Privacy notice

The short version

• Reading the site, browsing the archive and using the firm checker require no account and set no tracking.
• We do not record who searched for what. There is no query log tied to a visitor.
• We never ask how much money you lost, and no field anywhere in our systems records it.
• We do not sell, rent or share personal data with advertisers, lead buyers, claims companies or law firms.
• Tips are purged 12 months after receipt.

Who is responsible

The Fraud Center is the controller for the personal data described here. The registered entity and its contact details are published on the ownership page; for any data question, write to us through the contact page and mark it "data request".

The firm checker

Queries typed into the firm checker are not stored against you. We keep no IP address, user agent, session identifier or query text tied to a visitor. What we do keep is deliberately minimal:

• An anonymous daily count of how many checks produced each verdict, with no query text attached.
• A short-lived hashed rate-limit counter so the tool cannot be scraped or abused. It expires within the hour.
• A cache of results from official sources, held for 24 hours against the normalised search term only — never against a person, a device or a session.

This is a design choice, not a promise: the system has nowhere to write a per-visitor query log, so it cannot be handed over, leaked or repurposed later.

Tips

We store what you send through the tip line, including an email address if you choose to give one. Tips are readable only inside the newsroom, are never published by default, and are purged 12 months after receipt. We never ask how much money you lost and we hold no field for it. If you want your tip deleted sooner, ask and we will delete it unless it is already the subject of a published story.

Contact and complaints

Messages sent through the contact page, including complaints, right-of-reply correspondence and takedown requests, are logged with the date received so that we can meet deadlines and show how a complaint was handled. Complaint records are kept for six years, because they may be needed to defend or explain a publishing decision.

Accounts and comments

Commenting requires an account. We hold the email address you sign up with, a display name, and the comments you post along with the time they were posted. Moderators can see this; other readers see only your display name and your comment. Deleting your account removes your profile and detaches your comments; comments that are part of a published discussion may remain in anonymised form.

Newsletter and alerts

If you subscribe to a newsletter or to alerts for a category or a firm, we keep your email address and the subjects you asked to follow, and use them for nothing else. Every message carries an unsubscribe link, and unsubscribing deletes the subscription record.

Follows and reading preferences

Following a firm or topic without an account, and your text-size choice, are stored in your own browser. They never leave your device unless you sign in and choose to sync them. Clearing your browser storage clears them.

Analytics and performance data

We measure page performance (loading and responsiveness timings) and an aggregate count of how many times an article has been served. Those measurements are not linked to a person, contain no identifiers, and are used to keep the site fast and to see what readers find useful. We run no advertising analytics and no cross-site tracking of any kind.

Lawful bases

• Journalism in the public interest — legitimate interests, for handling tips, research and publication.
• Consent — for newsletters and alerts, withdrawable at any time.
• Contract or steps toward it — for an account you create yourself.
• Legal obligation — where we are required to keep or disclose something.

How long we keep things

• Tips: 12 months from receipt, then purged.
• Complaints, corrections and takedown records: six years.
• Newsletter and alert subscriptions: until you unsubscribe.
• Accounts and comments: until you delete the account.
• Checker rate-limit counters: under one hour. Result cache: 24 hours.
• Published journalism, including the archive: indefinitely, as a matter of public record.

Who processes data for us

We use a small number of service providers to host the site, store the database and deliver email. They act on our instructions under contract, may not use the data for their own purposes, and are held to equivalent security obligations. We do not use advertising networks, data brokers or lead platforms in any capacity.

International transfers

Where a provider processes data outside the UK, the transfer is covered by UK adequacy or by the UK International Data Transfer Addendum, and the data is limited to what that service needs to function.

Security

Access to tips and reader data is restricted to the newsroom accounts that need it and is enforced by row-level rules in the database rather than by application code alone. Traffic is encrypted in transit. We keep an audit record of administrative actions. If a breach affecting your rights occurs, we will tell you and the regulator within the statutory timeframe.

Children

The site is intended for adults. We do not knowingly collect personal data from children, and we do not name children in reporting.

Your rights

You can ask what we hold about you, ask us to correct it, ask us to delete it, object to processing, ask us to restrict it, or ask for a copy in a portable format. Write to us through the contact page; we answer within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you gave us the chance to fix it first.

The journalism exemption

Journalistic material carries limited exemptions under UK data protection law — for example, we may not be able to disclose material that would identify a confidential source, or to delete material relating to a story we are working on. Where an exemption applies we will tell you which one and why, rather than simply refusing.

Changes to this notice

We update this notice when what we do changes, and the date at the top of the page always reflects the current version. Material changes are noted on the corrections and changes log.