Privacy notice

This notice applies from 16th November 2026. It explains how Dittabase handles personal data, and is in two parts: the first is for people who use the site, and the second is for people who are named in the company information it shows, such as directors and owners of companies.

Who we are

Dittabase (dittabase.com) is run by Mossend Software Ltd, a company registered in Scotland with company number SC809600, whose registered office is at 4 Bairdsland View, Bellshill, ML4 1RZ. Mossend Software Ltd is the controller of the personal data described here. We are registered with the Information Commissioner's Office under registration number [[ICO REGISTRATION NUMBER]].

For anything about this notice or your personal data, email [[CONTACT EMAIL]]. We have not appointed a data protection officer, as we are not required to, but that address reaches the person responsible.

Part one: members of the site

What we collect

• Your sign-in details. You sign in with Google, with a Microsoft work or school account, or with a link we email you. Google tells us your email address, whether it has been verified, your name and a link to your profile picture; Microsoft tells us your email address, whether your organisation has verified its domain, your name and your organisation's directory identifier. We keep your email address, which identifies your account, and the date you joined. We do not keep your name or picture. When you ask for a link by email, we keep the address it was sent to, when, and whether it was used, for a day.
• Your plan and billing. Your plan, and the identifiers Stripe gives your customer record and subscription, with the subscription's status. Your card details go to Stripe and never reach us. Stripe holds your billing name, address, payment details and any VAT number you give it.
• What you do in the site. The screens you keep, the companies you add to your shortlist, the marks and notes you make on filed accounts in the reader, the questions you put in words to the question box (with the screen produced, and the number of model tokens used, kept in a ledger of your allowance), your messages from us, and whether you have chosen to preview the site as a Free member.
• Support reports. What you write when you report a problem or ask for something, any pictures you paste or attach, the page you were on, the size of your browser window, and your browser's user-agent string.
• Technical data. Your IP address and the requests your browser makes, which are recorded in our server logs and briefly held in memory to apply rate limits to each address and each member; and information our network provider, Cloudflare, processes to protect the site from attacks and automated abuse.

We do not use analytics or advertising cookies, and we do not build marketing profiles of members.

Why we use it, and our lawful basis

• To provide your account and the service you have chosen, including sign-in, your plan, your saved screens, shortlist and notes, answering questions you put in words, and your messages. Lawful basis: performance of our contract with you.
• To take payment, and to keep accounting and tax records. Lawful basis: performance of our contract, and compliance with our legal obligations (for example, to keep VAT and company records).
• To deal with support reports and complaints. Lawful basis: performance of our contract, and our legitimate interest in running and improving the service.
• To keep the site secure and the data protected, including rate limits, daily quotas, bot protection on sign-in, detecting scraping and account sharing, and keeping server logs. Lawful basis: our legitimate interests in protecting the service, our data and our members, which we consider are not overridden by your interests given the limited data used.
• To tell you about changes to the service, these terms or your subscription. Lawful basis: performance of our contract, and our legitimate interests.
• To understand which companies members look at, so that we can decide which to read in more fully. We use this in aggregate, not to profile you. Lawful basis: our legitimate interest in improving the data.
• To establish, exercise or defend legal claims. Lawful basis: our legitimate interests.

We will not send you marketing emails unless the law allows it (for example, about similar services you have bought from us, with a way to opt out each time) or you have agreed to them.

Who we share it with

We use the following organisations to run Dittabase. Where they act for us as processors, they may use your data only on our instructions.

• Google, for signing in (Google receives your sign-in as part of its own service) and for the web fonts the pages load, which means your browser sends your IP address to Google when a page loads.
• Microsoft, for signing in with a work or school account (Microsoft receives your sign-in as part of its own service).
• Amazon Web Services (Amazon Simple Email Service), which sends the sign-in links we email you, in [[SES REGION]]; it receives your email address and the message.
• Stripe, for payments, invoices and the billing page. Stripe acts as our processor for some purposes and as a controller in its own right for others, such as fraud prevention and its legal obligations; see Stripe's privacy policy.
• Cloudflare, which carries all traffic to the site, protects it from attacks and automated abuse (including the Turnstile check on signing in), serves a script used by the filings reader, and stores our backups and some of our data.
• OVH, which hosts our server, in [[HOSTING LOCATION]].
• OpenRouter, and through it the provider of the language model it routes to (currently Anthropic), which receive the text of a question you put in the question box, the screen you are working on, and our instructions to the model, so that the model can write a screen. They do not receive your email address or any other account detail from us. [[CONFIRM: OPENROUTER DATA-RETENTION AND TRAINING SETTINGS, AND THE MODEL PROVIDERS ALLOWED]]
• Companies House, from whose service we fetch a company's filed accounts when you open them in the reader. Nothing about you is sent to Companies House.
• Professional advisers, insurers, and authorities where needed, for example our accountant, or a court or regulator where the law requires.

We do not sell members' personal data.

International transfers

Some of these providers are based in, or process data in, the United States or elsewhere outside the UK. Where personal data leaves the UK, we rely on one of the safeguards UK data protection law provides: a UK adequacy regulation (which covers the European Economic Area, and the United States for organisations certified to the UK Extension to the EU-US Data Privacy Framework), or the International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, which the providers include in their data processing terms. [[CONFIRM FOR EACH PROVIDER WHICH SAFEGUARD APPLIES -- SEE COMPLIANCE MEMO]] You can ask us for more detail at [[CONTACT EMAIL]].

