Privacy Policy
This notice is given under Article 13 of the UK GDPR. It explains how UKGovscan processes personal data when you create an account, take out a subscription, contact us, or use account features such as lists, alerts and Ask-AI. The personal data of individuals who appear in the public records we publish, and who do not hold an account, is covered by a separate notice: How we use public-record information.
On this page
1. The controller
UKGovscan is operated by Elenchos Ltd, a company registered in England and Wales. Elenchos Ltd is the controller in respect of the processing described in this notice.
Elenchos Ltd is registered with the Information Commissioner’s Office under reference ZC251505.
Privacy enquiries and requests to exercise data protection rights may be sent to [email protected]. Our company number and registered office are set out in our Terms of Service.
2. Personal data we collect
We process the following personal data:
- your name and email address, and the identifiers used to authenticate you;
- your saved lists, notes and alert rules, and the notifications generated for you;
- your notification preferences and, if you link one, your Telegram chat identifier;
- your plan, your subscription status and a Stripe customer reference;
- the questions you submit to Ask-AI, the database queries generated from them and the answers you receive;
- a record of whether each email we send you is delivered;
- correspondence you send us and our replies, including data protection requests and complaints;
- a record of sensitive actions taken on your account by our administrators, such as a refund, a suspension or a deletion made at your request;
- the date on which your account was last active, and whether it is suspended; and
- technical data, namely your IP address, which is held in memory to apply rate limits, and server logs retained for a limited period.
Payments are processed by Stripe. We do not receive or store payment card numbers.
You must provide an email address to hold an account, and we cannot provide the service without one. All other personal data is collected only when you use the feature to which it relates.
If you use UKGovscan without signing in, we do not create a profile of you. Your IP address is processed briefly for rate limiting, and our cookieless analytics counts page views in aggregate. Section 9 lists each item stored on your device.
We retain the terms entered in the search box, with the date and the number of results, in order to understand what users search for and which searches return no results. These records contain nothing that identifies you or your account, whether or not you are signed in, and are deleted after 90 days.
3. Purposes and lawful bases
UK data protection law requires a lawful basis for each purpose for which we process personal data. Each purpose, and the lawful basis on which we rely for it, is set out below.
| Purpose | Lawful basis |
|---|---|
| Providing your account and its features, including lists, alerts and notifications | Necessary to perform our contract with you, under Article 6(1)(b) |
| Managing subscriptions and taking payment | Necessary to perform our contract with you, under Article 6(1)(b), and compliance with our legal obligations in respect of tax and accounting records, under Article 6(1)(c) |
| Sending the alerts you have selected, by email or Telegram, and recording whether each email was delivered | Necessary to provide the service you requested, under Article 6(1)(b). Alerts can be switched off at any time |
| Answering Ask-AI questions (section 4) | Necessary to provide a feature you have chosen to use, under Article 6(1)(b) |
| Applying plan limits and preventing misuse of Ask-AI and other features | Our legitimate interests in enforcing account limits and preventing abuse, under Article 6(1)(f) |
| Improving search, by analysing which terms are searched for and which return no results | Our legitimate interests in improving the effectiveness of search, under Article 6(1)(f) |
| Maintaining the security of the service, including rate limiting, security logging and administrative audit records | Our legitimate interests in protecting the service and its users, under Article 6(1)(f) |
| Responding to enquiries and providing support | Our legitimate interests in operating the service and assisting users, under Article 6(1)(f), or Article 6(1)(b) where the enquiry concerns our contract with you. Authorised personnel can view your account in order to resolve a problem, and each such action is recorded |
| Handling data protection requests and complaints | Compliance with our legal obligations, under Article 6(1)(c), together with our legitimate interests in maintaining a record of how each request was handled, under Article 6(1)(f) |
| Complying with the law, court orders and lawful requests from authorities | Compliance with a legal obligation, under Article 6(1)(c) |
We do not use your personal data for advertising. We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
4. Ask-AI
When you use Ask-AI, your question is converted into a database query, and the results of that query are used to write an answer.
