse prevention, and support.
• Analytics Data (with your consent): if you accept analytics cookies, we use PostHog to collect usage analytics, including session recordings of how you interact with pages (with sensitive content such as passwords and API keys masked). See Section 10 for details and how to change your choice.
• API and MCP Request Data: if you use our API or MCP server, we log each request's endpoint or tool name, search text, filter expression, the company or person identifier queried, response status, credits charged, latency, approximate country, and the identifier of the API key used (never the key itself). We keep these records for approximately three months and use them for product analytics, abuse prevention, and support.

3.3 Information From Third Parties

We may receive data about you from third-party services that you use to sign up or log in to CompanyTrack (such as our authentication provider, Clerk, including social login providers you choose to connect).

We do not collect any Special Categories of Personal Data about our users (such as data about race, ethnicity, religious beliefs, health, sexual orientation, or political opinions).

4. Information We Publish About Directors, PSCs and Shareholders

CompanyTrack republishes information from the UK public companies register. This section explains that processing — it applies to you if you are (or have been) a company director, officer, person with significant control (PSC), or shareholder of a UK company, whether or not you use CompanyTrack.

4.1 What We Publish and Where It Comes From

Our primary source is Companies House, the UK registrar of companies, which publishes this information under the Companies Act 2006. The categories of personal data we process from the register include:

• Name, month and year of birth (the register does not publish the day), nationality, country of residence, and occupation.
• Appointments — current and past directorships and officer roles, with dates.
• PSC details — natures of control and notification dates.
• Shareholdings — shareholder names and holdings as disclosed in company filings.

We do not publish residential or correspondence addresses of individuals — only company registered office and trading addresses.

We also derive data from the register, such as a person's approximate age (computed from the registered month and year of birth), estimated age ranges where no date of birth is filed, and links between a person's appointments across companies. For some companies, we additionally show publicly available professional profile information about key personnel (for example names, job titles, and links to public LinkedIn profiles).

4.2 Why We Publish It (Lawful Basis)

We process this information on the basis of our legitimate interests (UK GDPR Article 6(1)(f)) — and those of our users — in corporate transparency: helping businesses and individuals carry out due diligence, credit and counterparty research, fraud prevention, and market analysis using information Parliament has decided should be public. We have carried out and documented a legitimate interests assessment for this processing, balancing these interests against the rights of the people on the register, and we apply safeguards including: publishing no home addresses, showing only month and year of birth, and operating the suppression process described below.

4.3 Keeping Register Data Accurate and Up to Date

We refresh our data from Companies House on an ongoing basis. Where Companies House suppresses or removes information from the public register — for example a residential address or a day of birth suppressed under the Economic Crime and Corporate Transparency Act 2023 — we remove it from CompanyTrack as part of that refresh. If Companies House has agreed to suppress your information and it still appears on CompanyTrack, contact us (Section 4.4) with your Companies House confirmation and we will remove it without waiting for the next refresh.

4.4 Your Rights If You Appear on the Register

You have the same legal rights as any data subject (see Section 12), including the right to object to our processing of your data and the right to request rectification of inaccurate data. To exercise them, email info@companytrack.com with the subject line "Director data request", telling us who you are, which profile or record you mean, and what you would like us to do.

We respond within one month. We consider every request individually. Where we agree, our usual remedies are to suppress your profile page from search engines, restrict what is shown, or remove specific data. Because the register exists to make this information public, we may decline requests where we consider our legitimate interests in corporate transparency prevail — if we do, we will explain why, and you may complain to the ICO or seek a judicial remedy. Requests involving a risk to personal safety, or data Companies House has itself suppressed, are always actioned.

Please note that we cannot change the public register itself — corrections to the register, and applications to protect your residential address or date of birth at source, are made to Companies House.

5. How We Collect Your Data

• Direct interactions: when you create an account, subscribe to a plan, save searches, create watchlists, set up alerts, or contact us.
• Automated technologies: as you use CompanyTrack, we automatically collect Technical and Usage Data using cookies, session tokens, and similar technologies (see Section 10 below).
• Third-party services: we receive data from our authentication provider when you sign up or log in.
• Public sources: we collect the register data described in Section 4 from Companies House and, for key personnel information, from publicly available professional profiles.

6. How We Use Your Data

We will only use your personal data where we have a lawful basis to do so. The main lawful bases we rely on are:

• Performance of a contract: where processing is necessary to provide you with our Services.
• Legitimate interests: where processing is necessary for our (or a third party's) legitimate interests, provided your rights do not override those interests.
• Legal obligation: where we need to comply with a legal or regulatory obligation.
• Consent: where you have given specific consent (e.g., analytics cookies and marketing communications).

Specifically, we use your data to:

Automated decision-making: we do not make decisions about you based solely on automated processing that produce legal or similarly significant effects. AI-generated analysis on CompanyTrack is informational only.

7. Who We Share Your Data With

We share personal data with the following service providers ("processors"), only to the extent necessary for the purposes described above:

