Privacy policy

1. Who we are

"The Accounts" / "StatDesk" (referred to here as "we", "us", "the site") is operated as an independent project by Kyle Bolton. The site is hosted at statdesk.co.uk. For any privacy question or request, contact us at [email protected].

We are the data controller for the personal data described below. The site is not affiliated with, endorsed by, or connected to Companies House or any UK government body.

2. What we collect

We collect the minimum data needed to run the site:

• Email address — only if you subscribe to the daily brief or follow a company. Stored with the signup source (which page you signed up from) and, optionally, the company number you asked to follow.
• Subscription state — confirmation status, when you confirmed, and an unsubscribe token tied to your record so we can honour opt-outs from a one-click link.
• Server logs — our hosting provider (Cloudflare) processes standard request metadata (IP address, user agent, timestamp, URL) at the edge for security, abuse prevention, and aggregate traffic measurement. We do not run separate analytics on top of these logs.

We do not currently use third-party analytics scripts (no Google Analytics, no Plausible, no PostHog, etc.), we do not set advertising or tracking cookies, and we do not sell or share your data with advertisers or data brokers. If that changes in the future, this policy will be updated to reflect it before the change goes live.

3. Cookies

The public site does not set tracking or advertising cookies. Strictly necessary cookies may be set in the future to remember a logged-in preferences session (e.g. for managing your email subscription); if and when that ships, it will be a single first-party, signed, HttpOnly session cookie used only to authenticate your own preference changes — no third-party cookies, no cross-site tracking, and no ad targeting.

4. Companies House data

The company, officer, and filings information shown on this site is sourced from public filings at Companies House under the Open Government Licence v3.0 . We are not the controller of that upstream public register. If you are an officer, PSC, or named individual on a UK company filing and you have a request about the underlying record itself (rather than how it appears on our site), the appropriate route is Companies House directly.

We may format, summarise, or extract figures from those public filings on a company's page. If a figure or attribution on our site is incorrect, contact us at [email protected] or use the per-company correction link.

5. Why we use your data (legal basis)

Under UK GDPR, our legal bases are:

• Consent — for sending the daily email brief and any follow-company notifications. You give consent when you confirm your email; you can withdraw it at any time via the unsubscribe link in any email.
• Legitimate interest — for keeping the site available, secure, and free from abuse (edge logging, rate-limiting, attack prevention) and for publishing factual information already in the public Companies House register.

6. How long we keep it

• Email subscription records — kept while you are subscribed. If you unsubscribe, we keep a minimal suppression record (the email address and the fact you opted out) so we don't accidentally re-email you. You can ask for full deletion of the suppression record at any time.
• Server / edge logs — retained by Cloudflare under their own retention windows for security and abuse purposes; we do not persist them in our own systems beyond what is needed to investigate incidents.

7. Who we share it with

We use a small number of processors strictly to run the service:

• Cloudflare, Inc. — site hosting, edge logging, and email delivery for transactional / subscription mail sent from notify.theaccounts.uk.
• Google — model inference for extracting figures from publicly filed accounts PDFs (Gemini API). No personal subscriber data is sent — the inputs are public Companies House documents.

We do not sell, rent, or trade your data. We will only disclose it where required by law (e.g. a valid court order).

8. International transfers

Some of our processors (Cloudflare, Google) are US-headquartered and operate global infrastructure, so personal data may be processed outside the UK. Where that happens, transfers rely on the UK International Data Transfer Addendum, Standard Contractual Clauses, or an equivalent adequacy mechanism that those providers offer to their customers.

9. Your rights

Under UK GDPR you have the right to access, correct, delete, port, and restrict processing of the personal data we hold about you, and to object to processing or withdraw consent at any time. To exercise any of these, email [email protected]. We will respond within one month.

If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint .

10. Children

The site is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has signed up, contact us and we will delete the record.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top of this page will change when we do. Material changes affecting how we handle subscriber data will be flagged in the email brief before they take effect.

12. Contact

Privacy questions and requests: [email protected].