Privacy Notice

Version 0.2. Last updated: 4 November 2026.

This notice explains how AIBI LTD handles personal data in ROE Overdue Watch (the "Service"). It covers our customers and their users, people we contact about the Service, and individuals whose details appear on the public register records we read.

Who we are

AIBI LTD (company number 16142632, registered office 80 Osborne Road, London, England, W3 8SR) operates the Service. Contact us about privacy at hello@aibisolutions.co.uk. AIBI LTD's registration with the Information Commissioner's Office is in progress; we will publish our registration number here once issued.

What data we use

• Entity numbers you give us: overseas entity IDs or company numbers, in single checks, uploaded lists and monitoring lists, with any references you add. These identify organisations, not people.
• Public register data: from the Companies House public register, entity details such as name, status, registration date, update statement dates and filing history. To count and flag registrable beneficial owners we read their published records, but we keep only counts and flags (for example how many are active, whether any is flagged as sanctioned, whether identity verification details are shown). We do not store or show beneficial owners' names, dates of birth, nationalities or addresses.
• Customer account data: an account key, your credit balance, monitoring plan and alerts, an alert email address if you give one, and the email you give us when you ask for a payment link. Account records also include activity dates, purchase references, the business confirmation and Terms version accepted when starting a purchase, and records of credit charges, returns and expiry.
• Payment data: from our payment provider, the order reference, amount, status and the name and email given at checkout. We never receive full card details.
• Technical data: your IP address, used to apply the daily free lookup limit and to protect the Service from abuse, and standard request logs kept by our hosting provider (IP address, time, page or endpoint, and response code).
• Correspondence: emails you send us and our replies.

Our role

• For your lists and the results produced from them, we act as your processor under the processing terms in section 11 of our Terms of Service. You are the controller.
• For public register data that we retrieve and briefly cache to run the Service, and for customer account, payment, technical and correspondence data, AIBI LTD is the controller.

Why we use it and our lawful basis

• Running checks and monitoring on public register data: legitimate interests (UK GDPR Article 6(1)(f)). Our interest, and our customers', is checking that an overseas entity involved in UK property is up to date on the Register of Overseas Entities, which exists to make this information public. We use only the fields needed for that purpose and keep only counts and flags about beneficial owners.
• Providing your account, credits, monitoring and alerts: contract (Article 6(1)(b)).
• Taking payment and keeping accounting and tax records: contract and legal obligation (Article 6(1)(c)).
• Free lookup limits, security and preventing abuse: legitimate interests in keeping the Service available and secure.
• Answering your messages: legitimate interests, or contract where you are a customer.
• Emailing business contacts about the Service: legitimate interests (see below).

We do not use personal data for advertising, we do not sell it, and we do not make decisions about individuals by automated means that have legal or similarly significant effects on them. Risk bands describe an entity's filing position on the register, not a person.

Individuals connected to an entity

If you are a beneficial owner or officer of an overseas entity, our results contain counts and flags derived from your public register record, not your personal details. We obtained this information from the Companies House public register. You can ask for access or object to our processing by contacting us, and we will consider your request. The underlying data remains on the public register, which we do not control; to correct it, contact Companies House.

How long we keep data

We apply the retention periods below. Account and financial records may remain after report or result contents are deleted.

