01Who we are
LookupDock is operated by Administrative Burden Ltd, trading as Modest Ambitions, a company registered in England and Wales (company number 17363389). Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.
Contact us about privacy at [email protected].
02Our role
We are the controller for personal data about you as a visitor or customer: your account, sign-in sessions, billing records, support emails and, if you allow it, website analytics.
When you or your systems send phone numbers, email addresses or IP addresses for checking, those values usually belong to other people. For that data we are your processor: we handle it only to provide the checks you ask for, under our data processing terms. Your own privacy notice should tell those people about it.
03What we collect
| Data | Details |
|---|---|
| Account | Your email address, a salted hash of your password, your workspace name and whether your email is verified. If you choose a connected sign-in provider when available, its name and stable account ID. Provider access and refresh tokens are not retained. |
| Sign-in sessions | Your IP address and browser user agent for each signed-in session. |
| API keys | The key name, a short prefix, a SHA-256 digest of the key and when it was last used. We never store the full key. |
| Checks | The values you submit, the results, the service, status, credits used and request IDs. Inputs and results are encrypted. |
| Bulk uploads | The file name and the parsed rows, encrypted while the batch runs. The original file is not kept. |
| Billing | When paid plans are switched on: Stripe customer and subscription IDs and invoice status. Card details go to Stripe, never to us. |
| Verification and password-reset messages we send, and anything you write to us. | |
| Technical logs | Request logs and rate-limit counters, with passwords, tokens and keys filtered out. |
| Analytics | Only if you allow it, on public pages only: pages viewed and clicks, through Google Analytics. The page address is sent without its query string. |
04Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Providing your account, the workspace, the API and checks | Contract |
| Billing, invoices and tax records | Contract and legal obligation |
| Keeping the service secure, preventing abuse and fixing faults | Legitimate interests |
| Service emails such as verification and password reset | Contract |
| Website analytics on public pages | Consent, which you can withdraw at any time |
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Our results are signals for you to weigh, not decisions.
05Data you submit for checks
You decide which values to check and must have a lawful basis to do so. Do not send special category data (for example health or political information) or data about children, and do not put personal data in URLs.
We use submitted values only to run the checks you request, return results, keep usage records and protect the service. We do not use them to build profiles, for marketing, or to train models.
06Suppliers
We use these suppliers. Those marked "not switched on yet" receive no data until the feature is enabled, and this page will change before that happens.
| Supplier | Purpose | Location | Status |
|---|---|---|---|
| Hetzner Online GmbH | Hosting, database and backups | Nuremberg, Germany | In use |
| Cloudflare, Inc. | DNS, TLS and network proxy for the website and API | Global network | In use |
| Resend | Account verification and password-reset email | United States | Not switched on yet |
| Google (Google Sign-In) | Optional sign-in using your Google identity and verified email address | United States and Ireland | Setup complete; verification pending |
| GitHub, Inc. | Optional sign-in using your GitHub identity and verified primary email address | United States | Setup complete; verification pending |
| Stripe | Subscription billing and payments (Stripe is also an independent controller for some payment processing) | United States and Ireland | Not switched on yet |
| IPQualityScore | Validation data supplier. Receives the values you submit for live checks. | United States | Not switched on yet |
| Google (Google Analytics 4) | Website analytics on public pages, only after you allow it | United States and Ireland | Only if you allow analytics |
07International transfers
The application and database are hosted in Germany. Some suppliers are based in, or reach data from, the United States. Before personal data goes to a supplier outside the UK, we rely on UK adequacy regulations, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework where the supplier is certified. Ask us for details of the safeguard that applies.
08How long we keep it
| Data | Kept for |
|---|---|
| Lookup inputs and results | 7 days, then deleted |
| Usage counts, request IDs and idempotency records | Kept with the account, without the looked-up value |
| Uploaded CSV files | Not retained. Parsed rows are encrypted and cleared after processing. |
| Database backups | Daily, kept for 7 days |
| Sign-in sessions (IP address and browser user agent) | Until you sign out |
| Account and billing records | For the life of the account, then as accounting law requires |
| Connected sign-in identities (provider name and stable account ID) | For the life of the account. Provider access and refresh tokens are not retained. |
09Security
- Lookup inputs, results and batch contents are encrypted in the database.
- All traffic uses HTTPS. API keys are stored only as SHA-256 digests.
- Every query is scoped to your workspace, and responses carrying personal data are not cached.
- Daily database backups are kept for seven days.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the ICO where the law requires it.
10Your rights
Under UK data protection law you can ask to access, correct or delete your personal data, restrict or object to how we use it, and receive it in a portable format. Where we rely on consent you can withdraw it at any time.
Email [email protected]. We reply within one month. If your request is about values a customer sent us to check, we will pass it to that customer, who decides how to respond.
You can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. If you are in the EU, you can also contact your local data protection authority.
12Business use
LookupDock is a service for businesses and professionals. It is not intended for children, and we do not knowingly collect their data.
13Changes
We will update this notice when our practices or suppliers change and show the new date at the top. For significant changes, we will also email account owners.
14Contact
Administrative Burden Ltd, trading as Modest Ambitions. Company number 17363389, registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. Email: [email protected].
