Privacy Notice

Version 0.1. Last updated: 4 November 2026.

This notice explains how AIBI LTD handles personal data in UK Company Check (the "Service"). It covers our customers and their users, and the directors, members, people with significant control (PSCs) and other individuals whose details appear on the Companies House records we read.

Who we are

AIBI LTD (company number 16142632, registered office 80 Osborne Road, London, England, W3 8SR) operates the Service. Contact us about privacy at hello@aibisolutions.co.uk. AIBI LTD's registration with the Information Commissioner's Office is in progress; we will publish our registration number here once issued.

What data we use

• Inputs you give us: company numbers and names, batch lists, monitoring lists, any webhook URL, and the references you add to them.
• Public register data: from the Companies House public register, company details, filing history, charges and insolvency notices, and what the register publishes about officers and PSCs: name, role, appointment and resignation dates, month and year of birth, nationality, country of residence, occupation, identity verification status, other appointments. For disqualification screening, we use names and month and year of birth to identify possible matches on the public register. Register responses can briefly include a full date of birth, addresses and reasons for disqualification. We extract the matching details, published disqualification dates and register link, and do not cache those disqualification responses. Saved results contain the possible match, its matching basis, the published period and the register link, without the reason narrative, full date of birth or address from that response.
• Results we produce: verdicts, scores, reasons and summaries, which can include the register details above.
• Customer account data: your work email, a scrambled (hashed) copy of your API key (we do not store the key itself), credit balance and usage history, batch jobs, monitoring settings and change events, and your webhook signing secret. Account records also include activity dates, purchase references, the business confirmation and Terms version accepted when starting a purchase, and records of credit charges, returns and expiry.
• Payment data: from our payment provider, the order reference, amount, status and the name and email given at checkout. We never receive full card details.
• Technical data: your IP address, used to apply the daily free allowance, record where a key was created, and protect the Service from abuse, and hosting request metadata such as IP address, time, endpoint and response code. API keys are supplied in request headers; URL credentials are not accepted. Our hosting provider may receive a URL before our application rejects it.
• Correspondence: emails you send us and our replies.

Our role

• For your inputs and the check and batch results, monitoring settings and change events we store for you, we act as your processor under the processing terms in section 11 of our Terms of Service. You are the controller.
• For public register data that we retrieve to produce results, and for customer account, payment, technical and correspondence data, AIBI LTD is the controller.
• Once you receive results, you are an independent controller of any personal data in them.

Why we use it and our lawful basis

• Screening companies using public register data: legitimate interests (UK GDPR Article 6(1)(f)). Our interest, and our customers', is knowing who they are dealing with and spotting risks such as insolvency, overdue filings, missing identity verification or disqualified directors, which is why the register is public. We use only published register data, do not combine it with other sources, and do not build profiles of individuals. Disqualification screening is limited to possible register matches and published periods; results do not report the reason for the disqualification. For disqualification screening, our purpose is to identify possible current directors acting while disqualified and associated corporate fraud or false authority in B2B counterparty due diligence. This involves criminal-offence data. In addition to legitimate interests under Article 6(1)(f), we rely on Schedule 1 paragraph 10 to the Data Protection Act 2018, as extended for criminal-offence data by paragraph 36. We use this condition only where screening is necessary to prevent, investigate or detect unlawful acts and obtaining the individual’s consent would prejudice that purpose.
• Providing your key, credits, batch jobs and monitoring: contract (Article 6(1)(b)).
• Taking payment and keeping accounting and tax records: contract and legal obligation (Article 6(1)(c)).
• Free allowances, security and preventing abuse: legitimate interests in keeping the Service available, fair and secure.
• Answering your messages: legitimate interests, or contract where you are a customer.
• Emailing business contacts about the Service: legitimate interests (see below).

We do not use personal data for advertising and we do not sell it. The Service does not itself make decisions about individuals; it produces screening indicators about companies for our customers to review, and our Terms prohibit using results as the only basis for significant decisions about individuals.

Directors, PSCs and other individuals on the register

If you are a director, member or PSC of a UK company, our results may show details about you that are published on the Companies House public register, listed above. We obtained them from the Companies House public data API. We do not store a separate profile of you: register data is fetched when a customer runs a check and held only briefly in our cache, and it is held for longer only inside results we store for the customer who ran the check, for the periods below. You can ask for access to, or object to, our processing by contacting us, and we will consider your request. To correct information on the register itself, contact Companies House. If a disqualification match is wrong because a different person shares your name and month and year of birth, tell us and we will look into it.

How long we keep data

We apply the retention periods below. Account and financial records may remain after report or result contents are deleted.

