Privacy notice

This notice covers two groups of people, those who instruct us and those we are asked to find, and visitors to this website.

People who instruct us

What we collect: your name, organisation, postal address, email address and phone number; your relationship to the person you ask us to find; the reason for the trace and the detail you give; everything you tell us about the person; your declaration and the version of the terms you accepted, with the date, time, IP address and browser from which the instruction was made; your country as reported by our network provider; how you reached our website (the site that referred you, the first page you opened and the campaign label on any advert or link you followed); payment tokens from our payment provider (we never see full card numbers); identity or purpose documents where we ask for them; and the emails you exchange with us. For firm accounts: the work email addresses of the people allowed to sign in, sign-in times, uploaded spreadsheets, API keys (stored hashed), the webhook address you give us, and invoices.

Why: to perform the contract with you (Article 6(1)(b)); to comply with our legal obligations, including data protection, tax and accounting law (Article 6(1)(c)); and for our legitimate interests (Article 6(1)(f)) in verifying who instructs us, preventing and detecting misuse of our service, deterring and reporting crime, and establishing, exercising or defending legal claims.

Who we share it with: the suppliers listed under Processors below. We may also disclose your identity, your instruction and your declaration to the police, the Information Commissioner's Office, a regulator or a court where we believe a declaration was false or a result has been misused, or where the law requires it. If the person you asked us to find exercises their right of access, we may be required to tell them that their data was disclosed to you; we withhold your details where the law allows.

How long: the record of your instruction, including your identity, your declaration, the purpose, the terms you accepted and what was delivered, is kept for six years after the case closes, so that we can deal with complaints, regulatory enquiries and legal claims. Payment and invoice records are kept for six years for tax. Firm account records are kept for the life of the account plus six years. Identity documents are deleted once checked unless we have a reason to keep them, which we will tell you.

Unfinished instructions: if you give us your name and email address on the instruction form and do not send it, we keep what you typed for seven days and email you once, about an hour later, with a link to pick up where you left off, unless you tick the box on the form asking us not to. The draft is deleted when you send the instruction, when you tick that box, or after seven days.

Your rights: you can ask what we hold about you, ask for it to be corrected or erased, and object to processing based on our legitimate interests. We will not erase a record that we need to keep for a legal claim or a regulatory enquiry. Email [email protected].

People we are asked to find

What we collect: your name and other names, date of birth or approximate age, past and present addresses, and information from public and licensed sources that helps confirm an address. In consent-based reconnection cases, the message we pass on and your response.

Why: the legitimate interests of the instructing party (Article 6(1)(f)), such as recovering money owed, pursuing or defending legal claims, serving documents, administering an estate or resolving a tenancy or commercial dispute. We record a legitimate interests assessment for every case, we consider your rights and interests before we act, and we refuse instructions where they outweigh the purpose. Where the purpose is personal, such as reconnecting with a relative, we rely on your consent: we pass on a message and nothing is disclosed unless you agree.

Where it comes from: the instructing party; electoral registers; Companies House; HM Land Registry; court, insolvency and other public registers; directories and business listings; the open web and social sources; and licensed tracing data.

Who receives it: only the instructing party, for the purpose they declared and under a duty of confidence. We do not sell data and we do not add it to any list.

How long: 12 months after the case closes, then deleted, except where we need to keep it to deal with a complaint, a legal claim or a request from a regulator or the police.

Your rights: you can ask what we hold about you, ask for it to be corrected or erased, object, and complain to the Information Commissioner's Office. Email [email protected] with your name and we will respond within one month. We may not be able to tell you who instructed us where that would prejudice their legal rights, but we will tell you what we can. If you believe that someone has used an address obtained from us to harass or threaten you, tell us and tell the police: we keep a record of every instruction and we cooperate fully.

Processors and transfers

We use a small number of suppliers to run the service, each under a written contract: our hosting and network security providers (including Cloudflare), our payment provider (Stripe) for card details and charges, our email provider for transactional email, and professional advisers bound by confidentiality. Where a supplier stores data outside the United Kingdom, we rely on the UK adequacy regulations or the UK International Data Transfer Addendum.

Security

Data is encrypted in transit, access is limited to the people who need it, portal sign-in is by single-use emailed links, and API keys are stored hashed. Card numbers never touch our systems.

Website

No cookies and no browser storage. Cookie-free first-party analytics record the pages viewed, how long each page is open and how far down it is read, the links and buttons clicked (their visible text only, never anything typed into a form), the referring site and the campaign label on any advert or link followed, the type of device and browser, the approximate location (town or city, from the network), and an identifier that changes every 30 days and cannot be tied to a person. Some visits are also recorded as a replay of what the page showed and how it was scrolled and clicked, with anything typed into a form masked before it leaves the browser; replays are kept for 14 days. The name of the organisation that owns the network a visit came from may be recorded where it is a business or public body, never a home or mobile network. IP addresses are not stored by our analytics. Our network security provider records IP addresses and request logs for security and abuse prevention.

When you arrive from one of our adverts on Microsoft's search network, the click identifier Microsoft adds to the link is kept with the visit and, if you instruct a trace, with the instruction. We report the instruction, its time and its price back to Microsoft Advertising so we can see which adverts work. Microsoft receives the identifier it created, the time and the amount; it is never told who instructed us or who is being traced.

Complaints

[email protected] first. If we cannot resolve it, the Information Commissioner's Office at ico.org.uk.