What we hold, and what we do not.

Last updated 25 October 2026.

Who is responsible

Funding Check is operated by Winston Dube, the data controller for everything described here. A postal address is available on request. For anything on this page, write to hello@fundingcheck.co.uk.

What we collect

The company you check

You give us a company number. We look it up in the public Companies House register and keep what comes back: the registered name, status, company type, incorporation date, registered address, SIC codes, and the nation, region and local authority those imply. All of it is already public, and we hold it so a check can be repeated without asking you twice.

What you tell us

The follow-up questions, where you answer them: how many people you employ, roughly what you turn over, what you want funding for, and anything else a particular scheme turns on. These change the result, which is the only reason they are asked.

Your email address

Given once, to see your results and to get a link back to them. It is how we recognise you if you later pay, and how the alerts reach you if you subscribe. We do not sell it, rent it or pass it to anyone else.

Payment details

Handled entirely by Stripe, on Stripe’s own checkout page. Card numbers never reach this site and we never see them. What we keep is a Stripe customer reference, your subscription status and when the paid period ends.

How the site is used

Public pages are counted, and the counting is deliberately thin. No IP address and no browser user agent is stored. We keep the path, the date, whether the visit came from a search engine, a link, a social site or an AI assistant, and the host it came from rather than the full referring address, because a search referrer usually carries what the person typed. Signed-in and personal pages are not recorded at all. To answer “how many people” rather than “how many page loads”, a scrambled code is derived each day from the IP and user agent using a key that is never written down, so it cannot be reversed and it stops being the same code tomorrow.

Cookies

Three, all strictly necessary, none for advertising and none shared with anyone:

• one that remembers the check you are in the middle of, so a refresh does not lose it, kept for 30 days;
• one that keeps you signed in once you have an account;
• a short-lived one, ten minutes, used only to make signing in with Google safe from tampering.

There is no analytics cookie and no tracking pixel, which is why you have not been asked to accept anything.

Signing in with Google

If you choose it, Google tells us one thing: your email address, and that Google has verified it belongs to you. We do not ask for, and cannot see, your contacts, your calendar, your files or anything else in your Google account. We never receive your Google password. You can disconnect Funding Check at any time in your Google account connections.

Why we are allowed to hold it

• To do what you asked, which covers running the check, showing the results and, if you subscribe, keeping them current. In data protection terms, performing a contract with you or taking steps before entering one.
• Our legitimate interests, for keeping the service up, preventing abuse of an expensive automated check, and counting traffic in the limited way described above.
• Legal obligation, for the records tax and company law require us to keep about payments.

Who else sees it

Only the suppliers that make the product work, each handling data on our instructions and for no purpose of their own:

• Railway, which hosts the site and the database.
• Stripe, which takes the payments.
• Resend, which delivers the emails.
• Anthropic, whose models read each funder’s published criteria against your business profile. What is sent is the business profile described above. Your email address is not.
• Companies House, the public register we look your company up in. We send a company number and nothing about you.

Some of these process data outside the UK. Where they do, the transfer relies on the UK’s approved safeguards, such as the International Data Transfer Agreement or an adequacy decision.

How long we keep it

• An unfinished check, where no email was given, is kept for up to 12 months and then deleted.
• A completed check and the email behind it is kept while the account is in use, and for 12 months after the last sign-in or subscription, so you can come back to it.
• Payment records are kept for seven years, because tax law requires it.
• Traffic counts are aggregate, hold no identifier that lasts beyond a day, and are kept indefinitely.

What you can ask for

Under UK data protection law you can ask us for a copy of what we hold about you, to correct it, to delete it, to restrict or object to what we do with it, and to have it sent to you or another provider in a portable form. You can also withdraw consent where we relied on it.

Write to hello@fundingcheck.co.uk and we will answer within one month. There is no charge. If you are not satisfied with how we handle it, you can complain to the Information Commissioner’s Office, the UK regulator, though we would rather you gave us the chance to put it right first.

Children

This is a product for businesses. It is not intended for anyone under 18 and we do not knowingly collect their data.

Changes

If this notice changes in a way that matters, the date at the top changes with it, and anyone with an account is emailed before the change takes effect.

See also our terms of service, or run a check.