Privacy Policy

KYC Central Ltd (company number 17405668, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom) operates KYC Central and is the data controller for the personal data described in this notice.

Our ICO registration number is ZC230792.

If you have a question or concern about how we handle personal data, contact us first at privacy@kyccentral.co.uk. That mailbox is hosted by Microsoft 365 in the United Kingdom. As with our support mail, a reply may be drafted with AI assistance, and a person reviews and approves every reply before it is sent. To complain about how we handle personal data, email the same address; you do not need an account. We will acknowledge your complaint within 30 days, look into it, keep you updated and tell you the outcome without undue delay. To report a security vulnerability or incident, email security@kyccentral.co.uk.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

If you create an account, we hold the following categories of data about you:

• Email and authentication — held by our authentication provider, Supabase. If you sign in with Google, GitHub or LinkedIn, we receive your name and email address (and your profile picture, if the provider shares one) from that provider, and that provider learns that you signed in to KYC Central.
• Billing — we never see or store your card number; Stripe processes payments and we hold only your Stripe customer ID and your plan status.
• Saved reports — PDF assessment reports you save are kept until you delete them individually or delete your account, subject to the saved-report cap on your plan. When you save a report beyond that cap, your oldest saved report is removed to make room, so export anything you need to keep.
• Workspaces, custom rules and notes — content you create to organise your investigations.
• Your company (optional) — if you tell us where you work, at sign-up or on the Account page, we store the company name and, where you pick it from the Companies House register, its company number. We use it to understand which firms use KYC Central, including to contact a firm about a team plan where several of its staff already use the service. We process it under our legitimate interest in growing the service; you can change or clear it on the Account page at any time.
• Invites — if you joined through a personal invite link, we record which invite you used and when, and the free Pro trial it gave you. We do not store the link itself, only a fingerprint of it.
• Referral links — if you create a referral link on the Account page, we record the link (as a fingerprint, not the link itself), when it expires or was revoked, and how many times it was opened. The link carries no report and no company; the page it opens says only that it is an invitation and what a new account gets. If someone creates a new account through your link, we record that their account came from your link, so that each of you gets 50% off one PDF report, and we record when each discount is used and on which Stripe checkout. We do not tell either of you who the other is. These records are deleted with your account.
• Support tickets — including the transcript of any bot chat that led to a ticket.
• Suggestions — if you send us a suggestion as a subscriber, we store its category and text with the date you sent it. We do not link it to your account and do not record the time. Suggestions are summarised with AI assistance for our own weekly product review, and the summary leaves out names and contact details. Because a suggestion is not linked to you, we cannot find or delete a particular one on request, so please do not include personal details in it. We process suggestions under our legitimate interest in improving the service.
• Usage counters — short-lived counters used to enforce rate limits and monthly quotas, held for between 60 seconds and 91 days depending on the counter.

We process this data under the contract lawful basis — it is necessary to provide the account and service you have signed up for.

You can remove all of this data yourself at any time from the Account page's delete-account flow. That flow cancels any active Stripe subscription, deletes your files and database rows, and removes your account. Payment records are kept afterwards only as required to meet our financial and audit obligations (see Retention, below).

Marketing email If you tick Product updates & marketing emails on the Account page, we will occasionally email you about new features and offers. The box is unticked until you tick it, and we send marketing email only to account holders who have ticked it. We rely on your consent for this, and record that you gave it and when. You can withdraw your consent at any time by unticking the box on the Account page or by using the unsubscribe link in any marketing email; either one stops further marketing email. Withdrawing does not affect emails already sent, or the service emails we send you about your account, purchases and reports.

A person at KYC Central sends each marketing email; none is sent automatically. We send them through Resend (listed in the sub-processors section below), which keeps a copy of each message for 30 days. We keep a record of each marketing email we send and how many people it went to, but not a list of who received it. Your consent record is deleted if you delete your account.

