UK and Ireland Firm Check privacy notice
This notice explains how Softblues Solutions Ltd handles personal data when you or your AI assistant use UK and Ireland Firm Check, our free MCP server at firmcheck.softblues.io. For the rest of softblues.io, our main privacy policy applies.
The short version: we receive only the tool request your assistant sends, such as a company name or VAT number. We pass it to the relevant public register and return the answer. Nothing is kept beyond a short cache and minimal technical logs. We never see your conversation.
1. Who we are
Softblues Solutions Ltd is the controller for the personal data described here. We are a company registered in England and Wales under number 14434878, with our registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Contact for anything in this notice: privacy@softblues.io.
We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number C2066974.
2. What we receive when the service is used
Tool requests. Your AI assistant sends us the name of the tool it wants to use and the details needed to run it. That means a company name or number, a VAT number or, once FCA checks are live, a firm reference number. We do not receive your conversation, your name, your email address or your account details with Claude, ChatGPT, Microsoft or any other assistant.
Technical data. Like any website, our hosting provider sees the IP address of each request and basic request details such as the time. We use the IP address to apply rate limits and to stop abuse. In our own logs we keep only a one-way hash of it, salted with a value that changes every day, so we cannot work out who you are from it.
No cookies. The MCP server does not set cookies or use tracking.
3. Personal data inside register results
Some register records name people. Examples are company directors, persons with significant control and, once FCA checks are live, people approved by the FCA. We return only their name, role or type of control, and the relevant dates. We never return dates of birth, nationalities, occupations or anyone's home or service address.
This data comes from public registers kept by law: Companies House, HMRC, the Irish Companies Registration Office, the European Commission's VIES service and the FCA. We do not build our own copy of anyone's details. Results may sit in a short-lived memory cache for up to 15 minutes to avoid repeat calls to the registers, and are then discarded.
If you are named in a register and something is wrong, the register itself can correct it. Companies House, for example, has its own process. We hold no separate record to change.
4. How we use the data
We use it to:
- answer the tool request and return the result to your assistant
- keep the service secure and available, for example by applying rate limits and spotting abuse
- count overall usage, such as the number of calls per tool per day
We do not use it for marketing or profiling, we do not sell it, and we do not use it to train AI models.
5. Our lawful basis
We rely on legitimate interests under Article 6(1)(f) of the UK GDPR.
- Running the service: our interest, and yours, is offering a free and quick way to check a business counterparty in public registers.
- Security: our interest is keeping the service secure and available for everyone.
- Register data about people: it is already published by law so that the public can check who runs a company. We show the minimum needed for that purpose.
We have balanced these interests against the rights of the people concerned, and we keep the data we handle to a minimum for that reason.
6. Who we share data with
- The public registers you query. We send them the identifier needed to answer your request, such as a company number to Companies House or a VAT number to HMRC or VIES. We do not send them your IP address or anything about you.
- Our hosting provider, Netlify, Inc., which runs the server for us as a processor under a data processing agreement. The server runs in Netlify's London region.
- Supabase, Inc., which stores our copy of the Irish company open data from the Companies Registration Office in its Ireland (EU) region, as a processor under a data processing agreement. Search terms for Irish companies pass through it. It holds no data about users.
Your AI assistant provider (for example Anthropic, OpenAI or Microsoft) is a separate controller for your conversations under its own terms. We have no access to them.
We will disclose data if the law requires it.
7. International transfers
The server runs in London. Netlify is a US company, so some processing, such as platform logs and support access, may happen outside the UK. Where it does, Netlify's data processing agreement provides the safeguards the UK GDPR requires. Netlify relies on the UK Extension to the EU-US Data Privacy Framework and, where that does not apply, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
The Irish company index is stored in Ireland, which the UK treats as adequate. Supabase is a US company; where its staff or systems process data outside the UK or EEA, its data processing agreement provides the required safeguards.
8. How long we keep data
| Data | How long |
|---|---|
| Tool request and register result | Not stored. Held in memory only while the request runs, plus a cache of up to 15 minutes |
| Our service logs (tool name, status, time taken, daily-hashed IP) | Up to 30 days |
| Hosting provider's platform logs | Under Netlify's retention settings for our plan. Netlify keeps function logs for between 24 hours and 7 days, depending on the plan |
| Emails you send us for support | As long as needed to deal with your request, then under our main privacy policy |
9. Your rights
Under the UK GDPR you have the right to access, correct or erase your personal data. You can also restrict or object to how we use it. Email privacy@softblues.io. We do not store IP addresses in a readable form and do not link requests to people, so in most cases we hold nothing we can connect to you. We will tell you if that is the case.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would appreciate the chance to sort it out first.
10. Security
All traffic uses HTTPS. The server is read-only and has no user accounts. Register API keys are held as encrypted secrets and never appear in code or logs. Access to the hosting account is limited to Softblues staff who need it.
11. Children
The service is meant for businesses and is not aimed at anyone under 18.
12. Changes to this notice
If we change how the service handles data, we will update this notice and the date below. Significant changes will also be noted on the service page.
Last updated: 22 October 2026