1. Who we are
1.1 MetaAshes is operated by MetaFenix Management Ltd, company number 16921717, registered office 3 Allens Mead, Gravesend, Kent DA12 2JA. We are the controller of the personal data described in this notice and are registered with the Information Commissioner's Office under reference ZC187194.
1.2 For any question about this notice or your personal data, please send an enquiry through our contact form using the subject "Data protection request".
2. The data we collect
| Category | What it includes |
|---|---|
| Account data | Your email address, a salted and hashed version of your password (never the password itself), your checks balance and the date your account was created. |
| Order and purchase data | The pack ordered, the number of checks, the amount, the order's payment reference, its status, the dates of the order and payment confirmation, and the time you gave the consents required at checkout. |
| Verification history | For each assessment: the name of the firm assessed, the pathway, the verdict, the score and the date. |
| Assessment answers | The details you enter during an assessment, including the firm's contact details, the offer, how you were approached, payment instructions and any notes you add. See section 4. |
| Uploaded documents | An email, letter or screenshot you choose to upload to pre-fill an assessment. See section 4. |
| Enquiries | Your name, email address, the subject and content of your message, and the account it was sent from, if any. |
| Technical data | Your IP address, used temporarily to limit repeated sign-in attempts and assessments, and a session cookie that keeps you signed in. See our Cookie Policy. |
2.1 We do not collect special category data, and we ask that you do not include it in notes, enquiries or uploaded documents.
3. How we use it and why
3.1 UK data protection law requires a lawful basis for each use of personal data. We rely on the following:
| Purpose | Lawful basis |
|---|---|
| Creating and managing your account, signing you in and keeping your account secure | Performance of a contract |
| Running assessments and keeping your verification history | Performance of a contract |
| Processing purchases, adding checks and handling cancellations and refunds | Performance of a contract |
| Keeping financial records of purchases | Legal obligation |
| Responding to enquiries and complaints | Legitimate interests, in responding to people who contact us |
| Limiting repeated attempts and preventing misuse of the Service | Legitimate interests, in protecting the Service and its users |
| Establishing, exercising or defending legal claims | Legitimate interests |
3.2 We do not sell your personal data, use it for advertising or send you marketing communications.
4. Assessments and uploaded documents
4.1 Your answers are not stored in our database. They are held in the server's memory only for the duration of your session so that the assessment can run and the result can be displayed. Only the firm name, pathway, verdict, score and date are saved to your verification history.
4.2 To produce the written findings, your assessment, including your answers and the results of the checks, is sent to our AI service provider. An uploaded document is sent to the same provider once, to read its contents and pre-fill the questionnaire for your review. We do not store uploaded documents.
4.3 To run the checks, details you enter about the firm, such as its name, website, company number and reference numbers, are sent to the official and public sources listed in section 5. These queries concern the firm, not you.
6. International transfers
6.1 Our AI service provider, Anthropic, PBC, and our hosting provider, Render Services, Inc., are based in the United States, so personal data, including assessment content and uploaded documents, may be processed outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we ensure that it is protected by appropriate safeguards recognised under UK data protection law.
7. How long we keep data
| Data | Retention period |
|---|---|
| Account data and verification history | Until you delete your account |
| Sign-in sessions | Up to 30 days, or until you sign out, change your password or delete your account |
| Assessment answers | Not stored; held in memory only during your session |
| Uploaded documents | Not stored by us |
| IP addresses used for attempt limits | Held in memory for up to one hour; not stored in our database |
| Orders and purchase records | Six years, to meet our accounting obligations; unlinked from you if you delete your account |
| Enquiries | Up to 24 months after the enquiry is resolved |
8. How we protect data
8.1 We use appropriate technical and organisational measures to protect personal data, including salted password hashing, secure HTTP-only session cookies, protection against cross-site request forgery, single-use assessment links, limits on repeated attempts and restricted access to our systems.
9. Automated processing
9.1 An assessment applies automated rules to information about a firm. It does not make decisions about you that produce legal or similarly significant effects. The decision whether to proceed with any firm remains yours.
10. Your rights
10.1 Under UK data protection law you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to our use of your data;
- receive your data in a portable format.
10.2 You can update your email address or delete your account at any time from your account settings. To exercise any other right, send an enquiry through our contact form using the subject "Data protection request". We will respond within one month.
10.3 You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would, however, appreciate the opportunity to address your concerns first.
11. Other information
11.1 Children. The Service is not intended for anyone under 18, and we do not knowingly collect their personal data.
11.2 Changes. We may update this notice from time to time. The date at the top of this page shows when it was last updated.