Clearfield
Privacy Notice
Who we are
Clearfield is a competitor intelligence service for UK businesses, run as a sole trader business. Clearfield is the data controller for the personal data described on this page.
The way to reach us is by email, at hello@getclearfield.co.uk. If you want to ask about anything on this page, that is the address to use.
This website does not track you
This website is a set of static pages, apart from one order page described below. It sets no cookies, runs no analytics and tracks nothing about you. There is no account, no session, and nothing that follows you between pages or between visits.
The site does carry a design preview of a future client portal, sign-in page included. It is labelled as a mock-up, there is nothing live behind it, and it shows input fields only as part of that mock-up: nothing typed into the preview submits anywhere, and nothing you type into it is stored or sent. The one page that does send what you type is our order page, where you name the competitors you want a report on and tick the areas you want to know about. When you continue to payment, those answers are sent to us and stored by our website host, Cloudflare, under an order reference, as section 08 describes.
The site is hosted on Cloudflare Pages. As part of delivering and protecting the site, Cloudflare processes technical data about visitors, including IP addresses and request logs. That is a normal part of web hosting and it happens before anything reaches us. We do not collect anything about your visit ourselves.
If you email us
Email is our only contact channel, so if you get in touch we will have whatever your message contains. That is usually your name, your email address and the content of what you wrote.
We use it to reply to you, to answer questions, and to provide the service you have asked about. We keep correspondence only for as long as it is relevant, and then no longer.
What our reports monitor
Clearfield produces intelligence reports about businesses. A report covers competitor companies that a client names, and it is built only from public sources: the competitors' own websites, the job listings they publish, aggregate figures from review sites together with short verbatim passages from the reviews themselves, the news, press and blog pages those competitors publish on their own sites, and the public registers at Companies House.
The subject of a report is a company, not a person. We are interested in what a business does in public, such as what it charges, who it is hiring and how it presents itself, and not in the individuals who work there.
How we keep personal data to a minimum
Public business sources sometimes contain personal data, and our practice is to cut it out rather than carry it along, with two deliberate exceptions set out immediately below.
The first exception is customer reviews. A report can quote a short verbatim passage from a public review page as the evidence for something it says about a competitor, and we do not rewrite those passages. A quoted passage occasionally names an individual, because the reviewer wrote that name in the review itself. Those passages are part of the report, so they are part of what is sent to the portal host named in section 08, and they are kept under the rule for delivered reports below.
The second exception is our daily monitoring record: for clients on a subscription, a short public headline and a short job title, taken from the competitors' own news pages and from published job listings, each as we recorded it, without rewriting it; one of each for each competitor for each daily check. It can name an individual, because whoever published it wrote the name there. Those strings go to the portal host named in section 08, the same place the review passages above go, and they are kept under the six-month rule set out below for material we derive that does not form part of a report we have delivered.
Company officer names from Companies House are not extracted into our reports, and no report names an officer. Reviewer names are not extracted from review pages, and no review quote in a report is attributed to a named person.
We do not use personal data to build a profile of an individual, to contact anyone, or to make any decision about a person. We do not sell it, and we do not share it with anyone for their own purposes.
We do not keep collected monitoring data indefinitely either. Our policy is to keep the captures a report is built from, and the material we derive from them that does not form part of a report we have delivered, for up to six months, and then to remove them. A report we have delivered is the client's own deliverable, so we keep it, and the copy our portal host stores for the client's account, for as long as that account is open, and we remove it when the account closes. Both of these are policies we apply and carry out by hand: nothing on our systems does either of them for us, and we do not promise you a timetable we do not operate.
Companies House information
Part of a report can come from the public registers at Companies House. That information is used under the Open Government Licence v3.0, and reports that carry it say so.
Our lawful basis
For the monitoring described above, and for handling correspondence, our lawful basis under UK GDPR is legitimate interests.
For taking payment and producing a report you have bought, our lawful basis is performance of a contract. Before you pay, holding the answers you give on our order page is a step taken at your request before entering into a contract, so the same basis applies. Where one of those answers is a person's name, such as a competitor that trades under its owner's own name, that person is not a party to the contract, and our basis for holding the name is legitimate interests, as it is for the monitoring.
