Privacy Policy
Last updated 15 October 2026
Draft: some details in [brackets] are still missing. Set the LEGAL_* variables before going live.
1. Who we are
ContaScope is run by [company name], company number [company number], registered office [registered office address]. We are registered with the Information Commissioner’s Office (ICO) under number [ICO registration number].
For the personal data of the people who sign up and pay, we are the controller. For personal data that a customer puts into its own workspace, the customer is the controller and we are its processor (see the data protection section of the Terms). Contact us about anything in this policy at contact@contascope.co.uk.
2. What we collect, why, and how long we keep it
ContaScope is a business tool for accountancy firms. We do not run adverts, we do not sell personal data, and we do not use analytics or advertising trackers.
| Data | Why we use it | Legal basis | How long |
|---|---|---|---|
| Account details: your name, work email, firm name, role, and a salted hash of your password (never the password itself). | To create your account, sign you in, confirm your email, reset your password and run your workspace. | Contract | Until the workspace is deleted. |
| Your workspace: the companies you monitor, tags, notes, imported CSV rows, and notification settings. | To provide the monitoring, alerts and digests you asked for. | Contract (you are the controller; we are the processor) | Until you remove it or delete the workspace. |
| Companies House data about the companies you monitor, including officers and people with significant control: names, role, appointment dates, month and year of birth, nationality, occupation, country of residence and the correspondence address as published. | To show deadlines, detect changes (for example a director resigning) and alert you. | Legitimate interests: helping firms keep track of their clients’ legal filing obligations, using information that is already public. See section 3. | While at least one workspace monitors the company. Change history is kept for the same period. |
| Alerts, deadline reminders and a copy of each email we send you (the Outbox). | To show what changed and prove what was sent. | Contract | Until the workspace is deleted. |
| Invitations: the email address of a colleague you invite. | To let them join your workspace. | Legitimate interests (running the invitation you asked for) | The link expires automatically; the record goes with the workspace. |
| Sign-in sessions: a random token (stored only as a hash) and its expiry. Your IP address is used briefly in the server’s memory to limit repeated sign-in attempts and is not saved to our database. | To keep you signed in securely and to block abuse. | Contract; legitimate interests (security) | Sessions last 30 days or until you sign out. Rate-limit counters last minutes. |
| Billing: plan, status, billing period, and your Stripe customer and subscription IDs. Stripe collects your card details and billing address itself; we never see the full card number. | To take payment and manage your subscription. | Contract; legal obligation (tax and accounting records) | Invoice and payment records for 6 years, as tax law requires. |
| Server and security logs kept by our hosting providers (IP address, time, requested address, error details). | To keep the Service secure and to fix faults. | Legitimate interests | For a short period, as set by the provider. |
| Messages you send us (for example support emails). | To reply and to help you. | Legitimate interests; contract | Up to 3 years after the conversation ends, or until you ask us to delete it. |
We send only service emails (confirmation, password reset, invitations, alerts, digests and billing notices). We do not send marketing emails. If that changes, we will ask first.
3. People named on the public register
Directors, secretaries and people with significant control are named on the Companies House register. That register is public by law. We receive their details from Companies House (the source), not from the individuals, and we show them to the customers who monitor the company.
We do this so that accountants can see when a company’s officers change. We use only what Companies House publishes, we do not add to it, and we do not use it to contact those individuals or to build profiles of them. We have weighed this against the individuals’ interests and consider it proportionate, because the information is already public and the use is limited and expected.
If you are named on the register and want to see, correct or object to how we use your details, email contact@contascope.co.uk. Errors in the register itself have to be corrected with Companies House.
4. Who we share data with
We share personal data only with companies that help us run the Service (our processors or “sub-processors”), under contracts that require them to protect it:
| Provider | What they do |
|---|---|
| Supabase | Hosts our database (account, workspace and register data). |
| [hosting provider] | Hosts the website and background services. |
| Stripe | Takes card payments and runs the billing portal. Stripe also acts as an independent controller for its own fraud-prevention and legal duties. |
| [email delivery provider] | Delivers our service emails. |
| Companies House | We send it the company numbers you monitor to fetch the public register data. No personal data about you is sent. |
Other people in your workspace can see its data, as you intend. We may also disclose data if the law requires it, to protect our rights or others’ safety, or in a sale or merger of the business (the buyer would have to honour this policy). We will tell you before we add a sub-processor that handles your workspace data.
5. Transfers outside the UK
Some of our providers, such as Stripe, may process data outside the UK. When they do, we make sure the transfer is protected, for example because the country is covered by UK adequacy regulations (including the UK–US data bridge for certified US companies), or by the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us if you would like details.
6. How we protect data
- Connections are encrypted in transit.
- Passwords are stored only as salted bcrypt hashes. Session, confirmation and reset tokens are stored only as SHA-256 hashes, so a copy of the database does not let anyone sign in.
- The session cookie cannot be read by scripts on the page.
- Every workspace’s data is separated in the database, and the database itself enforces that separation with row-level security.
- Sign-in and email requests are rate limited.
7. Deleting your data
The workspace owner can delete the workspace in Settings. This removes the account, the team, the monitored companies, the alerts and the history from our live database straight away. Copies in encrypted backups are overwritten on a rolling schedule. Billing records that the law requires us to keep stay, as shown in the table above.
Before you delete, you can export your clients and deadlines as CSV from the app. To have a single person’s account removed, or to ask us to delete anything else, email contact@contascope.co.uk.
8. Your rights
Under the UK GDPR you can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct data that is wrong;
- erase your data, in the cases the law provides;
- restrict how we use it, in the cases the law provides;
- give you the data you provided in a portable format;
- stop using it where we rely on legitimate interests (you can object, and we will stop unless we have compelling reasons).
Email contact@contascope.co.uk. We reply within one month. We may need to confirm who you are first. If your data is in a customer’s workspace, we may pass your request to that customer, because it is the controller.
If you are unhappy with how we handle your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
9. Automated decisions
ContaScope works out a risk level for each company automatically from register data (status, deadlines, recent changes). It is a sorting aid for the accountant. It does not make decisions with legal or similarly significant effects about any individual.
10. Children
ContaScope is for businesses and is not aimed at anyone under 18. We do not knowingly collect data from children.
11. Changes to this policy
If we change what we do with personal data, we will update this page and the date at the top, and tell account owners by email when the change is significant. See also our Cookies page and Terms of Service.