1. Who we are
1.1 MetaAshes is operated by MetaFenix Management Ltd, company number 16921717, registered office 3 Allens Mead, Gravesend, Kent DA12 2JA. We are the controller of the personal data described in this notice and are registered with the Information Commissioner's Office under reference ZC187194.
1.2 For any question about this notice or your personal data, please email contact@metaashes.co.uk or send an enquiry through our contact form, using the subject "Data protection request".
2. The data we collect
| Category | What it includes |
|---|---|
| Account data | Your email address, a salted and hashed version of your password (never the password itself), your checks balance, whether and when you confirmed your email address, and the date your account was created. |
| Email confirmation and password reset links | When you register, change your email address or ask to reset your password, we create a single-use link. We store only a one-way hash of it, never the link itself, together with the address it was sent to and when it expires. |
| Order and purchase data | The pack ordered, the number of checks, the amount, the order's payment reference, its status, the dates of the order and payment confirmation, and the time you gave the consents required at checkout. |
| Verification history | For each assessment: the name of the firm assessed, the website, FCA reference number and company number you entered, the product you selected and its pathway, the verdict, the risk level and the date. |
| Assessment answers | The details you enter during an assessment, including the firm's contact details, the offer, how you were approached, payment instructions and any notes you add. See section 4. |
| Uploaded documents | An email, letter or screenshot you choose to upload to pre-fill an assessment. See section 4. |
| Enquiries | Your name, email address, the subject and content of your message, and the account it was sent from, if any. |
| Partner billing | For an organisation with a paid partner licence: the billing email address it gives us, a purchase order number if it gives one, and each invoice we issue to it (number, dates, amounts, and when and how it was paid). The organisation's administrators and billing contacts can change the billing email address and purchase order number themselves, and each change is recorded. We do not ask for a postal address or for the organisation's bank details. |
| Partner licence applications and agreements | If you apply for a partner licence on behalf of an organisation: the organisation's registered name, company number and website, your name, job title and work email address, the administrator's and billing email addresses, and a purchase order number if given. We check the company number with Companies House and keep what it returned (the registered name and status) and the outcome of our other automatic checks, such as whether an email address belongs to a personal mailbox. When you accept the Partner Licence Agreement, we keep a copy of the exact text you accepted, its version, and your name, job title, email address and the time of acceptance. |
| Partner licence set-up and pilots | If you set up a partner licence from your account, we save the details you have entered and the step you have reached, so that you can return later and continue where you left off. You can change those details at any point before the licence is created. If you request a pilot, we record the request and the company number it was made for, because each company may have one pilot. While the pilot runs, we record its start and end dates, the assessments run under it and the date we told your organisation that the pilot was ending. |
| Partner licence membership | If an organisation invites you to use MetaAshes under its corporate licence: the organisation's name, your role (administrator, team user, read-only reviewer, billing contact or client) and any change to it, the date you joined, the date of each assessment you run under its licence, and, if you are a client, whether you have chosen to share your results with your adviser and when. |
| Business contact data | For organisations we may contact about working with us, chiefly firms authorised by the Financial Conduct Authority: the names and roles of senior individuals as published on the FCA Register and at Companies House, the business address and telephone number published there, and any business email address the organisation publishes on its own website. See paragraph 3.3. |
| Technical data | Your IP address, used temporarily to limit repeated sign-in attempts and assessments, and a session cookie that keeps you signed in. See our Cookie Policy. |
2.1 We do not collect special category data, and we ask that you do not include it in notes, enquiries or uploaded documents.
3. How we use it and why
3.1 UK data protection law requires a lawful basis for each use of personal data. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account, signing you in and keeping your account secure | Performance of a contract |
| Running assessments and keeping your verification history | Performance of a contract |
| Processing purchases, adding checks and handling cancellations and refunds | Performance of a contract |
| Drawing your assessments from an organisation's licence, and showing that organisation how its licence is used | Performance of a contract, for the licence that gives you access; and legitimate interests, in letting the organisation that provides your access see how much of its licence has been used |
| Assessing an application for a partner licence, checking the organisation with Companies House, and recording the acceptance of the Partner Licence Agreement | Performance of a contract, including the steps taken at your organisation's request before it is entered into; and legitimate interests, in confirming that a licence is offered to a genuine, active company |
| Saving a partner licence set-up so that it can be completed later, and running a pilot | Performance of a contract, including the steps taken at your organisation's request before it is entered into; and legitimate interests, in offering each company one pilot |
| Showing your adviser the assessments you choose to share | Consent, which you can withdraw at any time from your dashboard |
| Keeping financial records of purchases | Legal obligation |
| Responding to enquiries and complaints | Legitimate interests, in responding to people who contact us |
| Limiting repeated attempts and preventing misuse of the Service | Legitimate interests, in protecting the Service and its users |
| Contacting organisations about working with MetaAshes | Legitimate interests, in developing working relationships that help clients verify a firm before making a payment. We contact limited companies and limited liability partnerships only, using business contact details that the organisation or a public register has published |
| Establishing, exercising or defending legal claims | Legitimate interests |
3.2 We do not sell personal data or use it for advertising, and we do not send marketing communications to our customers.
