Legal
Privacy notice
Version 1.2, effective 18 October 2026.
1. Who we are
Policy365 Sanctions Screening is provided by Trailhead Design Limited, trading as Policy365, a company incorporated in British Columbia, Canada, incorporation number BC1560803, registered office 7687 Ontario Street, Vancouver, BC V5X 3C4, Canada ("we", "us"). For anything about this notice or your personal data, contact support@policy365.cloud.
This notice explains what personal data the service holds, why, and for how long. It covers our business customers' contacts, the people whose names are screened, and visitors to this website.
2. What we hold
| Data | Where it comes from |
|---|---|
| Account details: the business's name, the contact's name, email address and phone number where given, and sign-in records. | You, when you sign up or update the account. |
| Payment details. Card details are held by Stripe, not by us. We hold Stripe's customer and subscription references and the billing status. | You, through Stripe's payment form. |
| Names screened: names of people and companies, with the month and year of birth where given, the role (such as "director"), and the customer's own reference. | Our customers, who send them to the API. |
| Company officers and persons with significant control: their names, roles, month and year of birth, nationality, occupation, appointment dates and any entries on the disqualified directors register. | Companies House's public register, which we query when a customer asks us to look up or screen a company. |
| Screening records: each request and its answer (the names above, the results and any listed entries they resembled), when it was made, by which customer, and which version of each list was used. | The service, as it screens. |
| Usage ledger: one row for each call, holding the customer, the key used, the endpoint, the customer's reference, the outcome, timings and the screening's id. It holds no names or dates of birth. | The service, as calls are made. |
| AI assistant connections: which assistant a person connected (as it names itself, such as "Claude"), when, and when it was last used. Its sign-in tokens are kept only as a hash and can't be read back. | You, when you connect an assistant. |
| Light accounts: the email address, and a count of checks made each day. The names a light account screens are screened in memory and not kept: no names, no results and no references are stored, and its row in the usage ledger says only that a check was made, and through which assistant. | You, when you connect an assistant without an account. |
| Certificate offers: when a light check is offered as a certificate, the request (the names, years of birth, roles and references given) is held, encrypted, for up to 24 hours. Bought, it is screened and becomes a screening record, made in the business name the buyer gives; not bought, it is deleted. | Your AI assistant, from what you asked it; you, at checkout. |
| The homepage's try box keeps nothing typed into it. To limit it to ten lookups a day, the service remembers how many lookups each IP address has made in the last 24 hours, in memory only; that count is gone after 24 hours, or sooner if the service restarts. | Your browser's connection. |
| Website and security logs: the service's own log of warnings and errors, with the time, the page or endpoint (never its query string, so never a name or date of birth sent in one) and a reference; and the hosting's logs of connections to the site, including IP addresses, kept by Microsoft Azure. | Your browser or your systems' connection. |
We use only what this site needs to work: a cookie that keeps you signed in, one that protects its forms against forgery, and the hosting's own cookie that keeps your visit on one server. There are no analytics, advertising or tracking cookies. On the sign-up page, Stripe's card form sets its own cookies to prevent fraud, and a certificate's payment page is Stripe's own. Your choice of light or dark is kept in your browser, and never sent to us.
3. Our role
- For names our customers send us, and for the officers and controllers Companies House records for a company a customer sends, we act as a processor: we screen them and keep the record on the customer's instructions, under our data processing addendum, and the customer is the controller. If your name was screened by an insurer, broker or other business, they are the first place to ask about it.
- For names screened by a light account, or held for a certificate, we act as a processor for the business using it, on the same terms. A light check is kept nowhere; a certificate's request is held for up to 24 hours and, once bought, becomes that business's screening record.
- For account details: the people at our customers who use the service, and visitors to this website, we act as a controller.
- For our register of companies, we act as a controller. Each company looked up at Companies House is kept, with the officers and persons with significant control Companies House publishes for it, current and former, and their appointments: names, month and year of birth, nationality, country of residence, occupation and dates. It's public register data, reused under the Open Government Licence, and it holds nothing a customer sends us and no screening's result. We keep it for our legitimate interest in helping our customers check who they deal with, accurately and without asking Companies House again for each check. An appointment that ended more than six years ago is deleted, and anyone left with no appointments with it.
