CoSec CompanionSign in

Privacy Policy

Last updated 7 October 2026

This Privacy Policy explains how CosecCompanion ("we", "us", "our") collects, uses, and protects your personal data when you use our website and services. We are the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This is a draft policy provided for the private beta of CosecCompanion. It will be reviewed and finalised before general availability. If you have questions about how we handle your data in the meantime, please contact us using the details below.

1. Who we are

CosecCompanion is operated as a sole-trader service in the United Kingdom. References to "we" refer to the operator of the service. Our contact details are set out in section 11.

2. Personal data we collect

We collect and process the following categories of personal data:

  • Account data — name, email address, and authentication identifiers provided by our identity provider (Clerk) when you create an account or sign in.
  • Entity data — information you upload or import about the companies and other entities you manage, including company numbers, registered office addresses, directors, and persons with significant control. Some of this data is sourced from Companies House public records.
  • Filing and obligation data — records of statutory filings and deadlines generated, scheduled, or marked as filed within the service.
  • Usage data — IP address, device and browser metadata, referrer, and pages visited, collected via our hosting provider (Vercel) and authentication provider.
  • Communications — emails and other messages you send to us, and any feedback you submit through the product.

3. How we use your personal data

We use your personal data to:

  • Provide, operate, and maintain the CosecCompanion service.
  • Authenticate you and protect the security of your account.
  • Generate filing deadlines and obligation reminders for the entities you manage.
  • Communicate with you about the service, including service updates and incident notices.
  • Improve the service, including diagnosing technical issues and analysing usage patterns.
  • Comply with our legal and regulatory obligations.

4. Lawful bases for processing

We rely on the following lawful bases under the UK GDPR:

  • Contract — to provide you with the service you have signed up for.
  • Legitimate interests — to keep the service secure, prevent fraud, and improve our product. We balance these interests against your rights and freedoms.
  • Legal obligation — to comply with applicable laws, including responding to lawful requests from regulators.
  • Consent — for any optional cookies and any marketing communications you opt in to.

5. Sharing your personal data

We share personal data with the following categories of recipient where necessary to deliver the service:

  • Clerk — authentication and user management.
  • Supabase — application database hosted in the EU (Frankfurt).
  • Vercel — application hosting, with our application running in London, and edge delivery.
  • Cloudflare — DNS and content delivery.
  • Companies House — public-record lookups initiated by you.
  • AI model providers — only if your organisation turns on the AI assistant. It is off unless a super user turns it on. To answer a question, the assistant sends the records it reads to answer it (for example names, roles, dates, deadlines and filing details) to the model provider your organisation chose. It never sends residential addresses, full dates of birth or authentication codes, and it reads only what the person asking can already see. On our key the provider is Anthropic, acting as our sub-processor. On your organisation’s own key, it is the provider you chose (Anthropic, OpenAI, Google or xAI), or your own Amazon Bedrock, Azure OpenAI or Google Vertex AI in the region you chose, under your agreement with them, or a model or AI gateway your organisation runs itself, at the address it gives us. Only on your organisation’s own key, and only if a super user allows it, the assistant can also read the text inside your documents and files attached to a question; it is never allowed on our key, and identity documents and proofs of address are never read. If a super user also turns on search by meaning, passages of that text are sent to OpenAI or Google, whichever they choose, on your organisation’s own key, to be turned into numbers that can be compared; those numbers are stored with us and deleted if search by meaning is turned off. Conversations are visible only to the person who had them and are deleted after the period your organisation sets (90 days unless changed).
  • Your organisation’s own AI tools — only if a super user allows AI tools outside CoSec Companion. A person in your organisation can then connect an AI tool your organisation uses (for example Microsoft Copilot, ChatGPT or Claude) to read, as them, the records they can already see here. What it reads goes to that tool’s provider under your organisation’s agreement with them, not ours; it never receives residential addresses, full dates of birth or authentication codes, and it reads the text inside documents only where the assistant here is allowed to. It can prepare changes, but nothing changes until the person confirms it in CoSec Companion. Each record it reads is logged against the person and the tool, and a super user can disconnect any tool.
  • Professional advisers, regulators, or law enforcement where we are legally required to share data.

We do not sell your personal data.

6. International transfers

Some of our processors are based outside the UK. Where we transfer personal data outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or adequacy decisions recognised by the UK government.

7. Retention

We retain personal data for as long as your account is active and for a reasonable period afterwards to comply with legal obligations, resolve disputes, and enforce our agreements. Entity records and filing histories are retained for up to seven years after account closure to support audit trails. Files and folders you delete in Documents, and earlier versions of a file, are kept for 60 days so they can be restored, then removed permanently.

8. Your rights

You have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate or incomplete data.
  • Request erasure of your personal data in certain circumstances.
  • Restrict or object to certain processing.
  • Request a portable copy of data you have provided to us.
  • Withdraw consent where we rely on consent.
  • Lodge a complaint with the Information Commissioner's Office (ico.org.uk).

9. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, role-based access control, and audit logging. No service can guarantee absolute security; please use a strong password and keep your authentication credentials confidential.

10. Children

CosecCompanion is intended for use by professional users and is not directed at children under 18. We do not knowingly collect personal data from children.

11. Contact us

If you have questions about this Privacy Policy or wish to exercise your rights, please use the contact details on our Contact page.