Privacy notice

Last updated 19 October 2026

Who we are

FirmFacts (firmfacts.co) is run by Vavien Technology Limited, a company in Dublin, Ireland. We are the controller of the personal data described here. For anything about your data, write to support@firmfacts.co.

If you visit the site

You can use FirmFacts without an account. We don't use advertising cookies, and analytics cookies only if you say yes. What is kept:

• Request logs. Our host, Cloudflare, records requests (such as IP address, browser and page asked for) for a short time to deliver the site and protect it from abuse. Legal basis: our legitimate interest in running a secure site.
• In your browser only. Your light or dark theme, the companies you picked to compare, how you left the map, and a copy of your watchlist while you're signed in. These stay on your device and we don't read them; you can clear them in your browser at any time.
• Cookies. The ones the site needs to work: the sign-in cookies if you have an account, one that remembers which plan a page is shown for, and one that remembers your answer about analytics. Because they are strictly necessary, we don't ask for consent to them. Analytics cookies are set only if you say yes (below).
• Bug reports. If you report a bug (Ideas + Bugs), what you write, the page, your email address if you give one, your browser and, if you're signed in, your account's email are sent to support by email and kept as a support message. Cloudflare Turnstile checks the form is sent by a person, not a bot: it looks at your browser and connection for that check only, under Cloudflare's Turnstile privacy terms, and sets no tracking cookies. To limit reports from one address we keep a scrambled (hashed) form of your IP address, never the address itself, for a day. Legal basis: our legitimate interest in fixing the site and protecting it from abuse.

Analytics

If you say yes when the site asks, we use Google Analytics and PostHog to see which pages and features are used, so we know what to improve. They set cookies and record the pages you visit, what you click, your browser, device, approximate location (from your IP address) and where you came from; if you're signed in, they're told your account's id (a random number, never your email or name). PostHog may also record how a page was used (a session replay), with everything you type hidden. Nothing is used for advertising or sold. Legal basis: your consent, which you can take back at any time; if you say no, nothing of theirs loads.

Whether or not you say yes, our server tells PostHog when an account is created, a plan is bought, changed or cancelled, a report is bought or written, a list is exported, a company is watched, an idea is posted or voted on, or a bug is reported, with the account's id and what it concerned (such as the company or plan), never anything you wrote. Nothing is stored on your device for this. Legal basis: our legitimate interest in understanding how FirmFacts is used and keeping it working.

If you create an account

• Your account: your email address, a protected (hashed) password or, if you sign in with Google, the name, email address and profile picture Google shares with us, and when you signed up and last signed in. Legal basis: providing the service you asked for (contract).
• What you do with it: the companies you watch, your email settings, and the deep reports you've had. Legal basis: contract.
• Ideas and votes: the ideas you post on the ideas board and your votes, stored with your account. Other users see an idea's title, description, score and date, never who posted it or who voted: no name, email or initials are shown. We may close or remove ideas. Legal basis: our legitimate interest in hearing what users want from FirmFacts.
• Emails: sign-in emails (confirming your address, resetting your password), and at most one a day about the companies you watch: new accounts, filings, reports and blog lists they appear in. You can turn these off on your account page or with the link in any of them. Legal basis: contract for sign-in emails; our legitimate interest in telling you about what you chose to follow, for the others.
• Support: if you write to us, your message and our reply. Legal basis: our legitimate interest in answering you.
• Payments: your plan, its renewal date and the reports you bought. Stripe sells our plans and reports as the seller of record (through its Link service), so it collects your name, billing address, email and card details itself, under its own privacy policy; we never see your card details, and Stripe tells us only what we need to open what you bought. Legal basis: contract, and our legal duty to keep accounting records.

If you are a director, owner or officer of a company

Company pages and reports show the people named on public registers: name, role, appointment and resignation dates, and their other company appointments; for people with significant control, the nature of their control and its dates. In deep reports, we also link to news stories about the company and its directors that have been published elsewhere. We never show home addresses.

Sources: Companies House and the other public registers named on our Legal page, and published news. Legal basis: our legitimate interest, and the public's, in transparency about who runs and owns companies, which is the purpose these registers are published for. We keep this information while the company is shown on FirmFacts and update it as the registers change. You can object or ask for a correction at support@firmfacts.co; where a register is wrong, it also needs correcting at the register.

Who processes your data for us

We use these service providers, under contracts that let them use your data only to provide their service to us:

• Supabase: our database and sign-in (data stored in Ireland, in the EU).
• Cloudflare: hosting, delivery and security of the site (including Turnstile, the check on the bug-report form), and forwarding of mail sent to support@firmfacts.co.
• Resend: sending our emails.
• Google: if you choose to sign in with Google, and Google Analytics if you say yes to analytics.
• PostHog: product analytics (the events above, and pages and clicks if you say yes to analytics).
• Technology providers that read companies' filings and search for published news for our reports. They receive company documents and the names of the people in them, not any data about our users.
• Stripe, through its Link service: payments, as the seller of record of our plans and reports. For what Stripe does with the data it collects at checkout, see the Stripe privacy policy and the Link privacy policy.

Some of these providers are based in the United States or may process data there. Where data leaves the EU or the UK, it is protected by the European Commission's standard contractual clauses (and the UK addendum), or the provider's certification under the EU–US Data Privacy Framework. We don't sell personal data and don't share it with anyone else unless the law requires it.

How long we keep it

• Your account and everything in it: until you delete it. Delete it from your account page and it goes at once; copies in our providers' backups are overwritten on their normal cycle.
• Ideas and votes: until you delete your account (they go with it), or until we remove the idea.
• Support messages, bug reports included: up to two years after the conversation ends.
• The hashed address kept to limit bug reports: one day.
• Payment records: as long as tax and company law require (six years in Ireland).
• Request logs: the short period Cloudflare keeps them.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to have it in a portable form, and you can object to any use based on our legitimate interests. Write to support@firmfacts.co; we answer within one month. You can also complain to a regulator: in Ireland, the Data Protection Commission (dataprotection.ie); in the UK, the Information Commissioner's Office (ico.org.uk). We'd welcome the chance to put things right first.

Security and children

Connections to the site are encrypted, passwords are stored only in hashed form, and access to our systems is limited to the people who run them. FirmFacts is not meant for children, and we don't knowingly keep data about anyone under 16 who has an account.

Changes

When this notice changes, we'll update the date above, and if the change matters to account holders we'll tell them by email before it takes effect.

← Legal