How long we keep it

• Your account data, saved screens, shortlist, notes and messages: while your account is open, and deleted within 30 days of your asking us to close it, or after two years in which you have not signed in, if you have no subscription.
• Questions put in words and the token ledger: 12 months from each question, or until your account is closed if sooner.
• Billing and subscription records: six years from the end of the financial year to which they relate, as tax and company law require.
• Support reports and their pictures: two years from when the ticket is closed.
• Server logs: up to 90 days.
• Rate-limit counters: held in memory for minutes, and not stored.
• Backups: copies of our member database are kept for 30 days and then overwritten, so deleted data leaves our backups within that time.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected, to have it deleted, to have its use restricted, to object to our using it on the basis of legitimate interests, and to receive data you gave us in a portable form. These rights are not absolute: for example, we must keep billing records for as long as the law requires.

At present we do not offer deletion from within the site. To close your account and have your data deleted, or to exercise any other right, email [[CONTACT EMAIL]] from the address you sign in with. We will reply within one month, which may be extended by up to two further months for complex requests, in which case we will tell you why.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first at [[CONTACT EMAIL]] and we will respond. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.

Part two: people named in the company information

Dittabase shows information about UK companies. Some of it is about people: the directors and other officers of companies, people with significant control of companies (often called PSCs), shareholders, and people named in reports of deals. This part explains what we hold about them, where it comes from, and what they can do.

What we hold, and where it comes from

We did not obtain this information from you. It comes from public sources:

• Companies House, which keeps the public register of companies: directors' names, their positions or occupations, the dates they were appointed and resigned, and their month and year of birth; persons with significant control, with the nature of their control and their month and year of birth; and the accounts, confirmation statements, share allotments and other documents companies file. We obtain it through Companies House's bulk data products and its public data service.
• The London Gazette, for official notices about companies.
• Contracts Finder and Find a Tender, the government's public-contract services, for contracts awarded to companies.
• Press and news reports, for deals: the parties, and sometimes the people involved, named in public reports, which we link to.
• Filed accounts read by machine, where figures, and sometimes the names of buyers or sellers in a deal, are read from accounts by optical character recognition or by language models.

The data Companies House supplies to us includes directors' service (correspondence) addresses, which some people give as their home address. We do not display any address of an individual. We do not seek out anyone's residential address, full date of birth, or any information about their private life beyond what the public record contains.

How we use it

We show the directors of each company by name, as they appear on the register, with their position and date of appointment. We use people's month and year of birth only to work out figures such as the age of a company's oldest and youngest director or owner, which members can use in screens; we do not display individuals' dates of birth.

The names of persons with significant control, of individuals who buy or sell companies and, when we come to show them, of individual shareholders are veiled on the site: the page shows blurred placeholder letters and the real name is not sent to the member's browser. We may show such a person's nature of control or shareholding without their name. Where a buyer in a deal is an individual rather than a company, our question-box data refers to them only as "An individual".

Our lawful basis

We rely on legitimate interests: ours, in providing a research service about UK companies, and our members', in understanding who runs and owns the companies they deal with, lend to, invest in, buy or advise. This information is on the public register because Parliament decided that people who run and control companies should be identifiable, for transparency and to support trust in commerce.

We have weighed those interests against the interests and rights of the people concerned. In doing so we have taken into account that the information is already public, that it relates to people's business roles rather than their private lives, that people who take on these roles can reasonably expect to be identified in connection with them, and the safeguards we apply. We have concluded that showing directors' names in their business role is a proportionate use, and that the names of PSCs, shareholders and individuals in deals should be veiled. You can ask us for a summary of our assessment.

Telling people individually

We hold information about a very large number of people, obtained from public registers, and we do not have contact details for them. Writing to each of them would involve disproportionate effort, so instead we publish this notice, and link to it from every page of the site.

Keeping it accurate

We refresh information from Companies House regularly, so a correction made at the register will reach Dittabase in due course. Because some figures and names are read by machine, they may occasionally be wrong; the site says where figures have been read by a model and not checked.

Protected information

We respect the protections the law gives on the public register. Where Companies House has suppressed a director's residential address, or protected the details of a person with significant control, that information does not reach us through the register, and if it reached us by any other route we would not use it. We do not display residential or service addresses of individuals at all.

Your rights

If you are named in the company information on Dittabase, you have the right to ask what we hold about you and for a copy of it, to have inaccurate information corrected, and to object to our use of it. If you object, we will stop using the information unless we have compelling legitimate grounds that override your interests, rights and freedoms; we will look at each objection on its own facts, and will take particular account of any risk to your safety or that of your family.

If the information is wrong on the register itself, the correction needs to be made at Companies House first; our data sources page explains how. If it is wrong only on Dittabase, for example because a figure or a name has been misread, tell us and we will correct it.

To exercise any of these rights, email [[CONTACT EMAIL]], saying which company or page the information appears on. We will reply within one month. We may need to ask for information to confirm your identity before we act.

Retention

We keep company information for as long as it remains on the public register or is relevant to the companies we cover. Information about directors who have resigned and owners who have ceased is kept as part of a company's history, in line with what the register itself keeps. If information is removed from the register by law, we remove it from Dittabase when we next refresh our data.

Complaints

You have the right to complain to the Information Commissioner's Office, though we would ask you to contact us first so that we can try to put things right.

Changes to this notice

We will update this notice when our use of personal data changes, for example if we begin to show shareholders' details from confirmation statements or to send alerts by email, and will show the date it was last changed at the top.