The interest is a straightforward one. Businesses are entitled to understand the public behaviour of their competitors, and we are entitled to reply to people who write to us. We keep that balance on the right side by using public sources only, by stripping personal data out instead of carrying it apart from the two exceptions described in section 05, and by producing reports about companies rather than about people. If you think we have the balance wrong in your case, tell us and we will look at it properly.
Who we share information with
We do not sell personal data, and we do not pass it to anyone to use for their own purposes.
A report goes to the client who commissioned it. Beyond the client it reaches one other place: our portal host, Supabase, stores the released report and its PDF, and, for clients on a subscription, a short daily monitoring record, so that the client can read them in their account, and it holds them as our processor and on our instructions only. Our website host, Cloudflare, processes visitor technical data as described above, as part of hosting the site. It also stores the answers given on our order page (the competitors named, the areas ticked, an order reference and the time they were given) as our processor and on our instructions only. It deletes each set automatically 30 days after it is given, whether or not the order is paid; for a paid order we first copy the answers into the settings we produce your report from. The stored answers cannot be restricted to the UK, so they may be held outside it. Where they include personal data, those transfers are covered by the UK Addendum to the European Commission's standard contractual clauses, under the data processing addendum that forms part of our agreement with Cloudflare, and you can ask us for a copy.
If you buy a one-off report through the card checkout, payment is processed by Stripe, Inc. Stripe receives your card details, the details you enter at checkout (company name and website), and an order reference that links your payment to your order-page answers and carries nothing about you; we receive your email address, the checkout details, the order reference and confirmation of payment, and we use them solely to produce and deliver the report you bought. Stripe's own privacy policy applies to its processing.
Producing a report involves sending captured public-source material to a third-party AI provider, Anthropic, which acts as our processor and handles that material only on our instructions, to interpret it and draft the report. That processing may take place outside the UK, including in the United States; those transfers are covered by the UK Addendum to the European Commission's standard contractual clauses, which forms part of our data processing agreement with Anthropic, and you can ask us for a copy. We send nothing for this purpose beyond that captured material, the interpretations we derive from it, and the details of your own order - your company name, your sector, what you asked us to monitor, and the names and websites of the competitors you asked us to watch.
Delivering a report through the client portal involves storing it with a third-party hosting provider, Supabase, which acts as our processor and holds that material only on our instructions. What we send is the finished report: the report payload, which includes the short verbatim review passages described in section 05, and the PDF of that same report. For clients on a subscription we also send a short daily monitoring record. For each competitor we monitor, and for each of the two things we check every day - the competitors' own news pages and their job listings - it carries the number we counted, one headline or job title we recorded that day, as we recorded it, without rewriting it, whether that check completed, the date and time we looked, and a plain description of where we looked. It carries no article text, no review passages, no web addresses and nothing else about you or about the competitors we monitor. The project is hosted in Supabase's London (eu-west-2) region, so the stored reports and monitoring records are held in the UK; Supabase is not established in the UK, and its support and engineering staff may access the service from outside the UK. Those transfers are covered by the UK Addendum to the European Commission's standard contractual clauses, which forms part of the data processing agreement we have accepted with Supabase, and you can ask us for a copy.
Your rights
Under UK GDPR you have the right to be told how your data is used, to ask for a copy of it, to have it corrected if it is wrong, to have it deleted, to restrict how it is used, to object to it being used, and to ask for it in a portable form. Some of these apply only in particular circumstances, and if one of them does not apply to your request we will say so plainly and explain why.
Because we rely on legitimate interests, the right to object matters here in particular. You can object to what we do and we will consider it and reply.
To use any of these rights, email hello@getclearfield.co.uk. There is no charge, and we will reply as promptly as we can and in any event within the time UK GDPR allows.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first, at hello@getclearfield.co.uk, so we have a chance to put it right.
You can also complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. Coming to us first is not a requirement; you can go straight to them if you prefer.