Privacy notice

Who we are

Firmo (firmo.uk) is operated by Firmo UK, based in the United Kingdom. We are the data controller for the personal data described here. The way to reach us about anything on this page is [email protected], and a real person answers.

The company data we publish

Firmo searches the Companies House register and figures taken from accounts companies have filed. That information is published by Companies House as open data under the Open Government Licence.

Most of it is about companies rather than people, but some of it can relate to an identifiable person: a registered office is sometimes a director's home address. Firmo shows and exports company-level fields only, and does not export the register's information about individual directors or people with significant control.

We do not correct the register ourselves, because we are not its source. If something about you is wrong, it has to be changed at Companies House; our copy is rebuilt from their monthly snapshot, so a correction reaches Firmo within a month of appearing there. If you have had an address removed or suppressed at Companies House and it is still visible here after that, email us and we will remove it.

What we collect from you

• When you buy a report: the email address you paid with, the search your report was built from, and a record of when the file was sent. Payment is taken by Lemon Squeezy, who are the merchant of record. We never see or hold your card details.
• When you sign in: your email address, a record of each sign-in link we send, and while you are signed in a session record with the IP address and browser it started from. Each download of a report is recorded with the time, IP address and browser, so paid files can be accounted for. API keys are stored only as a fingerprint.
• When a subscriber invites you to their team: your email address, who invited you, and when the invitation was opened, accepted, withdrawn or declined. We hold it to send you the invitation and let you join, and we use it for nothing else. If you join, your membership is kept while you are in the team; the person who invited you and the other members see your email address in the team list.
• When you search: a short-lived session identifier issued after the human check, and counts of how many searches that session has run, so the service cannot be scraped or overloaded.
• Automatically: server and network logs containing IP addresses, times and the pages requested.

There is no account to create: if you have paid, you can sign in with the email you paid with. There is no newsletter you are signed up to without asking, and no advertising cookies. Firmo sets two strictly necessary cookies: the search session above, which lasts about an hour, and, only if you sign in, an account session that ends when you sign out, after 30 days without use, or after 60 days at most. Beside it, firmo_signed_in holds only the word that you are signed in, so the menu can show Account; it carries no identity and ends with the session. You can see every device you are signed in on, and sign any or all of them out, on your account page. If you subscribe to the weekly emails, opening your preferences sets a third strictly necessary cookie, firmo_weekly, which lets that browser change your lists for 30 days after you last used it; unsubscribing ends it. If you arrived through a link in an email from us, another cookie, firmo_ref, holds only that link's code for 60 days, so that a report or plan you buy later is counted against the email that led to it. It is read only by Firmo and never shared; unsubscribing from our emails deletes it. A link in Firmo Weekly sets firmo_wk the same way: that email's code only, for 60 days, read only by our server when you order, so we know which weekly email a purchase came from. Analytics cookies are set only if you accept them (below).

Firmo Weekly

If you sign up for Firmo Weekly, our one weekly email (every Monday at 08:00 UK time: the growing companies in the sectors and regions you choose, plus a UK snapshot), we keep:

• Your email address, to send it.
• Your lists: the sectors, places and company types you chose, so each email holds what you asked for.
• A record of each email we sent you: the edition, when it was sent, whether it was delivered, and which of its links were followed (not by whom beyond that email, and never your IP address), so a later purchase can be counted against it.
• A record of your consent: when you pressed the button in our confirmation email, the exact wording you were shown, the page you signed up on, and your IP address as a one-way keyed fingerprint only (we cannot turn it back into the address). It is how we can show you asked.

Nothing is sent until you confirm, so nobody can sign you up without access to your inbox. The emails are sent through Resend, which tells us if one bounces or is marked as spam, so we can stop. There is no tracking pixel: we don't record whether you opened an email.

Every email has a one-click unsubscribe, and your preferences page has one too. When you unsubscribe (or an email to you bounces for good, or is reported as spam), we delete your address and your lists at once. We keep only a one-way fingerprint of the address in our suppression list, with the dates you consented and left, so that we never email you by mistake and can show that consent was given. If you sign up again later, you confirm again. Our legal basis is your consent.