Your question is sent to Anthropic, which provides the AI service used by this feature, together with the query results from which the answer is written. We do not send Anthropic any other information about you, such as your name, email address, lists or notes.
Ask-AI accesses the database through a separate read-only account, which cannot change or delete any data.
We retain the record described in section 2 in order to operate the feature, apply plan limits and investigate failures. When a failure is investigated, authorised personnel can read the question that caused it and the answer given. You should therefore not enter into Ask-AI any information that you would not wish to be read. Each time that record is accessed, we log the person who accessed it and the information viewed.
Your question, the query generated from it and the answer are erased after 90 days, or immediately if you delete your account, as set out in section 7.
5. Public-record information
Separately from account data, UKGovscan publishes personal data that forms part of the public record, drawn from Companies House, the Parliamentary registers of interests, the Electoral Commission, the Charity Commission and its Scottish and Northern Irish counterparts, individual councils, and government procurement and spending publications.
We process this data on the basis of legitimate interests, under Article 6(1)(f), namely the public interest in the scrutiny of public office, public money and political influence. Our legitimate interests assessment is available on request.
That processing is described in How we use public-record information, which sets out the sources, the processing, retention and the rights of the individuals concerned.
7. Retention
| Information | Retention period |
|---|---|
| Account data | For as long as your account remains open. When you delete your account, this data is erased, including your Ask-AI history, and we instruct our authentication and payment providers to erase the corresponding data. |
| Ask-AI questions | Questions, the database queries produced from them and the answers given are erased 90 days after submission. The associated usage record, which contains a count of queries and tokens but no question text, is retained for 24 months so that plan limits and billing can be verified. Both are erased immediately if you delete your account. |
| Billing and financial records | Stripe retains transaction, tax and regulatory records for as long as the law requires, and for its own purposes where it acts as a controller in its own right. WorkOS retains the data it requires to operate authentication. |
| Email delivery records | For as long as they are needed to ensure that alerts are delivered to you, and to prevent further email being sent to addresses that reject it. |
| Support, requests and complaints | For as long as the matter remains open, and thereafter for as long as a record of how it was handled is required. |
| Administrative audit records | Retained after an account is deleted, as their purpose is to record what was done by a person acting on our behalf, and for no longer than that purpose requires. Each record contains the action, the date and the email address of the account concerned. |
| Technical data | IP addresses used for rate limiting are held in memory for a rolling period of approximately one minute and are not written to our database. Server logs are retained for a limited period. |
| Public-record data | For as long as it serves the purpose described in section 5 and its official source continues to publish it. A record withdrawn by its source is marked as withdrawn. |
Deleting your account removes the account data that we no longer need. It does not remove data that we, or another controller such as Stripe, are required to retain.
8. International transfers
Our servers are located in Germany.
Several of the providers listed in section 6, and companies on which they in turn rely, process data in the United States or elsewhere outside the United Kingdom. Where section 6 names a country, it identifies where the processing known to us takes place. It is not a representation that no affiliate or supplier of that provider is located elsewhere.
Where UK law treats such processing as a restricted transfer, we use an appropriate transfer mechanism: the UK’s adequacy regulations, the UK Extension to the EU–US Data Privacy Framework (the UK–US Data Bridge) where the recipient is certified under it, or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment where one is required.
Details of the safeguards used for a particular transfer are available on request from [email protected].
