Who we are
Disclosure is the trading name of the operator of disclosure.co, app.disclosure.co and admin.disclosure.co. We are based in the United Kingdom. For UK GDPR and the Data Protection Act 2018, we are the controller of personal data processed through those sites.
Write to us at team@disclosure.co for any privacy, legal or other enquiry. We will give you a postal address on request. You can also use the contact form.
This notice describes current processing. It is written to meet the information duties in UK GDPR Articles 13 and 14. It is not legal advice to you.
Personal data we collect
Account and sign-in
When you create an account we store your email address, first name, last name, password hash (we do not store the password itself), chosen region preference, and whether you asked for product updates. If you confirm the address we record the time of verification.
If you sign in with Google we receive the identifier, email address and basic profile fields Google returns for the openid and email scopes. We do not receive your Google password. LinkedIn sign-in, when configured, works the same way for that provider.
We also store session tokens, a device label from your browser’s user-agent, and a record of active sessions so you can inspect and revoke them in Sessions & security.
Enquiries and founding membership
Demo and contact forms store your name, email, optional organisation, selected region and message so we can reply. Submitting a form does not subscribe you to marketing or book a meeting. Do not send passwords, identity documents or confidential research through those forms.
A founding-member reservation is linked to your verified account. We record the campaign, selected region, the time you joined, your acknowledgement of the offer and whether you received a place or joined the waiting list. Public availability shows aggregate counts, not names or email addresses.
Workspace activity
When you use the research application we store the work you create: watchlists, projects, notes, organisation memberships, invitations, display preferences and similar account settings. You can export or reset many of those preferences in Settings.
Technical data
Our servers and the hosting provider record ordinary request logs (IP address, time, path, user-agent) to operate, secure and debug the service. A signed visitor cookie lets the application recognise a returning browser without asking you to sign in.
Data we do not collect from you for advertising
We do not sell personal data. We do not use advertising cookies or third-party advertising pixels. Signed-out visitors are not added to a marketing list. Optional product-update emails are sent only if you tick the box on sign-up or later ask us to send them.
Why we use personal data
| Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Create and operate your account, sign you in, and provide the research workspace | Contract (Art. 6(1)(b)) |
| Reply to a demo or contact enquiry | Legitimate interests (Art. 6(1)(f)) — responding to a request you made |
| Optional product-update emails | Consent (Art. 6(1)(a)), and PECR for electronic mail. You can withdraw at any time by writing to team@disclosure.co |
| Security, abuse prevention, session management and audit of operator actions | Legitimate interests (Art. 6(1)(f)) — keeping the service and other users safe |
| Display information that already appears in public SEC filings, including names of officers and directors where the filing includes them | Legitimate interests (Art. 6(1)(f)) — informing users about public market disclosures. See below |
| Meet a legal duty if one applies (for example a valid request from a UK authority) | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests we have considered your rights and expectations. You can object. See Your rights.
People named in public filings
US SEC filings are public records. Some of them — including insider and beneficial-ownership forms — name living individuals, their role, and reported holdings. We store a copy of those filings and may present that information in the product.
We do not collect that information from the named person. The source is the public register. We cannot change the official filing on EDGAR. If you are named in a filing and want to discuss how we present our copy, write to team@disclosure.co. We will consider objections and erasure requests. Where the filing itself is the public record, we may have to keep showing the filed facts or explain why we cannot remove them from the source document.
Cookies and similar technologies
The Privacy and Electronic Communications Regulations 2003 (PECR) sit alongside UK GDPR. Cookies that are strictly necessary to provide a service you asked for do not need consent. We do not currently set advertising or analytics cookies that would require a consent banner.
| Cookie | What it does | Type |
|---|---|---|
fh_session | Keeps you signed in. HttpOnly. | Strictly necessary |
fh_oauth_state | Protects the Google or LinkedIn sign-in round-trip for ten minutes. | Strictly necessary |
fh_visitor | A signed anonymous browser id used to operate the site securely. | Strictly necessary |
fh_region | Remembers the region you selected at sign-in. It does not move your data to another country. | Functional, set because you chose a region |
| Launch announcement preference | Remembers that you dismissed the founding-member banner. | Functional, set because you dismissed it |
| Operator console cookie | A separate HttpOnly cookie for platform operators only. | Strictly necessary for that console |
Google and, if configured, LinkedIn will set their own cookies on their domains when you use those sign-in buttons. Their notices apply to that step.
