Privacy & cookies.

Firmwatcher is committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Questions about how we handle your data? Email privacy@firmwatcher.com.

When you sign up

• Your name and email address
• A password, which is hashed by Supabase Auth – we never see it
• Your company name (optional)

When you request or book a demo

Your work email and, if you give it, your firm's name. We store these as a contact in Resend and send ourselves a notification through Pushover so we can reply. If you book a time through Cal.com, Cal.com processes the details you enter there.

When you use the service

• The firms (FRNs) and individuals you choose to monitor
• Email addresses where you want to receive alerts
• Your notification preferences
• Your acknowledgements and comments, and changes to your watchlist, with who made them and when

Automatically collected

• Usage information – pages visited and features used, and when
• Technical information – IP address, browser type – for security and troubleshooting
• Error reports when something goes wrong in your browser
• Cookies (see Cookies section below)

Public FCA data

We collect publicly available information from the FCA Financial Services Register about the firms you monitor. This is public regulatory data that anyone can access.

We use your information to:

• Run the service: create your account, check the FCA register every morning for the firms and individuals you monitor, and send you alerts
• Billing: invoice your subscription and keep the records tax law requires
• Respond to demo requests: contact you about the demo you asked for
• Provide support: respond to questions and issues
• Improve the service: understand how the product is used
• Keep it secure: detect and prevent fraud, spam, and unauthorised access
• Comply with the law: keep records for tax and respond to legal requests

Legal bases: providing the service you signed up for (contract), our legitimate interests in running and improving the service, and legal obligations such as tax records.

We do not sell your data to anyone. We share it only with services that help run Firmwatcher:

Your workspace database is hosted in London (AWS eu-west-2). Some of the services above are based in the USA, which means your data may be transferred internationally. Each has appropriate data protection agreements in place.

Legal requirements

We may disclose your information if required by law or to protect against fraud or illegal activity.

• While you’re a customer: we keep all your data so the service works
• After you cancel: we keep basic account and billing records for 6 years (UK tax law), then delete
• Usage logs: deleted after 12 months
• Support emails: kept for 2 years, then deleted

What we do today:

• All HTTP traffic is served over TLS (managed by Vercel)
• Passwords are hashed by Supabase Auth – never stored in plaintext
• The database is hosted in London (AWS eu-west-2) and encrypted at rest by Supabase
• Regular database backups by Supabase

SSO (SAML / OIDC) and enforced MFA are not yet available.

No system is perfectly secure. Please use a strong, unique password.

Under UK data protection law you have the right to:

• Access the data we hold about you
• Correct anything that’s wrong
• Delete your account and data (some records must be kept for tax)
• Export your data in a portable format
• Object to certain processing
• Withdraw consent for marketing emails

To exercise any of these, email privacy@firmwatcher.com and we’ll respond within a month.

If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Essential – required

• Authentication: keeps you logged in (Supabase)
• You can’t disable these without breaking the service

Analytics

• PostHog: product analytics and error reports – which pages and features are used – so we can improve the service. It stores an identifier in a cookie and in your browser’s local storage.
• Vercel Web Analytics: page views and performance, measured without cookies

Cookie notice

• CookieChimp: provides our cookie notice

We may update this policy occasionally. If we make significant changes, we’ll email you. Otherwise, check the “last updated” date at the top of this page.

Email privacy@firmwatcher.com.