Privacy Policy
Last updated: September 2026
1. Who we are
FilingPulse is operated at www.fillingpulse.co.uk. We help UK businesses track Companies House and HMRC compliance deadlines. For privacy questions, contact us at privacy@fillingpulse.co.uk.
2. What data we collect
We collect only what is needed to provide the service: Authentication • Your email address — used to send a one-time sign-in code (OTP). The code is a 6-digit number, valid for 15 minutes, and is discarded after use. We store a hashed (SHA-256) version of the code temporarily; the plaintext code is never stored. • Session token — after you verify your code, we create a server-side session. A hashed version of the session token is stored in our database with a 7-day expiry. Your browser receives a secure, httpOnly cookie containing the token; this cookie is not readable by any JavaScript on the page. Monitoring • Your company number and company name — to retrieve filing deadlines from the Companies House public API. • Your alert preferences — whether you are VAT-registered or have employees, so we calculate the correct deadlines. Anonymous usage • When you use the free compliance check, we log the company number searched and the result status. We also log your IP address to detect abuse. IP addresses in the check log are deleted (nulled) after 30 days. • We record analytics events (such as starting a check, completing a check, or signing up to monitoring) to understand how the service is used. IP addresses in analytics records are deleted after 90 days. • After a free compliance check you may optionally submit a thumbs-up/thumbs-down rating and a short comment. This is entirely voluntary, requires no account, and is stored with the company number only (not your IP or any personal identifier). We do not collect payment information, passwords, or any other personal data.
3. Why we collect it
Your data is used only to: • Verify your identity via a one-time email code so you can access your dashboard securely. • Send you deadline reminder emails at 90, 30, 14, 7 and 1 day before each filing date, and once if a deadline becomes overdue. • Display your compliance dashboard when you visit the site. • Measure aggregate service usage so we can identify problems and improve the product. We do not use your data for advertising, profiling, or any other purpose.
4. Legal basis (UK GDPR)
We process your data on the basis of your consent, given when you tick the consent checkbox before saving your alerts. You can withdraw consent at any time by contacting us.
5. Who we share data with
We use the following third-party processors to operate the service. We do not sell your data to anyone. • Supabase (supabase.com) — our database provider. Your email, session tokens (hashed), company number, alert preferences, check logs, and analytics events are stored on Supabase servers. • Resend (resend.com) — our email delivery provider. Your email address is passed to Resend solely to deliver sign-in codes and deadline alert emails. • Vercel (vercel.com) — our hosting provider. Handles web requests and runs the service. Vercel may log IP addresses in standard server access logs. • Companies House API (company-information.service.gov.uk) — a UK government public API. We send your company number to retrieve filing deadline data. This is public information.
6. How long we keep your data
• Your account (email, company, alert preferences): retained for as long as you are subscribed to alerts. • Session tokens: expire after 7 days and are deleted automatically. • One-time sign-in codes: expire after 15 minutes and are discarded after use. • IP addresses in the check log: deleted (nulled) after 30 days. • IP addresses in analytics records: deleted after 90 days. If you request deletion of your account, we will remove your record from our database within 7 days.
7. Your rights
Under UK GDPR you have the right to: • Access the data we hold about you. • Correct inaccurate data. • Request deletion of your data ("right to be forgotten"). • Withdraw consent at any time. • Lodge a complaint with the ICO (ico.org.uk). To exercise any of these rights, email us at privacy@fillingpulse.co.uk with the subject line "Data Request".
8. Cookies and browser storage
FilingPulse uses one first-party cookie: • fp_session — a secure, httpOnly session cookie set after you sign in. It contains a session token that identifies your authenticated session. It is not a tracking cookie, contains no personal information directly, and expires after 7 days. It is not accessible to JavaScript running on the page. We do not use advertising cookies, tracking cookies, or any third-party analytics cookies. We do not use Google Analytics, Meta Pixel, or similar tools.
9. Security
• Passwords: we do not use passwords. Authentication uses one-time codes delivered by email. • Session tokens: stored as SHA-256 hashes in our database. The raw token is only ever held in your browser cookie. • OTP codes: stored as SHA-256 hashes. The plaintext code is sent to your email and never stored. • All traffic is served over HTTPS (TLS 1.2+). • API keys and server credentials are never exposed to the browser.
10. Changes to this policy
If we make material changes to this policy we will update the date at the top of this page. Continued use of the service after changes constitutes acceptance.