You can block cookies in your browser. If you block the session cookie you will not stay signed in.
Who we share data with, and transfers
We use processors to run the product. They may process personal data only on our instructions:
- Render — application hosting.
- Cloudflare — content delivery and object storage (R2) for the filings lake.
- Google — only if you choose “Continue with Google”. Google is an independent controller for your Google account.
- Our email relay — sign-in links, verification, invitations, watchlist notices and any update emails you asked for.
- xAI (or OpenAI, where a deployment is configured for it) — only when you use optional AI features such as Winslow or cited research. Your question and the filing passages it needs are sent to the provider to produce an answer. We ask the provider not to store the request, but that is a request setting, not a guarantee about their retention.
- Slack — internal operational alerts for our team. Alerts are written to leave out customer names, email addresses and research content.
- Brandfetch — some company logos load from Brandfetch’s servers, so your browser’s IP address and user-agent reach them when a logo is shown.
- Adobe Fonts — the public marketing pages load fonts from Adobe, so your browser’s IP address and user-agent reach Adobe when you open them.
Authorised platform operators can see enquiry forms, founding-member status and, where the product requires it, account records needed to support you. Ordinary team members cannot open the operator console.
We may disclose data if the law requires it, or to protect the service, users or another person’s rights.
International transfers
All login regions currently use the same Disclosure deployment. Selecting United Kingdom, Europe or another region is a preference. It does not create a regional copy of your data.
Hosting and storage providers may process data in the United States and other countries outside the UK. Where UK GDPR requires a transfer mechanism we use the mechanism the provider offers (for example the UK Extension to the EU-US Data Privacy Framework where a provider is certified, or the UK International Data Transfer Agreement / Addendum). Ask team@disclosure.co if you want the current list of processors and transfer tools.
How long we keep it
- Account data — for as long as the account stays open, then for a short period needed to close it, resolve disputes or meet a legal duty.
- Sessions — until you sign out, revoke the session, or it expires.
- OAuth state cookies — ten minutes.
- Enquiries — for as long as needed to answer you and keep a support record.
- Founding-member records — for the life of the offer and any later entitlement it creates.
- Server logs — for a limited operational period.
- Copies of public SEC filings — for as long as we offer that coverage. Those documents remain public at the SEC regardless of our copy.
When we no longer need personal data we delete it or irreversibly anonymise it.
Your rights
Under UK GDPR you can ask us to:
- access the personal data we hold about you;
- correct inaccurate data;
- erase data in the cases the law allows;
- restrict processing;
- receive account data you provided, in a portable form, where the basis is contract or consent and the processing is automated;
- object to processing based on legitimate interests;
- withdraw consent, where we rely on consent (this does not affect processing already carried out);
- complain to the Information Commissioner’s Office.
Write to team@disclosure.co. Include enough detail for us to find your account or enquiry (for example the email you use, or an enquiry reference). Do not send identity documents unless we ask. We may need to confirm it is you. We will respond within one month, or explain if we need more time.
The service is intended for people aged 18 or over. We do not knowingly create accounts for children. If you believe we have data about a child, tell us and we will delete it.
We do not use your personal data for automated decisions that produce legal or similarly significant effects about you.
Contact and complaints
Privacy, legal and all other communications: team@disclosure.co.
You can also complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint. The ICO is the UK supervisory authority. We would rather fix the problem first if you are willing to write to us.
If this notice changes we will update this page and the date above. If a change is material we will also email the address on the account where we can.
Related pages: Terms of Service, Security, Contact.