Privacy Notice
This notice explains how we collect and use personal data about company directors, company secretaries, and persons with significant control (PSCs) of UK companies. We publish it because we obtain this data from the public register rather than from you directly, and UK GDPR (Article 14) requires us to tell you how we use it.
If you have an account with us, or connect an AI assistant to our connector, the section on accounts says what we hold about you as a customer.
Who we are
PromptWorks AI Ltd (company number 17305850) is the controller of this data. Contact us at 66 Paul Street, London EC2A 4NA, or by email at privacy@promptworksai.co.uk.
What data we hold about you
If you are, or have been, a director, secretary, or PSC of a UK company, we may hold your name, an approximate date of birth (month and year only, as published by Companies House; we do not hold the day), your role and company, the date you were appointed to that role and, if you have left it, the date you left, a registered or correspondence address as published, and an ownership percentage or band. Where a subscriber asks us to read a company's own website, we also hold the business telephone number, general email address (such as info@) and postal address the website publishes; never a mobile number or a personal email address. We do not collect or infer any special category data about you.
Where we get it
Entirely from public sources: the Companies House register, published under the Open Government Licence, together with public news about the companies concerned and, where a subscriber has confirmed it and asked us to read it, the company's own website. We do not collect anything from you directly.
Why we use it, and our lawful basis
We use it to identify UK companies whose ownership may be approaching a succession, so that our subscribers can approach those companies, by post, telephone or email, about a possible sale, buyout, or investment. We do not contact anyone ourselves; a subscriber who telephones or emails is responsible for the rules on electronic marketing, including screening against the Corporate Telephone Preference Service. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR), assessed in a documented Legitimate Interests Assessment available on request.
Who we share it with
Our subscribers, who are bound by terms prohibiting resale or republication of the data, and infrastructure providers who process data on our behalf under contract. We do not sell your data as a standalone product.
Where a subscriber reaches the service through an AI assistant of their own choosing (for example Anthropic, OpenAI or Microsoft), connected by our Model Context Protocol connector, that assistant's provider also receives what the connector returns. The provider is the subscriber's choice and acts on the subscriber's instruction, not ours: the connector answers whichever assistant the subscriber connected, and for a hosted assistant that is the provider's own servers, which may be in a country outside the UK (Anthropic and OpenAI, for example, are US companies). We treat that as a disclosure to the subscriber, through a provider acting for them under their own agreement, rather than as a transfer by us to the provider; we have no contract with the provider and no say in what it does. That position is under legal review, and we will update this notice if it changes. Only company-level information goes by that route: a company's filed figures, its registered charges, and the succession signal we compute for it. No name and no date of birth is disclosed that way. The approximate age of a company's eldest and youngest controller does go, as a figure and a five-year band attached to the company's record rather than to a named person; if you are that company's eldest controller, it is still information about you, and your right to object covers it. How long the company's longest-serving director or LLP member has been in post goes too, as a five-year band worked out from the appointment dates the register publishes and attached to the company's record, never as the date itself; if you are that director or member, it too is information about you, and your right to object covers it.
How long we keep it
No longer than 24 months, after which it is deleted or refreshed from the current register. Register-derived data goes out of date on its own (ages advance, directors change, companies are sold), so holding it beyond that serves no purpose for us and none for you.
Your rights
You can object to our use of your data at any time. Because we process it for direct marketing purposes, an objection is absolute and we will suppress your record immediately. You can also ask to see what we hold, correct anything inaccurate, or ask us to erase it. You can complain to the Information Commissioner's Office at any time.
The quickest way to have your details removed is our removal page, and no account is needed.
If you have an account, or use the connector
When you create an account we hold your email address, a hash of your password (never the password itself), whether you have confirmed the address, your plan and subscription status, and which version of our terms you accepted and when. If you sign in with Google, Microsoft or Apple we hold the identifier that provider gives us for you, not your password there. We also hold what you create in the service: the cohorts you build, your watchlist, and the notes and outreach log you keep.
When you use the service we record what it served you: how many rows each request returned and, for a CSV export, which companies it contained. When an AI assistant calls our connector for you we record which account, which connecting client, which tool, how many rows, which companies were returned, and when. We never store what you or your assistant asked: the connector keeps only a one-way keyed fingerprint of a request's arguments, and it receives nothing of your conversation beyond the arguments your assistant sends to a tool. We do not read your assistant's memory, chat history or files.
Signing in to the connector is handled by WorkOS, our sign-in provider, which receives your email address and confirms it to us. Payments are taken by Stripe, which holds your card details; we never see them. Email we send you goes through Resend. The service runs on Railway and its database on Neon, and Sentry tells us when something breaks, without your personal data. Each acts on our instructions under contract.
We use this to provide the service you signed up for (Article 6(1)(b) UK GDPR), and the usage records to keep it secure and to answer anyone who asks who has received information about them (our legitimate interests, Article 6(1)(f)). Your account and what you created are kept while your account is open; email privacy@promptworksai.co.uk to close it and we will delete them, apart from records the law requires us to keep. Usage and connector records are kept for 24 months. You have the same rights over this data as anyone above: to see it, correct it, erase it or object.
Cookies
We set no cookies of our own and run no analytics. What the site keeps in your browser, and the third parties it talks to, are listed on the cookies page.