Privacy policy

Last updated: 15 July 2026

1. Who we are

plaingraph OÜ is the controller for personal data processed through the plaingraph service. The company is established in Estonia, and because the service handles UK and EU (including Estonian) registry data and may be used by people in the UK and the EU, UK and EU data-protection law (the UK GDPR and the EU GDPR) apply to this processing. Where the law requires it, we will appoint a representative; we will name it here once appointed.

2. Personal data we process

The service is built from public company-registry records and filed accounts from UK Companies House, the Estonian e-Business Register, and GLEIF. plaingraph is a company-fundamentals product: we do not operate a people-search or sanctions-screening service, and we do not ingest dedicated registers of company officers, persons with significant control, or beneficial owners, nor any sanctions or watch lists. Even so, public filings can contain incidental personal data — for example a registered office that is a residential address, or a name that appears in a filed accounts document or a charge record — so some personal data may pass through the service. We also process the basic account data of our users (such as name, email, and API-key activity) so we can run the service.

3. Why we are allowed to use it (lawful basis)

For the registry and accounts data, our lawful basis is our legitimate interest (and the legitimate interests of our users) in providing accurate company-fundamentals data built from public records — balanced against the rights of any people whose personal data incidentally appears in those records. We do not process special categories of data for this purpose. For user account data, our basis is performing our agreement with you and our legitimate interest in running and securing the service. We can share our balancing assessment on request.

4. The questions you send us

The questions a user or agent sends to the service (what you look up) can be more sensitive than the public registry itself. We use them only to answer your request, to keep the service secure, and to fix faults. We do not mine your query data to build the product, we do not use it to profile the companies you look up for our own purposes, and we do not sell it. Our analytics and error-monitoring tools never receive the contents of what you look up (see section 5).

5. Website analytics and error monitoring

We use PostHog (EU region) for product analytics on the marketing site and the signed-in dashboard. It is only loaded after you consent, runs no autocapture or session recording, and never receives the contents of what you look up. We rely on your consent for this analytics; you can withdraw it at any time from the cookie settings. Separately, we use Sentry (EU region) for error monitoring: it sets no cookies and receives only technical error data, with request bodies, query strings, headers and cookies stripped before any error is sent, so it never receives what you look up; we rely on legitimate interests for this. Both are processors acting on our instructions, are kept separate from billing records and security audit logs, and are listed in section 8.

6. Your rights and the takedown / suppression route

Individuals have rights under applicable data-protection law, including access, rectification, objection, and erasure where it applies. Because some data derives from the public register, certain rights interact with statutory publication rules, so we cannot always remove data that the public register still publishes — but we will explain our reasons and point you to the source. To request suppression or removal of personal data surfaced by plaingraph, or to exercise any right, contact [email protected]. We aim to respond within one month, in line with data-protection law.

7. How long we keep it

We keep data only as long as we need it. Registry and accounts data is refreshed from source and carries an as-of timestamp. The questions you send us are kept for a short period to run and secure the service and then deleted or aggregated; security and audit logs are kept longer where we need them to protect the service or meet a legal obligation. Account data is kept while your account is active and for a reasonable period afterwards. We will confirm exact retention periods as the service matures.

8. Sub-processors and international transfers

We use a small number of trusted providers ("sub-processors") to run the service. Each one only handles data to provide its part of the service, on our instructions and under data-protection terms. The sub-processors we use to run the service are:

Payments are handled by Lemon Squeezy as merchant of record, which processes your payment details to take subscription payments; we do not store full card numbers. Most data stays in the UK or EEA. Where a sub-processor is outside the UK/EEA — currently WorkOS, Modal, Axiom, and Lemon Squeezy in the United States — we rely on an appropriate transfer safeguard, such as the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum. We keep this list current as the service develops, and give notice of a new or replacement sub-processor before it starts handling personal data, so anyone relying on our Data Processing Addendum can object. For the latest version, or a copy of the safeguards, email [email protected].

9. Complaints and supervisory authorities

If you think we have mishandled your personal data, please contact us first so we can put it right. You also have the right to complain to a data-protection authority: the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) where we are established, the UK Information Commissioner's Office (ICO) for UK matters, or the authority in your own EU country. We will confirm any data-protection-fee or registration details that apply to us here.

10. Contact

Privacy questions: [email protected].