Data, privacy, and GDPR

What data PenaltyProof stores, how it is used, and your rights under UK GDPR.

What we store

PenaltyProof stores your email address, your clients' Companies House registration numbers, and the alert history generated by the daily check. We do not store any client financial data, accounting records, or personal data about your clients other than their company numbers.

Companies House data

All company-filing status data comes from the Companies House public API — the same data available to anyone on the Companies House website. We do not store copies of accounts or confirmation statements; we record only whether a filing is current or outstanding on the date we checked.

GDPR and UK data protection

PenaltyProof processes your personal data (email address, subscription details) as a data controller under UK GDPR. Our full privacy policy is at /privacy. Our Data Processing Agreement (DPA) is available at /dpa for practices that require one for their own compliance records.

Deleting your account

Go to /delete-account and follow the link emailed to you. Your account is soft-deleted immediately: monitoring stops and your Stripe subscription is cancelled. Your data is held for 90 days under the UK GDPR retention policy, then permanently purged. See the account-deletion article for details.

Common questions

Do you share my data with third parties?

PenaltyProof uses Stripe (payment processing), Resend (email delivery), and Sentry (error monitoring). Each has its own privacy policy. We do not sell or share your data for marketing purposes.

Can I export my data?

Contact privacy@penaltyproof.co.uk to submit a Data Subject Access Request. We will provide a copy of all personal data we hold about your account within 30 calendar days.

Related articles