Privacy Policy

1. Introduction

RecoupIQ ("we," "our," or "us") is operated by RecoupIQ Ltd, a company registered in England and Wales (Company Number: 16947526). Our registered office is located at Flat1 410 High Street Lincoln LN5 7TE United Kingdom.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our UK company risk intelligence service, including our web platform, API, and Trust Check™, our Microsoft 365 app for Outlook, Excel, Word, and Microsoft Teams.

Trust Check™ is a brand of RecoupIQ Ltd. It is a per-seat Microsoft 365 app that runs inside Microsoft Teams, Outlook, Excel, and Word, providing UK company risk intelligence checks across 12 live data sources and 10 compliance registers.

This policy explains our current processing practices. It is not a substitute for a feature-specific notice or an applicable Data Processing Agreement. We update it when our processing changes.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Name and email address
• Business name and role (if provided)
• Payment information (processed securely through Stripe; we do not store card numbers)
• Microsoft account identity and authentication metadata for Trust Check™ users authenticating via Microsoft SSO

2.2 Usage Information

• Companies you search for or monitor
• Reports you generate
• Watchlist composition
• Feature usage patterns

2.3 Automatically Collected Information

• Device information and browser type
• IP address
• Cookies and similar tracking technologies (with consent)

2.4 What We Do NOT Collect

• We do not intentionally store the body of Outlook email messages through the company-check workflow
• We do not intentionally collect personal details from email signatures for that workflow; any requested permissions and data flows are described in the relevant Microsoft 365 experience
• Customer account data is kept separate from public company and director data. Public-record relationship analysis is not a sharing of one customer's private data with another customer.

3. How We Use Your Information

We use your information to:

• Provide, maintain, and improve our services
• Generate intelligence reports when you request them
• Send watchlist alerts when monitored companies change risk band
• Provide customer support and respond to inquiries
• Send important updates about our services
• Comply with legal obligations and prevent fraud
• Analyse usage patterns and improve the platform

4. Legal Basis for Processing (UK GDPR)

We process your data based on:

• Contract Performance: To provide our intelligence services to you
• Legitimate Interests: To improve our services, prevent fraud, and generate aggregated market intelligence
• Legal Compliance: To comply with UK tax and financial regulations
• Consent: For marketing communications and analytics cookies (which you can withdraw at any time)

5. Automated Analysis and Human Decisions

We use automated analysis to organise public company records, identify patterns, and prepare evidence for a requested check or monitoring alert. An output is an indicator or verification prompt, not a decision about a person or company. We do not intend for the Service to make decisions solely by automated means that produce legal or similarly significant effects for an individual. You remain responsible for reviewing the source evidence and making your own decision, and you should obtain professional advice where appropriate.

If you believe an automated output about you is inaccurate or has been used unfairly, contact us through the corrections and right-of-reply process.

6. Public Company Data We Process

6.1 Automated Analysis of Public Records

We run automated analysis over publicly available data from UK statutory sources (Companies House, The Gazette, HMRC published lists, FCA registers, Land Registry, OFSI sanctions lists, court hearing lists, and others) to help businesses assess the companies they trade with.

• What we analyse: Filed accounts (iXBRL), officer appointments, PSC data, charges, insolvency notices, disqualification orders, gazette notices, payment practices reports, and other public filings.
• Evidence lineage: Every finding is mapped back to its original statutory source so it can be traced and verified.
• Lawful Basis: Legitimate Interests (Art 6(1)(f) UK GDPR). This processing is necessary for our legitimate interest in helping UK businesses make informed commercial and trading decisions.

6.2 Connected-Person Data

Our reports may reference personal data about company directors, persons with significant control, and other officers. This data comes exclusively from lawfully published public sources:

• Companies House (officer, PSC, charge, and filing data)
• The Gazette and the Insolvency Service (insolvency and disqualification notices)
• HM Land Registry corporate and overseas-ownership datasets
• The Individual Insolvency Register
• OFSI sanctions list
• FCA Warning List and register

How findings are presented: connected-person links are shown as public-record facts to verify, never as assertions of wrongdoing.

6.3 Corrections and Objections

A director or officer can contact us about inaccurate, outdated, or unfairly presented personal data, or object to processing where the law gives that right, by contacting contact@recoup-iq.tech or using our corrections and right-of-reply process. We assess requests against the source record, the applicable legal basis, and any legal obligation to retain or publish the information.

7. Data Sharing and Disclosure

We may share your information with:

• Authentication:Clerk (web platform user accounts); Microsoft Entra ID (Trust Check™ SSO within Microsoft 365)
• Payments: Stripe (payment processing)
• Infrastructure: Microsoft Azure (application hosting, database, analytics via Microsoft Fabric)
• CRM: HubSpot (onboarding and support communications)
• Error Monitoring: Sentry (error tracking; may capture anonymised technical context)
• AI and analysis services: Azure-hosted AI services may be used for limited report generation or analysis where enabled. We send only the context needed for the requested feature, apply contractual and technical safeguards, and do not authorise providers to use customer content to train public models.
• Legal Authorities: When required by law or to protect our legal rights

We do not sell your personal information to third parties. Anonymised, aggregated datasets (with no personally identifiable information) may be used for industry benchmarks.

8. Data Security

We use technical and organisational security measures appropriate to the risks and the current service configuration, including where applicable:

• Encryption in transit (HTTPS/TLS) and at rest
• Access controls and role-based authentication
• Controlled cloud infrastructure and access management
• Regular dependency audits and security updates

9. Your Rights Under UK GDPR

You have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate or incomplete data
• Erasure:Request deletion of your data ("right to be forgotten")
• Restriction: Limit how we process your data
• Portability: Receive your data in a structured format
• Object: Object to processing based on legitimate interests
• Withdraw Consent: For marketing communications and analytics cookies

To exercise these rights, contact us at contact@recoup-iq.tech. We normally respond within one month. If a request is complex or numerous, the law may allow an extension of up to a further two months, and we will explain this.

10. Data Retention

We retain different categories of data for different periods. We keep data only for as long as needed for the relevant service, security, legal, accounting, dispute, and correction purposes, then delete or anonymise it where appropriate:

• Account and support data: for the account relationship and a proportionate period afterwards
• Reports and search history: for the account relationship, subject to deletion requests, operational needs, and legal holds
• Billing and transaction records: for the period required by tax, accounting, payment, and limitation rules
• Marketing preferences and suppression records: until withdrawal and for as long as needed to respect that withdrawal

You can request account deletion by contacting us. Deletion is subject to identity verification, legal retention duties, security records, unresolved disputes, and the roles we hold for customer data under an applicable DPA.

11. Cookies

We use cookies for authentication and, with your consent, for analytics. You can control cookies through your browser settings or our cookie banner. Essential authentication cookies cannot be disabled while using the Service.

12. International Data Transfers

Data may be stored or processed in the UK and in other countries where our service providers operate. Where a restricted transfer occurs, we use an appropriate lawful transfer mechanism and supplementary safeguards where required, such as:

• The UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses
• Adequacy decisions where applicable
• Data processing agreements and supplier security commitments

13. Children's Privacy

Our services are not intended for individuals under 18 years of age. We do not knowingly collect data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through a prominent notice on our website. Your continued use of our services after changes constitutes acceptance.

15. Contact Us

For questions about this Privacy Policy or to exercise your rights:

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):ico.org.uk