Privacy
Privacy policy
What we process, why, for how long, and who it's shared with. Last updated: September 2026.
Who controls this data
Subfocus Technologies Ltd (a company registered in England and Wales (company number 14775280), registered office c/o Savvy Accountancy, Kenward House, High Street, Hartley Wintney, Hampshire, RG27 8NY) operates whatdotheyown.com and is the data controller for the processing described on this page. Questions or requests about your data can be sent to info@bricksmart.ai.
Your account and payments
When you create an account we store your email address and the one-time sign-in codes we email you (each discarded once used), so we can keep you signed in and contact you about your account. If you subscribe to Professional, Stripe handles all card details on our behalf: we never see or store your full card number. We keep your Stripe customer and subscription identifiers, your plan and its status, and the transaction record Stripe holds (amount, date, plan), so we can match payments to your account and send billing emails. Lawful basis: performance of our contract with you, and compliance with our legal obligations (for example tax and accounting law).
Public register data we display
Company and individual information shown on the tree (officer names, roles and appointment dates, month and year of birth, nationality, service address, PSC names, nature of control and notification dates, registered office address, and, for Professional subscribers, financial and charges data and property title information) is read live from UK public registers: Companies House and HM Land Registry. We process this personal data on the basis of legitimate interests: making public register information usable in one place for the business purposes described on our use-cases pages. We do not fetch or display exact property addresses or title numbers for any viewer without an active Professional subscription.
Data you give us directly
If you submit the contact form (for example to ask about Professional access), we collect your email address and, optionally, your firm type, company name and what you're interested in. We also record a one-way cryptographic hash of your IP address for abuse prevention; we do not store the IP address itself. We process this on the basis of your consent in submitting the form and our legitimate interest in responding to it.
How long we keep it
Public register data is re-read from the source register on a regular cadence rather than permanently stored by us; a response may be cached for a matter of hours (typically up to 24) purely to avoid re-querying the source register on every visit. We keep account data for as long as your account is open, and for a reasonable wind-down period after closure, then delete or anonymise it. Certain records, such as transaction history, invoices and security logs, we keep for longer to comply with tax, accounting and security obligations. Contact form submissions are retained so we can follow up on the enquiry; you can ask us to erase yours at any time using the contact details above.
Who we share it with
We use a small number of processors to run the service: Vercel (hosting, bot mitigation and logs), Supabase (sign-in and database hosting), Stripe (payment processing), Upstash (caching and rate-limiting), and Resend (sign-in codes, billing emails and contact form notifications). These providers process data on our instructions and do not use it for their own purposes. We may also share data with our professional advisers, with the authorities where we are legally required to, and with a buyer if the business is ever sold, merged or restructured, who would be required to honour this policy. We do not sell personal data, and we do not share it with anyone for marketing purposes.
Cookies and tracking
With your consent, we use PostHog (hosted in the EU) for product analytics and session replay, with typed text masked, so we can see what's used and where things break. Nothing is collected until you choose Accept in the cookie banner; if you're signed in, analytics are linked to your account. We don't use advertising cookies. Our cookie policy has the detail, and you can change your choice any time from "Cookie settings" in the footer.
Your rights
Under UK GDPR you can ask us what personal data we hold about you, ask us to correct or delete it, object to our processing it, or ask us to restrict how we use it. This applies both to contact form submissions and to public register data we display about you. Because the underlying facts (a company appointment, a PSC notification) remain on the public register regardless of what we do, we may not always be able to remove them from the source, but we will always tell you what we hold, correct what's wrong on our side, and stop showing what we're not entitled to keep showing. To exercise any of these rights, contact us at the address above. If you're not satisfied with our response, you can complain to the Information Commissioner's Office (ico.org.uk).
Where the underlying data comes from
Company data is Crown copyright and reused under the Open Government Licence v3.0. Companies House applies its own, separate re-use terms to personal data on the PSC register, which restrict certain uses (for example, direct marketing to the individuals named). HM Land Registry's Corporate/Commercial Ownership Data, used for Professional property records, is a licensed dataset with its own commercial terms. We attribute and rely on these sources rather than claiming any ownership over the underlying facts.
Changes to this policy
We'll update this page if what we process, why, or who we share it with changes, and update the date below when we do.