Privacy Policy

1. Who we are

FinCrimeRadar ("we", "us", "our") is an open-source project operating at fincrimeradar.org. We are based in the United Kingdom and this policy complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For privacy queries, contact us at hello@fincrimeradar.org.

2. What data we collect

We collect only what is necessary to operate the service:

• Email address — only if you voluntarily sign up for early access updates via our signup form
• Search queries — names or entities you enter into the screening tool. These are processed in real time and are not stored or logged by us
• Technical data — standard server logs (IP address, browser type, pages visited, timestamps) collected automatically by our hosting providers for security and performance purposes

We do not collect names, addresses, payment details, or any other personal identifiers beyond the above.

3. How we use your data

• Email address — to send you updates about FinCrimeRadar features and launches. You can unsubscribe at any time.
• Search queries — processed solely to return screening results to you. Not stored, not analysed, not shared.
• Technical logs — used to maintain security, diagnose issues, and monitor uptime. Retained for up to 30 days.

4. Legal basis for processing (UK GDPR)

• Email signups — consent (Article 6(1)(a)). You gave explicit consent when submitting your email.
• Technical logs — legitimate interests (Article 6(1)(f)). Necessary to operate and secure the service.
• Analytics cookies, consent (Article 6(1)(a)). Only set after you accept via the cookie banner.

5. Third parties we use

We use a small number of trusted third-party services to operate FinCrimeRadar:

• Vercel — website hosting (US). Privacy policy
• Cloudflare — DNS, security, and email routing (US). Privacy policy
• Render — API hosting (US). Privacy policy
• Brevo (Sendinblue) — email list management for early access signups (EU). Privacy policy
• OpenSanctions — sanctions and PEP data provider. No personal data is shared with them.

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

6. International data transfers

Some of our third-party providers (Vercel, Cloudflare, Render) are based in the United States. Where data is transferred outside the UK, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards as required by UK GDPR.

7. Data retention

• Email addresses — retained until you unsubscribe or request deletion
• Technical logs — retained for up to 30 days then automatically deleted
• Search queries — not retained at all

8. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Right to access — request a copy of the data we hold about you
• Right to rectification — ask us to correct inaccurate data
• Right to erasure — ask us to delete your data ("right to be forgotten")
• Right to restrict processing — ask us to limit how we use your data
• Right to data portability — receive your data in a portable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent at any time (e.g. unsubscribe from emails)

To exercise any of these rights, email us at hello@fincrimeradar.org. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have handled your data unlawfully.

9. Cookies

FinCrimeRadar uses Google Analytics 4 (GA4) to understand how visitors use the site, page views, session duration, and general navigation patterns. GA4 cookies are not set until you accept them via the cookie banner. If you select "Reject non-essential," no analytics cookies are set and no analytics data is sent to Google for that session. You can change your choice at any time by clearing your browser's local storage and reloading the page.

Analytics cookies, where accepted, are retained by Google for up to 14 months before automatic deletion. We do not use advertising cookies or third-party ad tracking cookies.

Cloudflare may set security cookies necessary for DDoS protection, these are strictly functional, classed as essential, and cannot be disabled without affecting site security.

10. Children's privacy

FinCrimeRadar is not directed at children under 13. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us and we will delete it promptly.

11. Security

We take reasonable technical and organisational measures to protect your data, including HTTPS encryption on all pages, Cloudflare security protection, and access controls on our systems. No method of transmission over the internet is 100% secure, but we take our obligations seriously.

12. Educational tool disclaimer

The screening results provided by FinCrimeRadar are for educational purposes only and must not be used as a substitute for regulated compliance screening. We do not store or log the names or entities you search for. Search queries are processed in real time and discarded immediately after results are returned.

13. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top. Continued use of the site after changes constitutes acceptance of the updated policy. For significant changes, we will notify email subscribers.

14. Contact us

For any privacy-related questions or to exercise your rights:

• Email: hello@fincrimeradar.org
• Website: fincrimeradar.org