Analytics, and your choice

We use Google Analytics 4 to learn which parts of Firmo help people and where they give up, so we can make it better. When you first visit, we ask. Until you choose Accept analytics, Google Analytics sets no cookies: it receives only basic, cookieless signals (that a page was viewed, with no identifier that follows you from one visit to the next), which Google uses in aggregate. If you accept, it sets its own first-party cookies (_ga and _ga_*, lasting up to two years) so that visits can be counted as returning. Advertising features are always off: Firmo runs no ads.

What we send is about using the site, never about you or what you bought: which pages you open, the filters you choose (sectors, regions, size bands and the numbers you type), counts as ranges (such as 50 to 249), and steps like opening the buy dialog or starting checkout. We never send your email, company names or numbers, order or report details, or any single company's figures. Addresses are sent without their query strings, except campaign tags (utm_) and our own short referral code. If you accepted and then buy, we tell Google Analytics from our server that a purchase happened, with its value, linked to your analytics id only.

Google keeps this data for 14 months. To change your mind, use Cookie settings (in the footer of every page): choosing Reject stops the cookies and removes the ones already set. Our legal basis is your consent.

Why we are allowed to hold it

• To perform our contract with you: building and emailing the report you paid for.
• Our legitimate interests: keeping the service available, preventing scraping, fraud and abuse, keeping records of what we sent to whom, and being able to show what was supplied if a payment is disputed.
• Legal obligation: keeping sales records for tax purposes.

Who processes it for us

• Lemon Squeezy (payments and invoicing, merchant of record)
• Resend (sending your report, sign-in links and, if you subscribed, the weekly emails)
• Cloudflare (network, the human check, and protection against abuse)
• Google (Google Analytics 4, only as described under Analytics above)
• Hetzner (servers, Germany) and Cloudflare R2 (encrypted backups)

Our servers are in the EU. Some of the providers above are based in the United States and may process data there under the UK's approved transfer safeguards. We do not sell personal data, and we do not share it for anyone else's marketing.

How long we keep it

• Order and payment records: six years after the end of the relevant tax year.
• The report itself: downloadable for 30 days after signing in. A one-off report's file is then kept, no longer downloadable, for 18 months from sending, as evidence should the payment be disputed (card schemes allow disputes for up to 540 days), then deleted. The record of what was in it, its fingerprint, and when and to which address it was sent stay with the order.
• Your acceptance of the terms: when you tick the box before checkout, we record the terms version, the time, your IP address and your browser's description of itself, with the order records, as evidence of what you agreed to.
• Sign-in links and sessions: deleted a day after they expire. A record of how many times each sign-in link was opened is kept with it until then. Download records: kept with the order records.
• Team invitations, and the invited email address in them: deleted 30 days after the invitation stops working (accepted, withdrawn, declined, or 7 days old and expired). Leaving a team, or being removed from it, ends your membership at once.
• Email delivery records: 12 months. For a paid report, the delivery result (for example delivered, or bounced) and its time are kept with the order records.
• Firmo Weekly: your address and lists until you unsubscribe, then only the fingerprint in the suppression list, with the consent dates. An address that is never confirmed is deleted after 8 days. Delivery reports from Resend (sent, delivered, bounced), with the address only as a fingerprint: 90 days.
• Analytics: 14 months, at Google. A buyer's analytics id (only if analytics were accepted): kept with the order record.
• Rate-limit counters: 24 hours. Server logs: about 30 days. Backups: 30 days.

Your rights

You can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, or to receive it in a portable form. Email [email protected] and we will reply within one month.

If you are not happy with our answer you can complain to the Information Commissioner's Office (ico.org.uk), though we would rather you told us first so we can put it right.

Changes

If this notice changes we will update the date at the top. Material changes affecting people who have bought from us will be sent by email.