• Completed single-check results: retained for 30 days after completion. Batch reports: retained until 30 days after the batch was created. Unresolved processing or credit-return claims are retained until they can be resolved. Check references, status, dates and credit accounting are kept separately from result contents.
• Monitoring lists, snapshots and alerts: kept while your plan or account is in use. Removed entities are deleted straight away. Delivered or acknowledged alerts are deleted after 12 months.
• Cached register responses: up to 24 hours.
• Free lookup counters (IP address and date): up to 30 days.
• Hosting logs: Railway provides us with 30 days of log history. Provider-held copies may be retained longer.
• Credit expiry does not automatically delete your account. We retain your account credential, account details, settings and credit records so that you can use the account again and recover payments or refunds that still need to be resolved. Reports, results and other data follow their separate retention periods below. You can contact hello@aibisolutions.co.uk to ask us to close your account or exercise your data protection rights. We may need to retain records required by law or needed to resolve outstanding payments, refunds or disputes.
• We keep payment, purchase and credit records needed to account for transactions, verify balances and fulfilment, prevent duplicate charges or credits, and resolve payments, refunds or disputes. Accounting records generally need to be kept for at least six years after the end of the last financial year they relate to, and longer where required by law. You can contact hello@aibisolutions.co.uk to request a review of the records we retain or exercise your data protection rights. We assess requests individually; closing an account or expiring credits does not automatically erase records still needed for these purposes. Reports and results follow their separate retention periods.
• Correspondence: up to 2 years after our last contact, unless needed for a dispute.
• Business contact records for outreach: see below.

Who we share data with

We do not sell data. We share it only with:

• Revolut Ltd, which takes card payments as an independent controller for payment data under its own privacy notice;
• Railway Corporation, which hosts the Service and its database as our processor. The application and its SQLite storage are configured in Amsterdam, Netherlands. Railway's own operational processing is primarily in the United States;
• Google (Google Workspace), which provides our email as our processor, for correspondence and any payment links we send you;
• Companies House, which receives the entity numbers we look up through its API; and
• professional advisers, insurers, and authorities or courts where the law requires it, or a buyer of our business under equivalent protections.

International transfers

Some providers are based in, or may access data from, outside the UK, including the United States. Where personal data is transferred outside the UK, we rely on UK adequacy regulations (including, where the provider is certified, the UK Extension to the EU-US Data Privacy Framework) or on the UK International Data Transfer Agreement or Addendum. You can ask us for details.

Security

Data is encrypted in transit, held on access-controlled infrastructure with restricted administrator access, and results are available only to the account that created them. Payment secrets are held only in our hosting environment and are never logged.

Your rights

You have rights to access, correct, erase, restrict or object to processing of your personal data, and to data portability where it applies. Where we rely on legitimate interests you can object at any time, and you can always object to marketing. Contact hello@aibisolutions.co.uk. We normally reply within one month. If your request concerns a list or result a customer uploaded, we will pass it to that customer as controller and help them respond.

Complaints

If you are unhappy with how we have used your personal data, or with how we have handled a request about it, you have the right to complain to us. Please come to us first so we can try to put things right: email hello@aibisolutions.co.uk with "Data protection complaint" in the subject, or write to AIBI LTD, 80 Osborne Road, London, England, W3 8SR. We will acknowledge your complaint within 30 days of receiving it, keep you informed of progress, and tell you the outcome without undue delay.

If you are not satisfied with our response, you also have the right to complain to the UK data protection regulator, the Information Commission, at ico.org.uk/make-a-complaint or on 0303 123 1113. You do not have to wait for our response before doing so. (The Information Commission took over from the Information Commissioner's Office on 30 September 2026 and is still known as the ICO.)

Business contacts we email

We may email people at conveyancing firms, lenders and company formation or filing agents about this Service, using business contact details published by their organisation. We rely on legitimate interests, email only incorporated bodies (limited companies, LLPs and similar) unless someone has agreed otherwise, keep just the name, business email, organisation and where we found the address, and delete unanswered records after 6 months. Reply "unsubscribe" or email hello@aibisolutions.co.uk and we will add you to our do-not-contact list, which we keep so that we do not contact you again.

Cookies and local storage

We do not use advertising or analytics cookies. While you use the website, it keeps your account key in memory so that it can send the requests you choose. If you select “Remember this device”, it also saves the key in this browser's local storage for later visits. This is optional: you can instead keep a copy of the key and enter it when needed. You can remove the saved key using the account controls or your browser settings. Removing it from the browser does not close the account or delete its server records. Keep a copy first if you still need access. The browser also saves purchase request details so you can recover an interrupted checkout on this device.

Changes to this notice

We will post any update on this page with a new date, and tell customers by email about significant changes where we have their address.