Buying a report without an account If you buy a single report without creating an account, we use the email address you give us in the report wizard, or the one you enter at Stripe checkout if you gave none, to send you the report. We keep that email address for 14 days after your purchase and then remove it from our records, while keeping the payment record itself for our financial and audit obligations (see Retention, below). If a check your report requires could not be completed, we keep retrying it, and if we then email you a link to generate the report yourself, we keep your email address and the choices you made until you use that link or ask for a refund or, if you do neither, until we refund your payment the day after the link expires. The link is valid for 30 days, so this is at most about 31 days after your purchase rather than the usual 14.

Before KYC Central launches, our Coming Soon page lets you ask to be emailed when it does. If you join that waitlist, we hold your email address, when you gave your consent and when you confirmed your address. Joining does not create an account.

We rely on your consent. The box on the form starts unticked, and we do not store your address unless you tick it. A Cloudflare bot check (Turnstile) runs on the form before anything is stored. We then email you a link to confirm that the address is yours. The link expires after 7 days, and we store only a one-way hash of it. Until you click it, we send you nothing else. Once you have confirmed, we send you one email when KYC Central launches. We do not send you any other marketing email, and joining the waitlist does not sign you up to the marketing email for account holders described above. Both emails are sent through Resend (listed in the sub-processors section below).

We delete your address within 90 days of the launch announcement, or sooner if you ask. To withdraw your consent or have your address removed, email privacy@kyccentral.co.uk.

Our customers use KYC Central to run due diligence checks on UK companies. As part of that process, we screen company officers, persons with significant control (PSCs), charge holders and other individuals connected to a company against public registers and lists. This section is for you, if you are one of those individuals rather than a KYC Central account holder — it is our Article 14 notice, explaining what we do with your data even though we did not collect it from you directly.

What we process Names and related identifying details (including, for disqualified directors, the date of birth that the Companies House bulk product publishes) drawn from public registers and lists: Companies House (including our own mirror of its bulk data products), the FCA Register, GLEIF, the Insolvency Service, UK, US, UN and EU sanctions lists, the ICIJ Offshore Leaks database, other sector registries, and the results of news searches for adverse media.

Why we process it To help our customers meet their anti-money-laundering and customer due-diligence obligations and to help prevent financial crime.

Our lawful basis We rely on legitimate interests (Article 6(1)(f) UK GDPR). Where the data concerns criminal offences — for example a sanctions designation, a director disqualification, or adverse media alleging criminal conduct — we additionally rely on the conditions in Schedule 1 of the Data Protection Act 2018: preventing or detecting unlawful acts, protecting the public, and complying with regulatory requirements. The detail of that assessment is set out in our internal Appropriate Policy Document.

We do not make decisions about you KYC Central produces risk indicators for our customers to review with their own human judgement — it does not decide anything about you itself. Where a name match has not been manually confirmed, it is shown as "potential" or "unconfirmed" until a person checks and confirms it.

How long we keep it Most of the underlying source data is held in short-lived caches, typically between 1 hour and 7 days. Our Companies House mirror, our sanctions-list index and our copies of the sector registers are refreshed from their sources rather than expiring. Where a customer saves or downloads a report that names you, that copy is held by the customer under its own retention rules, and in our saved-reports storage until the customer deletes it or its saved-report cap removes it.

Your rights You can ask us what we hold about you (access), ask us to correct it (rectification), ask us to erase it or restrict how we use it, and object to our processing — we assess every objection individually. Contact privacy@kyccentral.co.uk; no account is needed. The customer who ran the check receives the screening result, so a request may also need to go to that customer as a separate controller. Because most of what we hold is a copy of a public register, the most effective way to correct inaccurate data is to correct it at the source register; once corrected there, contact us and we will purge our cached copy so it refreshes.

