Privacy

Controller

The data controller is Churchtown Media Ltd, company number 16960442, 5 Cambridge Avenue, Southport, PR9 9SA. Contact: [email protected].

Public records in the index

The index holds names, roles, company numbers, addresses and similar fields because they already appear in official public records: committee papers, Companies House, land titles, NHS organisation lists, published spend, published accounts, and equivalent sources. When court judgments are held, the index will store metadata and named parties from Find Case Law. It will not store the full judgment text, and it will not extract addresses or other sensitive fields from that text. A party name is not treated as a person in the index. We do not collect patient records, clinical notes, or health data from care systems. A person named in a published minute or a director file is there because the source published them, not because they opened an Institrace account.

UK GDPR still applies to that material where it is personal data. The lawful basis for holding it here is that it is already public and that indexing it is a legitimate interest: making published accountability records actually findable. You can object. We will consider a request against the original publication. We cannot un-publish a council minute or a Companies House filing.

Data from using the site

If you email us, or submit an invite request, we keep that correspondence so we can reply. If you create an account we hold your name, email, organisation, password hash, billing address, and Stripe customer and subscription identifiers. The lawful basis is the contract for the seat, or steps toward that contract. Stripe processes the card. We do not store raw card numbers. Hosting and security logs may include IP address, time, and the path requested. That is to run and protect the site, not to profile you. We do not sell personal data. We do not run advertising cookies.

Authenticated index pages are not offered to search engines. You can close the account by writing to us. Billing history stays as long as the tax record requires.

Cookies

The site sets an HTTP-only session cookie named it_customer for a customer seat, or it_session for a staff override, so you are not asked for the password on every page. After a correct password we also set it_login_pending for up to 10 minutes so we can check the email sign-in code. These are necessary cookies for that gate. They are not advertising cookies. The session cookie lasts up to 30 days. There is no cookie banner because we do not set optional tracking cookies.

Processors

The site is hosted on Vercel. The database is PostgreSQL on Neon. DNS and edge protection sit on Cloudflare. Access-request notices are sent through the Hostinger mailbox. Those processors see what they need to deliver the service. Official source files stay with their publishers. We do not send the corpus to a general-purpose web chatbot.

Your rights

You can ask for access, correction, erasure, restriction, or objection, and you can complain to the Information Commissioner's Office. Write to [email protected]. For a name that appears only because an official body published it, the usual answer is a pointer to that body. For an email you sent us, we can delete the correspondence unless we must keep it.

Retention

Indexed public records are kept for as long as they remain part of the index, including a hash of the file at the time it was collected. Correspondence is kept only as long as needed to deal with the request and any follow-up. Session cookies expire as set above.