• Clerk — authentication: manages user accounts, login, and session security.
• Stripe — payments: processes subscription payments. Stripe handles your payment card details directly; we do not store full card numbers.
• PostHog — analytics (only if you consent): usage analytics and session recordings, hosted in the United States.
• LinkedIn — advertising measurement (only if you consent to marketing cookies): the LinkedIn Insight Tag reports pages visited and sign-ups so we can measure our LinkedIn advertising and show ads to people who have visited the site. LinkedIn processes this data in the United States.
• Meta (Facebook and Instagram) — advertising measurement (only if you consent to marketing cookies): the Meta Pixel reports pages visited and sign-ups so we can measure our Facebook and Instagram advertising and show ads to people who have visited the site. Meta processes this data in the United States, and acts as an independent controller for its own advertising purposes as well as on our instructions.
• Cloudflare — hosting, content delivery, security (including the Turnstile bot-protection check on some pages), and operational logging.
• Hetzner — infrastructure hosting, including our search database and alert-processing pipeline (EU data centres).
• Postmark — email delivery: sends transactional and notification emails.
• OpenAI and Anthropic — AI features: when you use semantic search or AI-assisted analysis, your search text and the relevant company data are sent to these providers to generate results. We do not send your account details to these services.
• Exa — news search: when you request company news through our API, the company name or search term is sent to Exa to find and summarise relevant articles.
• Apify — if you choose to connect through our MCP actor on the Apify platform, your requests are routed via Apify's infrastructure.
• PDFShift — document generation: converts report pages to PDF when you request a report.
• Professional advisers: including lawyers, auditors, and insurers where necessary.
• Regulatory authorities: including HMRC and the ICO, where required by law.

We require all third-party service providers to respect the security of your personal data and to treat it in accordance with the law. We do not allow them to use your personal data for their own purposes and only permit them to process it for specified purposes and in accordance with our instructions.

8. International Transfers

Some of our service providers (including PostHog, LinkedIn, Meta, Stripe, Postmark, OpenAI, and Anthropic) process data in the United States or other countries outside the UK. Where personal data is transferred outside the UK, we rely on safeguards recognised under UK law: the UK Extension to the EU–US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Agreement / UK Addendum to the EU Standard Contractual Clauses.

Please contact us if you would like further information about the specific safeguards applied to international transfers of your data.

9. Data Security

We have implemented appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, accessed, altered, or disclosed in an unauthorised way. These include:

• Encrypted data transmission (HTTPS/TLS).
• Secure authentication and session management.
• API keys stored only as cryptographic hashes, plus a short prefix used to identify each key in your dashboard.
• Access controls limiting data access to authorised personnel only.
• Regular review of our security practices.

We have procedures in place to deal with any suspected personal data breach and will notify you and the relevant regulator where we are legally required to do so.

10. Cookies and Similar Technologies

CompanyTrack uses the following cookies and similar technologies:

• Essential: __session (Clerk) keeps you signed in securely (up to 7 days); ts_pass records that you have passed a bot-protection check (about 2 hours). These are necessary for CompanyTrack to function and cannot be disabled.
• Preferences: your chosen theme (light or dark) is stored in your browser's local storage.
• Analytics (consent only): if you accept analytics, PostHog sets cookies and local storage entries to measure how CompanyTrack is used, and records sessions as described in Section 3.2. Nothing is set unless you accept.
• Marketing (consent only): if you accept marketing cookies, the LinkedIn Insight Tag and the Meta Pixel set cookies to measure whether our LinkedIn, Facebook and Instagram advertising leads to sign-ups, and to build advertising audiences from site visits. Neither tag is loaded, and nothing is set, unless you accept.

When you first visit CompanyTrack we ask whether to enable analytics and marketing cookies. You can change your choice at any time — use the button below or the "Cookie settings" link in the page footer — and withdrawing consent stops analytics collection immediately and stops marketing tags loading from your next page view. You can also set your browser to refuse cookies, though disabling essential cookies means parts of CompanyTrack will not function.

Open cookie settings

11. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which we collected it, including to satisfy any legal, accounting, or reporting requirements. In particular:

• Account records: by law, we keep basic information about our customers (Contact, Identity, Financial, and Transaction Data) for six years after they cease being customers, for legal and tax purposes.
• API and MCP request logs: approximately three months.
• Site usage logs (searches and profile views linked to your account): up to 12 months.
• Anonymous usage metering (IP-based daily counters): kept only as long as needed for metering and security.
• Register data (Section 4): retained while it remains on, or continues to reflect, the public register, and updated as the register changes.

When you delete your account, we will delete or anonymise your personal data, except where we are required by law to retain it.

12. Your Legal Rights

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: request correction of any inaccurate or incomplete data.
• Right to erasure: request deletion of your personal data in certain circumstances.
• Right to restrict processing: request that we limit how we use your data.
• Right to data portability: request transfer of your data to you or another provider in a structured, machine-readable format.
• Right to object: object to our processing of your data where we rely on legitimate interests (see Section 4.4 if you appear on the public register). Where you object to direct marketing, we will always stop.
• Right to withdraw consent: where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at info@companytrack.com. We will respond to all legitimate requests within one month. If your request is particularly complex, we may require up to an additional two months, and we will notify you accordingly.

You will not normally have to pay a fee to exercise your rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.

13. Marketing

We may use your Identity and Contact Data to send you information about CompanyTrack features, updates, and services that may be of interest to you.

You will only receive marketing communications from us if you have opted in to receive them, or if you are an existing customer and the marketing relates to similar products and services.

We will not share your personal data with third parties for their own marketing purposes without your explicit consent.

You can opt out of marketing communications at any time by contacting us at info@companytrack.com or by using the unsubscribe link in any marketing email.

14. Third-Party Links

CompanyTrack may include links to third-party websites, plug-ins, and applications. We do not control these third-party websites and are not responsible for their privacy practices. When you leave CompanyTrack, we encourage you to read the privacy policy of every website you visit.

15. Children's Privacy

CompanyTrack is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected personal data from a child, we will take steps to delete that data promptly.

16. Changes to This Privacy Policy

We may update this privacy policy from time to time. The updated version will be posted on CompanyTrack with a revised "Last updated" date. We encourage you to review this policy periodically.

Where changes are significant, we will endeavour to notify you by email or through a notice on CompanyTrack.

17. Contact Us

If you have any questions about this privacy policy or wish to exercise your data protection rights, please contact us:

• Email: info@companytrack.com
• Post: Team Dimensions Ltd, 128 City Road, London, EC1V 2NX, United Kingdom