Compliance and regulatory framework

1. Regulatory position

1.1 MetaAshes is operated by MetaFenix Management Ltd, company number 16921717, registered in England and Wales.

1.2 MetaAshes is an information service. It does not recommend investments, arrange or manage investments, or hold or transfer client money, and MetaFenix Management Ltd is not authorised by the Financial Conduct Authority.

1.3 MetaAshes is independent of, and not endorsed by, the Financial Conduct Authority, Companies House, HMRC, the Information Commissioner's Office or the Foreign, Commonwealth & Development Office. We use the information these bodies publish; we do not speak for them.

1.4 MetaAshes is not a law enforcement agency, investigator or recovery service, and cannot act on behalf of anyone who has lost money.

2. Data sources

2.1 Assessments draw on the following official and public sources, retrieved directly from each source at the time of the assessment or from a recently refreshed copy:

• FCA Financial Services RegisterRefreshed hourly
• Companies HouseRefreshed hourly
• UK Sanctions ListRefreshed daily
• HMRC Alcohol Wholesaler Registration SchemeRefreshed daily
• HMRC VAT Number CheckerQueried live
• HMRC-Approved ISA ManagersRefreshed by hand
• Scotch Whisky Association Members DirectoryRefreshed by hand
• HMRC Supervised Business RegisterRefreshed by hand
• Ofgem Feed-In Tariff RegisterRefreshed by hand
• Carbon Credit Project RegistriesRefreshed by hand
• HMRC Money Laundering PenaltiesRefreshed daily
• Information Commissioner's OfficeRefreshed daily
• OpenFIGIRefreshed hourly
• Domain RegistriesRefreshed hourly
• Mail And Web RecordsQueried live
• Ofcom Numbering DataUpdated monthly

2.2 Information Commissioner's Office register data is used under the Open Government Licence v3.0. We do not alter the substance of source data, and we do not guarantee its accuracy, which remains the responsibility of the publishing body.

3. Data protection

3.1 MetaFenix Management Ltd is registered with the Information Commissioner's Office under reference ZC187194 and processes personal data in accordance with the UK General Data Protection Regulation and the Data Protection Act 2018.

3.2 The Service is designed to collect as little personal data as possible:

• assessment answers are held in memory only for the duration of a session and are never written to our database;
• uploaded documents are read once to pre-fill an assessment and are not stored by us;
• verification history is limited to the firm's name, website and reference numbers, the product, the verdict, the risk level and the date;
• IP addresses used to limit repeated attempts are held in memory for no more than one hour;
• only strictly necessary cookies are used, fonts are self-hosted, and no analytics or usage tracking is enabled.

3.3 Users can change their email address, change their password or permanently delete their account at any time. Full details of the data we process, our lawful bases, retention periods and your rights are set out in our Privacy Notice and Cookie Policy.

4. Security controls

• Passwords are stored only as salted PBKDF2-SHA256 hashes and are never stored or logged in readable form.
• Sign-in sessions use randomly generated identifiers held in secure, HTTP-only cookies, and are revoked on sign-out, password change or account deletion.
• Form submissions from other websites are refused, protecting accounts against cross-site request forgery.
• Each assessment is opened with a single-use, time-limited link, and a check is deducted atomically only when the assessment runs.
• Repeated sign-in attempts, enquiries and assessments are rate limited.
• Communication between the website and the assessment engine is authenticated with a shared secret that is never exposed to browsers.

5. Assessment integrity

5.1 Every score is calculated from 165 defined scoring rules across 69 checks. Identical information always produces an identical score.

5.2 The score is calculated before any artificial intelligence is involved. AI is used only to draft the plain-English explanation of findings that have already been determined, and to read uploaded documents for the user to review. A consistency review flags contradictions but cannot change a score.

5.3 Our rules include safeguards against false conclusions, so that a genuine firm is not marked down for trading under a registered trading name, for recent authorisation or for sharing a common name with another person or company.

5.4 Alongside the scoring rules, 8 cross-references, the fairness checks named on our home page, exist to protect genuine firms from false findings. They can only take a finding away, and none of them can raise a score. What each one relies on is recorded in our rule book rather than published here, so that it cannot be studied and imitated, and it is provided to a regulator on request.

• Email addressProtects a genuine firm from a false finding on the domain its email address sits on.
• Email addressProtects a genuine firm from a false finding on the type of email address it uses.
• Email addressProtects a genuine firm that operates from more than one email domain.
• FCA Warning ListA firm whose name is being cloned is not held responsible for the clone. The reader is still told that clones exist.
• Firm Reference NumberProtects a genuine firm from a false finding on its reference number.
• ICO registrationProtects a genuine firm from a false finding on its data protection registration.
• Telephone numberProtects a genuine firm from a false finding on which of its telephone numbers is used.
• Website against the registerProtects a genuine firm that operates from more than one website.

5.5 Some rules are weighted in proportion to what a firm can prove: where a firm can show independent evidence, certain findings carry less weight. Identical evidence always produces an identical result. These adjustments reduce a finding. None can increase a score.

6. Fairness and right of reply

6.1 Assessments are private. Each is visible only to the user who ran it, and MetaAshes does not publish ratings, lists or verdicts about firms.

6.2 Users agree under our Terms of Use not to present an assessment as a statement of fact that any firm or individual has acted unlawfully.

6.3 A firm or individual who believes that our rules have produced an unfair result, or that a source we rely on contains an error, may contact us. We will review the concern and, where appropriate, correct our rules. Errors in official registers must be corrected by the publishing body.

7. Payments and consumer rights

7.1 Checks are sold as one-off packs with no subscription or recurring charge. Payment is made by card on the secure payment page of Fondy Ltd, registered with the Financial Conduct Authority as an electronic money institution (FRN 900705). We do not receive or store card details or online banking credentials.

7.2 Each order carries a unique payment reference, and checks are added only after the full amount has been confirmed as received against that reference. The consents given at checkout are recorded with the order.

7.3 Consumers may cancel within 14 days of purchase and receive a full refund, provided no check from that purchase has been used. Full details are set out in our Cancellation and Refund Policy.

8. Reporting fraud

8.1 If you believe you have been defrauded, contact your bank immediately, then report the matter to Report Fraud (formerly Action Fraud) on 0300 123 2040 (in Scotland, Police Scotland on 101) and to the Financial Conduct Authority. Reports of suspected clone firms can also be sent to us at contact@metaashes.co.uk or through our contact form.

9. Complaints

9.1 Complaints about the Service can be made at contact@metaashes.co.uk or through our contact form. Complaints about our handling of personal data may also be made to the Information Commissioner's Office.