Privacy

OpenCompanies republishes the Companies House register: companies, the people who run them and the people who control them. That makes it a site full of personal data about other people. This page explains what we publish about people, what we collect when you visit, and what you can do about either.

Who we are

OpenCompanies is run by Jason Cartwright, an individual, who is the data controller for this site. It is an independent project and is not affiliated with Companies House. To get in touch about anything on this page, use the contact details at jasoncartwright.com.

The people on this site

For company officers (directors, secretaries and LLP members) and people with significant control (PSCs), we publish what Companies House publishes:

• their name;
• their month and year of birth;
• their nationality, country of residence and occupation;
• the companies they are or were involved in, their role, and the dates they were appointed, resigned, notified or ceased;
• for PSCs, the nature of their control, such as how many of the shares they hold;
• whether their identity has been verified with Companies House;
• any director disqualification.

We also hold the correspondence address each officer and PSC gave Companies House, and use it to show which people and companies share an address.

Where it comes from

All of it comes from Companies House: its bulk data products, its streaming service and its public API. Companies House publishes it under the Open Government Licence v3.0, and the law requires most of it to be on the public register. We don't add personal data from anywhere else.

What we never hold

• Day of birth. Companies House publishes only the month and year. Where a source does include a full date of birth (disqualification records, and some bulk officer records), we keep the month and year and drop the day.
• Home addresses. Companies House keeps home (usual residential) addresses on a restricted register that it does not publish, so we never receive them. If someone gave their home as their correspondence address, though, Companies House publishes it, and so do we.

Who is who

We only treat two records as the same person when a Companies House identifier says they are. Records that merely share a name and month and year of birth are shown as “possibly the same person”, never merged, unless someone has checked them by hand.

Keeping up with Companies House

• When Companies House updates a record, for example with a new correspondence address, our copy changes too, usually within a day.
• We keep history. Resigned appointments, ceased PSCs and dissolved companies stay on the site, with their end dates.
• When Companies House deletes a record from its register, usually because it was filed in error, we don't remove our copy automatically. If you find a record here that Companies House has deleted or suppressed, get in touch and we will take it down.
• Filed accounts documents are not stored here. When you open one, our server fetches it from Companies House at that moment, so your browser never contacts Companies House. Cloudflare may cache the document for a while.

Why we publish it

Our lawful basis is legitimate interests: making public-register data easier to search and connect, so anyone can see who runs and owns UK companies. That transparency is the reason the register is public in the first place.

If something is wrong

The official Companies House register is authoritative. If a record about you is wrong, correct it with Companies House, and our copy will follow. Companies House is also who to ask about removing your home address from older filings.

Objecting or asking for removal

You can object to us publishing your data, or ask us to remove it, even though it is on the public register. Get in touch through jasoncartwright.com with the address of the page (or pages) and what you would like us to do. We will look at each request and reply within one month.

Search engines

Company and people pages are open to search engines, and our sitemaps list every company and every person with two or more appointments. Search results and the admin are blocked in robots.txt. When we remove a page, search engines can take a while to drop it.

Other ways the same data is published

Every company and person page is also available as JSON and Markdown (see Data) and through our MCP server, and the officer and PSC records also go into public bulk files, rebuilt weekly. Removing a record here removes it from the pages, the JSON, the Markdown and the MCP server together (cached copies can take a few hours to expire), and from the bulk files when they are next rebuilt.

What we collect when you visit

Cookies

We don't set cookies for visitors. There is no account to make and nothing to sign in to. The only cookies are the session and security cookies for the staff-only admin.

Searches

We don't store what you search for. Your search words are part of the page address (for example /search?q=tesco), so they reach Cloudflare and our analytics just as any page address does.

Analytics

We use two cookie-free analytics services to count visits:

• Plausible, an EU-hosted service that sets no cookies. It receives the page address and the page you came from.
• fivebar, which also sets no cookies. Its tally script sends the page address, the page you came from, your window width, how fast the page loaded, how long it was in view and how far you scrolled, and the address of any link you follow to another site or any file you download.

Logs

• The OpenCompanies application does not log the pages you view, your IP address or what you search for.
• Cloudflare sits in front of the site and handles every request, so it sees your IP address and the page you asked for.
• The MCP server logs one line per request (see below). It never logs IP addresses, what was asked or what was searched for.

Other requests your browser makes

• opencommons.uk, the OpenCommons hub, serves the font, the shared stylesheet, and the map and chart code.
• maptiles.opencommons.uk serves the map tiles on company and address pages, from OpenFreeMap.

Both are part of OpenCommons, run by the same person as this site. Apart from these and the two analytics scripts, pages load nothing from elsewhere.

AI assistants (MCP) and the JSON API

• The MCP server and the .json pages need no key or sign-in. The MCP server is stateless: no cookies and no sessions.
• Each MCP request is logged as one line: the method, the tool, how long it took, the outcome, and the name the assistant gives for itself. Arguments and search text are never logged.
• The send_feedback tool sends us a short note about the tools, only once you have agreed to send it. A note containing an email address, an IP address or a web address with a query string is refused. Your IP address is never stored, only a keyed hash of it, used to limit how many notes one address can send. The note itself is never logged. Notes are deleted after 365 days.

Where data is processed

• The site and its database run on a Hetzner server in Falkenstein, Germany, managed with Coolify.
• Cloudflare sits in front of the site, and stores the bulk files.
• Plausible and fivebar receive the analytics described above.
• Companies House is where the register data comes from, and where filed documents are fetched from.

How long we keep it

• Register data: indefinitely, as a historical record, including resigned officers, ceased PSCs and dissolved companies, unless we remove it after a request.
• Raw copies of Companies House updates: 30 days after we process them, except notices that Companies House deleted a record, which we keep as the record of that deletion.
• Downloaded Companies House files: deleted once they are 3 days old.
• MCP feedback notes: up to 365 days.

Your rights

Under UK data protection law (the UK GDPR) you have the right to:

• ask what personal data we hold about you, and for a copy;
• have it corrected (for register data, correct it at Companies House and our copy will follow);
• object to us publishing it, or ask us to delete it or restrict how we use it.

To use any of these, get in touch through jasoncartwright.com. If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office.

Changes

We will update this page when what we do changes.

Last updated: 11 October 2026.