Privacy policy

This policy explains what personal data Regionsight keeps about the people who use it, why, who processes it, how long it is kept and what you can do about it.

Who is responsible

The controller of your personal data is [operator legal name], [registered address], registration no. [company registration number], established in [country of registration]. Contact us about anything in this policy at [contact e-mail address].

What we keep about users

• Account: your e-mail address and name, as given by your sign-in provider (Google, Microsoft, or e-mail and password). Passwords are handled by Firebase Authentication; we never see them.
• Organisation and team: your organisation's name, your role in it, and the invitations you send or receive.
• Orders and subscriptions: what you bought, when, the price and the invoice reference. Card and bank details are handled by Paddle; we never see them.
• Reports: the reports you order, the inputs you chose (sectors, regions, priorities) and the data release each report was built from.
• Watchlists, alerts and saved searches: the companies and regions you follow and the alerts you set.
• API keys: a hashed copy of each key, its name and usage counts.
• White-label settings: the logo, colours and firm name you upload for branded reports.
• Technical data: IP address and request details in server and security logs, and error reports, kept for a short period to keep the service running and safe.

The company data we publish

Regionsight publishes data about companies and places from official open sources. It contains no personal data: no names of administrators, shareholders or owners, no sole traders, and no e-mail addresses or phone numbers of companies.

Why, and on what legal basis

• To provide the service (your account, reports, subscriptions and the My reports page): performance of our contract with you (GDPR art. 6(1)(b)).
• Legal obligations, such as keeping invoices and tax records (art. 6(1)(c)).
• Security, preventing abuse and fixing errors: our legitimate interest in a safe, working service (art. 6(1)(f)).
• Analytics: only with your consent (art. 6(1)(a)). We use no analytics today; if we add it, we ask you first.

Who processes your data

We use these service providers, who process data on our behalf under data processing agreements:

• Amazon Web Services (Frankfurt, Germany): hosting of our servers, database and report files.
• Cloudflare: delivery of the website, protection against attacks, and storage of data releases.
• Google (Firebase Authentication): sign-in and password handling.
• Paddle: checkout, payments, invoices and VAT, as the reseller of our plans and reports.
• E-mail delivery provider: sends account, invitation, alert and report e-mails.
• Sentry: error monitoring, without names or e-mail addresses.

We never sell your personal data.

International transfers

Some providers (Google, Cloudflare, Paddle, Sentry) are based in, or may access data from, countries outside the EU, such as the United States or the United Kingdom. These transfers are covered by an adequacy decision, including the EU-U.S. Data Privacy Framework, or by the European Commission's standard contractual clauses.

How long we keep it

• Account, organisation, reports and the My reports page: until you delete your account. A deleted account is hard-deleted after 30 days.
• Orders and invoices: as long as tax law requires.
• Server and security logs: up to 30 days; they contain no names or e-mail addresses.
• Backups: deleted data can remain in encrypted backups until they expire (up to 30 days).

Your rights

You can ask us at any time for a copy of your data in a portable format, to correct or delete it, or to restrict or object to its processing, by writing to [contact e-mail address]. We answer within one month.

You also have the right to complain to a data protection authority, in particular in the EU country where you live or work, or to the [lead data protection authority].

Children

Regionsight is a business service and is not meant for children under 16.

Cookies

The cookie policy lists what we store in your browser.

Read the cookie policy

Changes

If we change this policy, we update the date at the top. For important changes we tell you by e-mail before they apply.