4. Why we use it, and the lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing the service to customers, and running their accounts | Contract (with the customer); legitimate interests, for the contact people at a business customer |
| Screening names sent by customers (as processor) | As processor: the customer's lawful basis, typically legal obligation, or legitimate interests in meeting sanctions law |
| Fetching and screening the officers and controllers Companies House records for a company a customer sends (as processor) | As processor: the customer's lawful basis, typically legal obligation, or legitimate interests in meeting sanctions law |
| Keeping screening records as evidence of what was screened, against which list, and when (as processor) | As processor: the customer's lawful basis, typically legal obligation, or legitimate interests in meeting sanctions law |
| Connecting AI assistants, and counting a light account's checks for its daily limit | Contract; legitimate interests, in limiting a free service's misuse |
| Holding a light check's request for up to 24 hours, so it can be bought as a certificate (as processor) | As processor: the customer's lawful basis |
| Billing and keeping accounting records | Contract; legal obligation (tax and company law) |
| Keeping the service secure and limiting misuse (rate limits, the try box's daily limit, logs) | Legitimate interests |
A screening result can show that a person resembles someone on a sanctions list. Where that amounts to data about criminal offences or allegations, the customer, as controller, relies on its own condition under the Data Protection Act 2018, Schedule 1 (for a regulated firm, typically preventing or detecting unlawful acts, or meeting a regulatory requirement), and we process it only on the customer's instructions. The service makes no decisions about anyone: a possible match is passed to the customer for a person to look at.
5. How long we keep it
| Data | Kept for |
|---|---|
| Screening records and results files | Six years from the screening, then deleted. For those six years they are held under a write-once lock: no one can change or delete them, including us. |
| A light account's checks | Not kept: screened in memory and answered. Only a count of checks is kept, in the usage ledger. |
| A certificate offer's held request | Up to 24 hours, then deleted, unless bought (two hours more while a payment that was started is confirmed). Once bought it is cleared, and the certificate is kept as a screening record. |
| AI assistant connections | While connected; ended ones as long as the account's details. |
| Usage ledger and billing records | Six years from the end of the financial year they relate to, for tax and accounting. |
| Account details | While the account is open, then six years after it closes, as long as the screening records it holds. |
| Our register of companies, their officers and persons with significant control | While an appointment runs, then six years after it ends; a company, while anyone holds a role in it or it was looked up in the last six years. |
| Companies House answers held to save repeat lookups | Minutes, in memory (they are also kept inside any screening record they were used for). |
| Try box counts per IP address | 24 hours, in memory. |
| Website and security logs | The service's log: 90 days. The hosting's logs: 7 days. |
6. Who we share it with
We do not sell personal data. We use these sub-processors and sources:
| Who | What for | Where |
|---|---|---|
| Stripe | Taking payment, subscriptions, invoices and certificate payments (with the buyer's business name and email): our own account data | USA, and other countries where Stripe operates |
| Microsoft (Azure) | Hosting the service, its database and its records: our sub-processor for the names screened | UK (UK South, London) |
| Microsoft (Microsoft 365) | Sending email (sign-in links, account and billing notices): our own account data | UK |
| Companies House | A source, not a sub-processor: we send it a company name or number to look up. We do not send it the names of people you screen. | UK |
An AI assistant you connect, such as Claude, is provided by its own provider (Anthropic, for Claude) under your own terms with them. The names you ask it about pass through it before they reach us, and our answers pass back through it. It is your choice to use one, and its provider is not our processor or sub-processor.
The sanctions lists are fetched from their publishers (the FCDO, the European Commission, the United Nations, Global Affairs Canada and the US Treasury's Office of Foreign Assets Control); nothing about anyone is sent to them. We may also disclose data where the law requires it, or to professional advisers under a duty of confidence.
7. International transfers
We keep the service's data in the UK. Where a sub-processor handles it outside the UK (for example Stripe in the USA), the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the recipient is certified) or the UK International Data Transfer Addendum to the EU standard contractual clauses. You can ask us for details.
8. Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- have inaccurate data corrected;
- have data deleted, or its use restricted, in some circumstances;
- object to our use of it where we rely on legitimate interests;
- have data you gave us transferred to you or someone else, in some circumstances.
Some rights are limited where we must keep records to meet a legal obligation, or where data is held to prevent or detect crime. Where we hold your data as a processor for one of our customers, we will pass your request to that customer and help them answer it.
To use any of these rights, contact support@policy365.cloud. We will answer within one month.
9. Security
Data is encrypted in transit and at rest. API keys and AI assistants' sign-in tokens are stored only as a hash and can't be read back. A certificate offer's held request is encrypted. The service reaches its database only through fixed procedures, and its records can't be altered or deleted by the service itself. Each screening's answer and each results file is kept in storage locked against change or deletion for six years. The service runs on Microsoft Azure in the UK; its database is backed up automatically, with backups kept for seven days in the UK, and the records' storage keeps three copies of every record within a UK data centre.
10. Complaints
Please contact us first at support@policy365.cloud, and we will try to put things right. You may also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
11. Changes
We will update this notice when what we do changes, and show the date of the version in force at the top.