Privacy notice
Draft: this page is under legal review and may change before launch.
Last updated 30 October 2026.
Project X checks businesses in the United Kingdom, Australia and New Zealand against official registers and returns an automated decision. This notice explains what personal information that involves, under the UK GDPR, the Australian Privacy Act 1988 and the New Zealand Privacy Act 2020.
What we collect and why
- What you search for. The business name, purpose, country, postcode and identifier of each check, and the result. We keep these in an audit log so every decision can be explained later. A business name can be a person’s name when the business is a sole trader.
- API key holders. The email address given when requesting a key, the key’s hash (never the key itself), when it was created and when it was first used successfully.
- Console sessions. A cookie holding a session ID only. It is
HttpOnly,SecureandSameSite=Lax, and is used only to keep you signed in. - Service logs. One line per check with timings, register status and the decision. Logs never contain the text you searched for or any person’s name.
Information about people on official registers
Company registers name directors and officers, and sole traders trade under their own names. We fetch these names live from the official register only to show them to you. We do not store them, and we never send them to the entity-matching model. For Australian sole traders we store the registered business name and ABN, not the individual’s name.
New Zealand (IPP3A). Where we collect information about a person from a register rather than from them, we do so to verify the business they are connected with. The source is the register named in the result. It is shown only to the person running the check. You can ask us for access to, or correction of, information we hold about you.
Automated decisions
Every check produces an automated decision: proceed, review or stop. Fixed rules for each purpose and country make the decision from register records. A model is used only to choose which registered company a search refers to; it never makes the decision. When the match is unclear, a register is unavailable or a rule needs judgement, the result is review, for a person to decide. Each decision lists its reasons and the official source for each.
Australia. From 10 December 2026 the Privacy Act requires us to say when personal information is used in automated decisions that could significantly affect a person. A check can use a sole trader’s registered business name and ABN, and register records about the business, to decide whether an agent should pay, onboard or rely on that business.
A decision is an automated assessment with sources. It is not legal or financial advice. If you think a decision about your business is wrong, contact us and we will check it against the official register.
Where your information is held
Data and hosting in London. Entity matching uses a US-hosted model that receives your search text and public company records; we never send it personal data we store.
The database and application run in London. The entity-matching model (Anthropic’s Claude API) runs in the United States. It receives the business name you searched for and public company records: name, identifier, status, postcode or town, activity codes and incorporation date. It never receives officers’ names or register records about individuals, such as sole traders.
Legal basis (UK)
Checks: our legitimate interest, and our customers’, in verifying businesses before paying or onboarding them. API keys and sessions: to provide the service you asked for.
How long we keep it
Audit records are kept so decisions can be explained. Audit records are kept for 12 months. The business name and postcode you searched for are deleted after 90 days; the identifier and the result are kept. Session records expire. Key records are kept while the key exists.
Your rights
You can ask for access to, correction of or erasure of personal information we hold about you, and object to its use. You can complain to the Information Commissioner’s Office (UK), the Office of the Australian Information Commissioner, or the Office of the Privacy Commissioner (New Zealand).
Contact
For privacy requests, or to ask us to check a decision about your business, email hello@crado.io.