Privacy policy

The order form collects your name, email address, organisation and country, the report type and tier you select, the purpose you state for the report, and your confirmation of the permitted-use statement. It also collects the subject details you supply: legal or personal name, a second subject name for combined reports, country, registration number, date of birth, nationality and any free-text notes you add.

Each order is stored against a reference (for example SCX-1A2B3C4D) that appears in your confirmation email and, for Full reports, in the payment link we send once coverage is confirmed. The price is calculated and stamped on our server from our published price list; it is never taken from your browser.

If you create an account to access reports, our authentication provider stores your email address and a hashed credential. We also record standard server logs — IP address, browser type, pages viewed — for security and aggregate site measurement.

Payments are processed by Stripe. Card numbers, expiry dates and security codes are entered directly into Stripe's payment form and are never transmitted to, or stored on, our systems. We hold no card data at any point.

What we do receive and store against your order is the Stripe customer identifier, the checkout session and payment intent identifiers, the invoice identifier and hosted invoice link, the amount charged, the currency, whether the payment succeeded and the time it settled. Stripe also calculates and collects any sales tax or VAT due, which requires it to process your billing address and country.

Stripe acts as an independent controller for fraud prevention and regulatory purposes and processes your data under its own privacy policy. We use these records to issue invoices, to reconcile payments, to handle refunds and chargebacks, and to meet tax and accounting obligations.

To prepare a report we process identifying information about the subject: legal or personal name, registration number, date of birth, nationality, addresses, directorships and shareholdings, company status from official registers such as UK Companies House, entries on sanctions and politically exposed person lists maintained by OFAC, the United Nations and the European Union, records in the ICIJ Offshore Leaks database, litigation records and published media.

Screening is performed by matching the name and identifiers you supply against these datasets. Matches are graded by confidence, and every match — including those dismissed as false positives — is recorded in the research file so the conclusion can be evidenced later.

This data comes from public registers, licensed commercial databases and the information you provide. We do not obtain data through pretexting, unauthorised access or any unlawful means.

Every report includes at least one adverse media search. An analyst runs structured queries — typically the subject's name combined with terms such as fraud, investigation, lawsuit or sanction — against public web and news sources, assisted by an automated search and page-retrieval service that returns publicly accessible pages for review.

For each search we record the exact query used, the source searched, the date and time of the search, the analyst who ran it, and for each result kept: a short factual summary, the source URL, the publication date and an analyst assessment of whether the item is material to the subject. Searches that return nothing relevant are logged as such, so the report can state that a search was performed and found nothing rather than staying silent.

Adverse media results are third-party allegations and reporting. We record them as published, attribute them to their source and do not present them as findings of fact. If an item cannot be reliably tied to the subject, it is excluded and the exclusion noted.

Screening matches are generated automatically by name-similarity scoring. Depending on the report tier, the screening outcome and the analyst workflow, a report may be auto-composed from clean results or reviewed and edited by an analyst. Adverse media searches are manually run and logged before a report is finalised. Automated matches are not used by Scrutinex to make a decision with legal or similarly significant effect about a person.

We process client data to accept, prepare and deliver the report you ordered, to take payment for it and to maintain records of the engagement. We process subject data for the legitimate interest of our client in verifying a counterparty before entering a commercial relationship, and for the prevention of fraud and financial crime. We do not use subject data for marketing, and we do not sell data to anyone.

We share data with service providers who act on our instructions under contract, and only to the extent needed to deliver the service:

• Stripe — payment processing, invoicing and tax calculation.
• Lovable Cloud — database, authentication and encrypted storage of report files.
• Resend — delivery of transactional email such as confirmations and report links.
• Firecrawl — retrieval of publicly accessible web pages during adverse media research.
• Sanctions, PEP, corporate registry and offshore data providers, including OFAC, the United Nations, the European Union, UK Companies House and the ICIJ Offshore Leaks database.
• Google — tag management and aggregate website or advertising measurement when a Google Tag Manager container is enabled on the site.

We disclose data to authorities where legally required. We do not disclose to the subject of a report that a report has been commissioned, except where verification with contacts you supplied necessarily involves contacting them.

Completed reports, the underlying research file, the screening record and the adverse media search log are retained for seven years, which reflects the period over which a due diligence decision may need to be evidenced. Order, invoice and payment records are retained as required by applicable tax and accounting law. You may ask us to delete your account data at any time, subject to those retention obligations.

Data is encrypted in transit and at rest. Order and report tables are protected by row-level access rules so that a client can only reach their own records. Report PDFs are held in a private storage bucket and delivered by expiring signed link rather than open attachment; links expire after seven days. Access to research files is restricted to the analysts working on them. We do not store payment card details on our systems.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to our processing of your personal data, and to receive a copy in portable form. Report subjects in jurisdictions with data protection legislation such as the GDPR may exercise those rights in relation to data we hold about them.

Submit requests to support@scrutinex.com. We respond within 30 days. Where a request would require us to disclose the identity of a client who commissioned a report, we will consider that request against our confidentiality obligations and applicable exemptions, and explain our position.

We operate globally, and data may be processed in countries other than your own, including by our infrastructure providers. Where personal data is transferred out of the European Economic Area or the United Kingdom, we rely on standard contractual clauses or another lawful transfer mechanism.

We use the cookies needed to keep you signed in and to measure aggregate site usage. We do not sell browsing data.

If we later run advertising, we may load a tag manager that sets measurement and advertising cookies from Google in order to count enquiries generated by an advertisement. Those cookies are used for campaign measurement only, are never combined with the contents of a report or the identity of a report subject, and can be blocked in your browser without affecting your ability to order or receive a report. This section will name the specific services in use before any such tag is enabled.