We draw screening and company data from the following sources:

• Companies House — company profile, officers, PSCs, charges, insolvency and filing history.
• FCA Register — regulatory status and prohibition orders for authorised firms and individuals.
• GLEIF — Legal Entity Identifier data and global corporate parent chains.
• Insolvency Service — the Individual Insolvency Register.
• UK, US, UN and EU sanctions lists — OFAC, the UN Security Council, the UK Sanctions List (published by FCDO/OFSI), and EU consolidated financial sanctions lists.
• ICIJ Offshore Leaks — the Panama Papers, Pandora Papers, Paradise Papers, Bahamas Leaks and Offshore Leaks investigations. Data © International Consortium of Investigative Journalists; the database is licensed under the Open Database License (ODbL) and its contents under CC BY-SA.
• Sector registries — including the Charity Commission, Gambling Commission, HMRC, the SRA and the CQC.
• News search results — Google News results for the names being screened, retrieved through our news-search provider (DataForSEO, listed in the sub-processors section below) and used for adverse-media screening. We show an article's headline, publication, date and search snippet, and link to the original article; we do not reproduce the article itself.

We use the following sub-processors to provide the service. For each one we list where it processes your data and, where that is outside the UK, the safeguard that covers the transfer:

• CircleCI — runs our nightly encrypted backup of the customer database; the copy is encrypted before it leaves CircleCI's machine — region: United States — transfer safeguard: EU Standard Contractual Clauses with the UK International Data Transfer Addendum
• Cloudflare — reverse proxy and web application firewall in front of our API, for every request whether or not you have an account, and the bot check (Turnstile) on our waitlist form — region: global network (each request is handled at a nearby Cloudflare data centre; request metadata is processed in the United States and Europe) — transfer safeguard: UK Extension to the EU-US Data Privacy Framework, or EU Standard Contractual Clauses with the UK Addendum
• Railway — hosting, database and background jobs — region: EU (Netherlands) — transfer safeguard: UK Extension to the EU-US Data Privacy Framework, or EU Standard Contractual Clauses with the UK Addendum
• Vercel — site hosting, cookieless analytics, and private file stores holding our configuration files, our copies of the public sanctions lists and of four public sector registers (the HMRC supervised business register, the CQC provider list, the SRA register of organisations and the Gambling Commission register), and our encrypted nightly backups — region: UK (London) and EU (Ireland) for hosting, with pages delivered through a global edge network; file store region: UK (London) — transfer safeguard: EU Standard Contractual Clauses with the UK Addendum
• Supabase — accounts, database and storage — region: EU (Ireland) — transfer safeguard: EU Standard Contractual Clauses with the UK Addendum
• Upstash — cache and queue — region: UK (London) for the cache, EU (Frankfurt) for the queue — transfer safeguard: EU Standard Contractual Clauses with the UK Addendum
• Stripe — payments — region: UK, EU and United States — transfer safeguard: UK Extension to the EU-US Data Privacy Framework, with the UK International Data Transfer Addendum as a fallback
• Resend — email, including a copy of each message sent to our support and privacy mailboxes — region: United States (mail is routed through the EU, but all message content and account data is stored in the US) — transfer safeguard: EU Standard Contractual Clauses with the UK Addendum, and the UK Extension to the EU-US Data Privacy Framework
• Microsoft 365 — email, including our privacy and support mailboxes — region: United Kingdom — transfer safeguard: Microsoft Products and Services Data Protection Addendum, with the UK Extension to the EU-US Data Privacy Framework and EU Standard Contractual Clauses with the UK Addendum as fallback
• DataForSEO (DataForSEO OÜ) — adverse-media news search: the names being screened are sent as search queries, and the news results come back to us; DataForSEO keeps search requests and results for up to 12 months — region: Estonia (EU), with DataForSEO's own infrastructure providers in Germany (Hetzner) and the United States (Google, Microsoft Azure) — transfer safeguard: UK adequacy regulations for the EEA cover our transfer to DataForSEO; DataForSEO's onward transfers to the United States rely on the EU Standard Contractual Clauses or an adequacy decision
• Sentry — error and performance monitoring, on our servers and in your browser — region: EU (Germany) — transfer safeguard: UK Extension to the EU-US Data Privacy Framework, with EU Standard Contractual Clauses with the UK Addendum as a fallback
• Trello (Atlassian) — support ticket tracking — region: United States — transfer safeguard: UK Extension to the EU-US Data Privacy Framework and EU Standard Contractual Clauses with the UK Addendum
• Slack — the internal channel where we approve support and privacy replies drafted with AI assistance — region: United States — transfer safeguard: UK Extension to the EU-US Data Privacy Framework, with EU Standard Contractual Clauses with the UK Addendum as fallback
• AI providers — Anthropic (default; our contract is with Anthropic Ireland, Limited) or Google — only the currently active provider receives your data — region: United States — transfer safeguard: Anthropic: EU Standard Contractual Clauses with the UK Addendum; Google: UK Extension to the EU-US Data Privacy Framework, with EU Standard Contractual Clauses as a fallback