9. Cookies and device storage
The law applies the same rules to information stored on or read from your device as it applies to cookies. The table below lists every such item that the service uses.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| wos-session | Cookie (necessary) | Maintains your signed-in session. Set by WorkOS, our authentication provider, only when you sign in, and removed when you sign out. | Up to 400 days, renewed while you use the site |
| wos-auth-verifier-… | Cookie (necessary) | Secures the sign-in process. Set by WorkOS when sign-in begins and cleared when it completes. One is set for each sign-in attempt, so several may be present if sign-in is opened in more than one tab; the oldest are removed automatically. | Approximately 10 minutes |
| wos-callback-restart | Cookie (necessary) | Set only when sign-in returns without the expected security token, so that the attempt is restarted once rather than repeatedly. It contains no information about you. | 2 minutes |
| ukgs_intent | Cookie (necessary) | Set when you save or track an item before signing in, so that the action can be completed after you sign in. Sent only to the page that completes it. | 24 hours |
| ukgs-theme | Local storage (preferences) | Stores your choice of light or dark theme. | Until you clear it |
| uks:recent-searches | Local storage (preferences) | Stores your recent searches, which are shown when the search box is empty. | Until you clear it |
| umami.disabled | Local storage (preferences) | Records that you have disabled analytics on this device. | Until you clear it |
| ask-ai:thread | Session storage (necessary) | Stores your recent Ask-AI questions and answers, so that they are restored when you return to the page. | Until you close the tab |
| cp:… and acc-fetch:… | Session storage (necessary) | Stores company profile data you have already loaded, so that it is not fetched again when you return to the profile. | Until you close the tab |
Local and session storage remain in your browser and are not sent to us. You can clear or block any of these items in your browser settings. Blocking the session cookie will sign you out.
Analytics
We count page views using Umami, which runs on our own server. Umami sets no cookie, stores no identifier on your device and cannot track you across other websites. It records the page viewed, the referring website, and your browser language, screen size and country.
You may object to this processing at any time using the control below. An objection applies only to the device and browser on which it is made.
Analytics is enabled on this device.
10. Your rights
Subject to the circumstances and to the lawful basis relied upon, you have the following rights:
- Access. A copy of the personal data we hold about you.
- Rectification. Correction of inaccurate or incomplete data.
- Erasure. Deletion of your data, in certain circumstances.
- Restriction. Restriction of our use of your data, in certain circumstances.
- Objection. Objection to processing based on legitimate interests.
- Portability. A copy of the data you provided to us, in a portable format. This applies to account data processed under our contract with you, and not to the public-record database.
- Withdrawal of consent. Where we rely on consent, you may withdraw it at any time.
- Complaint. To us, and to the Information Commissioner’s Office, as described in section 11.
You may delete your account at any time from Profile & privacy. Any other request may be sent by email to [email protected]. In response to an access request, we provide all personal data held about you, including your notes, your Ask-AI history and our record of the emails we have sent you. The records held by WorkOS and Stripe, and our administrative audit records, are also provided on request. Requests concerning public-record data may be made in the same way.
We respond within one month of receiving a request. Where a request is complex, or where you have made a number of requests, the law permits additional time; in that event, we will inform you within the first month and explain the reasons.
Before acting on a request, we may ask for the information reasonably necessary to confirm your identity, or your authority to act on behalf of another person. We will not ask for more information than is required for that purpose.
No fee is charged. Article 12(5) of the UK GDPR permits a reasonable fee, or a refusal, where a request is manifestly unfounded or excessive, or where further copies are requested. If we rely on that provision, we will explain our reasons and how the decision may be challenged.
11. Complaints
Under section 164A of the Data Protection Act 2018, you have the right to complain to us about our processing of your personal data. You may make a complaint by email to [email protected].
We will acknowledge receipt of your complaint within 30 days. We will then, without undue delay, take appropriate steps to respond to it and inform you of the outcome.
You may also complain at any time to the Information Commissioner’s Office, the UK’s data protection regulator, at ico.org.uk/make-a-complaint. The ICO recommends that you first give us the opportunity to complete our complaints process.
12. Changes to this notice
We may amend this notice, including where our service, our providers or our legal obligations change. The current version, with its effective date, is published at ukgovscan.com/privacy.
Where a change materially affects how we use account holders’ personal data, we will notify them by email before it takes effect.