Privacy Policy

Last updated: 27 July 2026.

1. Data controller

Will Evans (sole trader), operating Formation Alert. Contact: hello@formationalert.com.

2. What we collect from you

• Email address. Used to send sign-in links, transactional emails, and the Tuesday digest.
• Filter preferences. The SIC codes and postcode areas you set.
• Billing details. Handled by Stripe. We never see your card number. We store your Stripe customer ID and subscription ID.
• Server logs. Nginx access logs, containing timestamps, IP addresses, and user-agent strings, retained for 30 days for security and troubleshooting.
• Page views. We count visits to our own pages so we can tell which of our articles anyone actually reads. For each view we store the time, the page, the referring site, your browser's user-agent string, and a one-way salted hash of your IP address and user-agent. We do not store your IP address itself, and the hash cannot be reversed back to it — it exists only so that ten pages read by one person are not counted as ten people. This runs on our own server; no data leaves it. Retained for 180 days.

3. What we do NOT collect

We do not use analytics cookies, third-party trackers, or advertising pixels. There is no Google Analytics on this site, and no analytics company receives anything about you. The page-view counting described above is entirely first-party: it uses no cookie, sets nothing on your device, and cannot follow you to any other website.

4. Companies House data

The digest content is drawn from the UK Companies House public register (a public dataset published by UK Government). This is publicly-available information about UK Ltd companies. Formation Alert does not collect or store personal data about company officers beyond what appears in the register itself and only surfaces it to you where relevant to a matched lead.

5. Legal bases for processing

• Sending you the digest and account emails — performance of contract.
• Billing — performance of contract.
• Security logs — legitimate interests (preventing abuse).
• Page-view counts — legitimate interests (knowing which of our own pages are read, using pseudonymised data and no third party).

6. Sharing

We share only what is necessary with these processors:

• Amazon Web Services (SES, Lightsail, Route 53, S3) — hosting and email delivery.
• Stripe — payment processing.
• Anthropic — AI summary of publicly-listed company data (company name and SIC codes only; your email is not sent).
• Companies House — source of the register data.

We do not sell your data.

7. Your rights

You can request access, correction, deletion, or export of your data by emailing hello@formationalert.com. We respond within 30 days.

8. Retention

• Account data: retained while you have an active subscription and for 90 days after cancellation.
• Server logs: 30 days.
• Page-view records: 180 days, then deleted automatically.
• Billing records: 7 years (UK tax law).

9. International transfers

Data is stored in the AWS eu-west-2 (London) region. Anthropic is a US-based processor; requests to Anthropic are governed by the Anthropic Data Processing Addendum, which uses Standard Contractual Clauses for EU/UK transfers.

10. Complaints

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ico.org.uk).