• Cached register responses: up to 24 hours.
• Check results made with an API key, and batch results: retained for 30 days after completion. We also keep the check reference, status, dates and credit accounting separately from the result contents. Anonymous requests retain only the records needed for the free allowance and credit accounting, not a retrievable result.
• Monitoring settings and webhook secrets: while monitoring is active; deleted when you remove the company, when monitoring stops because credits run out, or when you close your key.
• Change events: 12 months.
• Free allowance counters (IP address and date): up to 30 days.
• IP address recorded when a key is created: 12 months.
• Hosting logs: Railway provides us with 30 days of log history. Provider-held copies may be retained longer.
• Credit expiry does not automatically delete your account. We retain your account credential, account details, settings and credit records so that you can use the account again and recover payments or refunds that still need to be resolved. Reports, results and other data follow their separate retention periods below. You can contact hello@aibisolutions.co.uk to ask us to close your account or exercise your data protection rights. We may need to retain records required by law or needed to resolve outstanding payments, refunds or disputes.
• We keep payment, purchase and credit records needed to account for transactions, verify balances and fulfilment, prevent duplicate charges or credits, and resolve payments, refunds or disputes. Accounting records generally need to be kept for at least six years after the end of the last financial year they relate to, and longer where required by law. You can contact hello@aibisolutions.co.uk to request a review of the records we retain or exercise your data protection rights. We assess requests individually; closing an account or expiring credits does not automatically erase records still needed for these purposes. Reports and results follow their separate retention periods.
• Correspondence: up to 2 years after our last contact, unless needed for a dispute.
• Business contact records for outreach: see below.

Who we share data with

We do not sell data. We share it only with:

• you, our customer, who receives results you ask for, including register personal data;
• Revolut Ltd, which takes card payments as an independent controller for payment data under its own privacy notice;
• Railway Corporation, which hosts the Service and its database as our processor. The application and its SQLite storage are configured in Amsterdam, Netherlands. Railway's own operational processing is primarily in the United States;
• Google (Google Workspace), which provides our email as our processor;
• Companies House, which receives the company numbers and names we look up through its API;
• any webhook endpoint or AI tool that you choose to connect, which receives the results you ask it to; and
• professional advisers, insurers, and authorities or courts where the law requires it, or a buyer of our business under equivalent protections.

International transfers

Some providers are based in, or may access data from, outside the UK, including the United States and the European Union. Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum. You can ask us for details.

Security

Data is encrypted in transit and held on access-controlled infrastructure with restricted administrator access. We store only a hashed copy of API keys, accept API keys in request headers rather than URLs, sign webhook deliveries, and keep payment and Companies House secrets only in our hosting environment, never in logs.

Your rights

You have rights to access, correct, erase, restrict or object to processing of your personal data, and to data portability where it applies. Where we rely on legitimate interests you can object at any time, and you can always object to marketing. Contact hello@aibisolutions.co.uk. We normally reply within one month. If your request concerns a list or result a customer stored with us, we will pass it to that customer as controller and help them respond.

Complaints

If you are unhappy with how we have used your personal data, or with how we have handled a request about it, you have the right to complain to us. Please come to us first so we can try to put things right: email hello@aibisolutions.co.uk with "Data protection complaint" in the subject, or write to AIBI LTD, 80 Osborne Road, London, England, W3 8SR. We will acknowledge your complaint within 30 days of receiving it, keep you informed of progress, and tell you the outcome without undue delay.

If you are not satisfied with our response, you also have the right to complain to the UK data protection regulator, the Information Commission, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to wait for our response before doing so. (The Information Commission took over from the Information Commissioner's Office on 30 September 2026 and is still known as the ICO.)

Business contacts we email

We may email people at businesses that could use the Service, using business contact details published by their organisation. We rely on legitimate interests, email only incorporated bodies (limited companies, LLPs and similar) unless someone has agreed otherwise, keep just the name, business email, organisation and where we found the address, and delete unanswered records after 6 months. Reply "unsubscribe" or email hello@aibisolutions.co.uk and we will add you to our do-not-contact list, which we keep so that we do not contact you again.

Cookies and local storage

We do not use advertising or analytics cookies. While you use the website, it keeps your account key in memory so that it can send the requests you choose. If you select “Remember this device”, it also saves the key in this browser's local storage for later visits. This is optional: you can instead keep a copy of the key and enter it when needed. You can remove the saved key using the account controls or your browser settings. Removing it from the browser does not close the account or delete its server records. Keep a copy first if you still need access. The browser also keeps purchase request details for recovery during the browser session. If you connect through an AI tool or the command-line client, your key is stored by that tool or in your own configuration, not by us.

Changes to this notice

We will post any update on this page with a new date, and tell customers by email about significant changes where we have their address.

All results are screening indicators and not legal advice.