Privacy policy

1. Who we are

"The Accounts" / "StatDesk" (referred to here as "we", "us", "the site") is operated as an independent project by Kyle Bolton. The site is hosted at theaccounts.uk. For any privacy question or request, contact us at privacy@theaccounts.uk.

We are the data controller for the personal data described below. The site is not affiliated with, endorsed by, or connected to Companies House or any UK government body.

2. What we collect

We collect the minimum data needed to run the site:

• Email address — only if you subscribe to the daily brief or follow a company. Stored with the signup source (which page you signed up from) and, optionally, the company number you asked to follow.
• Subscription state — confirmation status, when you confirmed, and an unsubscribe token tied to your record so we can honour opt-outs from a one-click link.
• Server logs — our hosting provider (Cloudflare) processes standard request metadata (IP address, user agent, timestamp, URL) at the edge for security, abuse prevention, and aggregate traffic measurement.
• Aggregate page analytics — we use Cloudflare Web Analytics to count page views and measure page performance. It is privacy-first by design: it sets no cookies, does not fingerprint your browser, does not track you across sites, and reports only aggregate figures to us. Because it stores nothing on your device, it does not need a cookie banner.

We do not use Google Analytics or any other cookie-based analytics, we do not set advertising or tracking cookies, and we do not sell or share your data with advertisers or data brokers. If that changes in the future, this policy will be updated to reflect it before the change goes live.

3. Cookies

The public site sets no cookies at all — not for tracking, advertising, or analytics. Strictly necessary cookies may be set in the future to remember a logged-in preferences session (e.g. for managing your email subscription); if and when that ships, it will be a single first-party, signed, HttpOnly session cookie used only to authenticate your own preference changes — no third-party cookies, no cross-site tracking, and no ad targeting.

Some pages also keep small conveniences in your browser's local storage (for example, companies you recently viewed, your screener column layout, or that you dismissed a prompt). That data never leaves your device and is not sent to us. You can clear it at any time through your browser settings.

4. Companies House data

The company, officer, and filings information shown on this site is sourced from public filings at Companies House under the Open Government Licence v3.0 . We are not the controller of that upstream public register. If you are an officer, PSC, or named individual on a UK company filing and you have a request about the underlying record itself (rather than how it appears on our site), the appropriate route is Companies House directly.

We may format, summarise, or extract figures from those public filings on a company's page. If a figure or attribution on our site is incorrect, contact us at privacy@theaccounts.uk or use the per-company correction link.

5. Why we use your data (legal basis)

Under UK GDPR, our legal bases are:

• Consent — for sending the daily email brief and any follow-company notifications. You give consent when you confirm your email; you can withdraw it at any time via the unsubscribe link in any email.
• Legitimate interest — for keeping the site available, secure, and free from abuse (edge logging, rate-limiting, attack prevention) and for publishing factual information already in the public Companies House register.

6. How long we keep it

• Email subscription records — kept while you are subscribed. If you unsubscribe, we keep a minimal suppression record (the email address and the fact you opted out) so we don't accidentally re-email you. You can ask for full deletion of the suppression record at any time.
• Server / edge logs — retained by Cloudflare under their own retention windows for security and abuse purposes; we do not persist them in our own systems beyond what is needed to investigate incidents.

7. Who we share it with

We use a small number of processors strictly to run the service:

• Cloudflare, Inc. — site hosting, edge logging, and email delivery for transactional / subscription mail sent from notify.theaccounts.uk.
• Google — model inference for extracting figures from publicly filed accounts PDFs (Gemini API). No personal subscriber data is sent — the inputs are public Companies House documents.

We do not sell, rent, or trade your data. We will only disclose it where required by law (e.g. a valid court order).

8. International transfers

Some of our processors (Cloudflare, Google) are US-headquartered and operate global infrastructure, so personal data may be processed outside the UK. Where that happens, transfers rely on the UK International Data Transfer Addendum, Standard Contractual Clauses, or an equivalent adequacy mechanism that those providers offer to their customers.

9. Your rights

Under UK GDPR you have the right to access, correct, delete, port, and restrict processing of the personal data we hold about you, and to object to processing or withdraw consent at any time. To exercise any of these, email privacy@theaccounts.uk. We will respond within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint .

10. Children

The site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has signed up, contact us and we will delete the record.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will change when we do. Material changes affecting how we handle subscriber data will be flagged in the email brief before they take effect.

12. Contact

Privacy questions and requests: privacy@theaccounts.uk.