3.3 Where we collect business contact details from a public register or from an organisation's own website, our first message says so, including where the details came from and how to object. If you object, we stop at once and keep only what is needed to make sure you are not contacted again.
4. Assessments and uploaded documents
4.1 Your answers are not stored in our database. They are held in the server's memory only for the duration of your session so that the assessment can run and the result can be displayed. Only the firm's name, the website, FCA reference number and company number you entered, the product and its pathway, the verdict, the risk level and the date are saved to your verification history. The exact score is never stored. A PDF copy of each report is kept for 48 hours so that you can download it again, and is then permanently deleted.
4.2 To produce the written findings, your assessment, including your answers and the results of the checks, is sent to our AI service provider. An uploaded document is sent to the same provider once, to read its contents and pre-fill the questionnaire for your review. We do not store uploaded documents.
4.3 To run the checks, details you enter about the firm, such as its name, website, company number and reference numbers, are sent to the official and public sources listed in section 5. These queries concern the firm, not you.
6. International transfers
6.1 Our AI service provider, Anthropic, PBC, and our hosting provider, Render Services, Inc., are based in the United States, so personal data, including assessment content and uploaded documents, may be processed outside the United Kingdom. Our email provider processes your address within the European Economic Area (Ireland), by our choice. Where personal data is transferred outside the United Kingdom, we ensure that it is protected by appropriate safeguards recognised under UK data protection law.
7. How long we keep data
| Data | Retention period |
|---|---|
| Account data and verification history | Until you delete your account |
| Sign-in sessions | Up to 30 days, and no more than 7 days without use, or until you sign out, sign out of your other devices, change your password or delete your account |
| Email confirmation links | 48 hours, then they stop working and are deleted |
| Password reset links | 60 minutes, then they stop working and are deleted |
| Assessment answers | Not stored; held in memory only during your session |
| PDF copy of a report | 48 hours, then permanently deleted |
| Uploaded documents | Not stored by us |
| IP addresses used for attempt limits | Held in memory for up to one hour; not stored in our database |
| Orders and purchase records | Six years, to meet our accounting obligations; unlinked from you if you delete your account |
| Partner invoices and payment records | Six years, to meet our accounting obligations |
| Partner licence applications that do not lead to a licence | 12 months from the application |
| Pilot requests that do not lead to a pilot | 12 months from the request |
| Pilot dates and the assessments run under a pilot | Six years, with the licence's usage records |
| Partner licence details saved during set-up | While your account is open; deleted when you delete your account |
| Accepted Partner Licence Agreements and the record of their acceptance | Six years after the licence ends |
| Records of changes to a partner licence (who changed what, when and why), including a client's choices to share or stop sharing results | Six years, with the licence's usage records |
| Licence usage records (the organisation, the person and the date of each assessment run under a licence) | Six years, to meet our accounting obligations; unlinked from you if you delete your account |
| Enquiries | Up to 24 months after the enquiry is resolved |
| Business contact data | Up to 12 months from our last contact, unless a working relationship follows. If you ask us not to contact you, your name, organisation and email address are kept on a suppression list for as long as we send business communications, solely to honour that request |
8. How we protect data
8.1 We use appropriate technical and organisational measures to protect personal data, including salted password hashing, secure HTTP-only session cookies, protection against cross-site request forgery, single-use assessment links, limits on repeated attempts and restricted access to our systems.
8.2 We also watch for repeated checks on the same target with small changes to the details given. This can pause an account, and you will need to contact us to have it released.
9. Automated processing
9.1 An assessment applies automated rules to information about a firm. It does not make decisions about you that produce legal or similarly significant effects. The decision whether to proceed with any firm remains yours.
10. Your rights
10.1 Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our use of your data;
- receive your data in a portable format.
10.2 From your account settings you can, at any time, update your email address, download a copy of the data we hold about your account in a portable format, sign out of your other devices or delete your account. If you are the only administrator of a partner licence that is still running, please contact us first so that another person can be made administrator or the licence can be ended. To exercise any other right, email contact@metaashes.co.uk or send an enquiry through our contact form, using the subject "Data protection request". We will respond within one month.
10.3 You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would, however, appreciate the opportunity to address your concerns first.
11. Other information
11.1 Children. The Service is not intended for anyone under 18, and we do not knowingly collect their personal data.
11.2 Changes. We may update this notice from time to time. The date at the top of this page shows when it was last updated.