Sign-in providers are not sub-processors. If you choose to sign in with Google, GitHub or LinkedIn, that company acts as a separate controller, under its own privacy policy, for an account you already hold with it. You sign in on that company's own page, and it then sends us the details described in Data we hold about account holders. We also keep the identifier that company uses for your account, so that we can recognise you when you sign in again. We send it nothing about you from our systems, so no transfer safeguard is listed for it.

Some of our sub-processors process data outside the United Kingdom. Processing in the European Economic Area is covered by the UK adequacy regulations for the EEA. For processing elsewhere, including the United States, we rely on a UK-approved transfer safeguard in the vendor data processing terms — the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, or the UK Extension to the EU-US Data Privacy Framework. Several vendors are US-based even where they host our data in the UK or EU, so a safeguard is listed for them too. The safeguard for each vendor is set out in the sub-processors section above. Google, GitHub and LinkedIn, if you sign in with one of them, are not our sub-processors and receive nothing about you from our systems (see the end of the sub-processors section).

We take the following measures to protect your data:

• Data is encrypted in transit.
• API access is tiered, so features are only available at the appropriate account level.
• Downloaded PDF reports are delivered via burn-after-read, one-time links, available to you for 24 hours from generation and deleted after you download them (or once a link expires unused).
• Server-side error telemetry is scrubbed of credentials and common personal identifiers before it reaches our monitoring tools. We do not record your browser session.
• Sensitive admin actions are recorded in an audit log.

The risk flags and scores generated by KYC Central are decision-support only — they are produced automatically from public data and probabilistic name matching, but we do not make solely automated decisions with legal or similarly significant effects about anyone. Any AI-generated analysis is clearly labelled as such and is intended to be reviewed by a person before it is relied upon.

In summary:

• Account data — kept until you delete it.
• Screening data caches — kept for between 1 hour and 7 days, depending on the source.
• Support tickets — kept for 2 years after the ticket is closed.
• Admin audit log — kept for 2 years.
• Suggestions — deleted automatically about two weeks after you send them, once they have been included in our weekly review.
• Backups — an encrypted copy of our customer database and saved reports is kept for 14 days. Data you delete leaves our backups within 14 days. If we ever have to restore from a backup, we delete again anything you had already deleted.
• Marketing email consent — kept until you withdraw it or delete your account. Our record of each marketing email we send does not list who received it.
• Launch waitlist — your email address is deleted within 90 days of the launch announcement, or sooner if you ask.
• Payment records — kept for 6 years, as required by financial record-keeping law.
• A report bought without an account — the email address and choices you gave us are kept for 14 days after purchase, or at most about 31 days if we could not complete the report and sent you a link to generate it (see Buying a report without an account, above).

KYC Central is a business tool and is not directed at, or intended for use by, anyone under 18. We do not knowingly collect or hold data about children.

We may update this notice from time to time. When we do, we will post the updated version here with a new date at the top. If a change is material, we will also email registered account holders to let them know.