Privacy Policy

Who's responsible

Louis Arnold, a sole trader trading as Gov Owed (a Velra product), of 21 Cairns Gardens, Balerno, EH14 7HJ, United Kingdom, is the data controller for govowed.uk. Contact: hello@govowed.uk.

What we collect, and why

• Company information — pulled from the public Companies House register when you scan, plus any business details you enter (sector, size, location, what you're planning). Used to check you against funding schemes. Lawful basis: performing our contract with you.
• Answers that change your matches — a scan only asks the follow-up questions that change your own results: for example where the business works from and its rateable value, what you're planning to buy, whether you're raising investment or selling abroad, how much land you manage, an exact headcount or turnover, and how a company is set up. We use them to check you against schemes and to write your drafts. They are kept with your report so it can re-run, and in our scan records (below) so we can see which questions help, and deleted on request. Lawful basis: performing our contract with you.
• About the founders (optional) — only when it would change your results, we may ask the founder's age band (under 25, 25 to 30 or over 30), whether all of a company's directors are 30 or under, and whether the business is majority-owned or led by women. Each has a “prefer not to say” answer. We use them only to check funding limited to young or women founders, keep the band (never a date of birth) with your report so it can re-run, never use them for analytics or marketing, send them for a draft only when that scheme is limited to young or women founders, and delete them on request. We never guess them from names. Lawful basis: legitimate interests (giving you the accurate match you asked for).
• Hiring and training plans — if you're hiring, we ask about the role and the kind of person you'd most likely take on (an age band, whether they receive benefits, time out of work, veteran or redundancy status), and whether you'd hire someone who is disabled or has a health condition. If you're training staff in Scotland, we may ask whether some of them fall into the groups a training fund pays for, as a yes or no for the group. These are about your plans, not a named person: we never ask for anyone's name or health details, so please don't give them. We use the answers only to check hiring and training scheme rules, keep them with your report so it can re-run, and remove them on request.
• Results copies and reminders — if you ask us under your results to email you a copy, or to tell you when a scheme opens or before it closes, we keep your email address, the answers your scan used (the same business profile a paid report keeps), which schemes matched, which reminders you asked for and when we sent them. We use them to send what you asked for, and so that if you later sign up or buy a report you don't have to answer again. The link in a results email carries your answers in sealed form, so nobody can read or change them from the link, and it stops working after 30 days. Lawful basis: legitimate interests (sending you what you asked for). You don't need an account, and none of this is needed to see your results.
• The Grant Radar box under your results — it starts unticked. Only if you tick it do we add you to the Grant Radar, our email about new schemes, and we record the exact words next to the box and when you ticked it, as proof you asked. Lawful basis: consent, which you can withdraw at any time with the unsubscribe link in every email.
• Account data — your email address, sign-in events, and (if you use Google or Microsoft sign-in) your name from that provider. Lawful basis: contract.
• Practice early access — if you join the list for our accountancy-firm plan, the details you give us: your name, firm, role, roughly how many clients you have, and, if you choose, a phone number, website, location, practice software and a note. Used to tell you when Practice opens, to contact you about setting it up, and to decide what to build first. Kept until Practice opens and you've decided, or until you ask us to delete it. Lawful basis: legitimate interests (you asked to hear about it).
• About you (optional) — if you choose to tell us: which best describes you (for example business owner or accountant), how you heard about us, a phone number, and whether you want the Grant Radar email. We also note the page you first signed in from. Used to tailor what you see, to contact you if you asked us to, and to understand which of our channels work. Lawful basis: legitimate interests, and consent for the Grant Radar.
• Where you came from — only if you accept analytics cookies: the ad or link that first brought you here (its campaign tags and the referring site's name, never the full address), kept on your device and added to your account when you sign in. Lawful basis: consent.
• Purchase records — what you bought and when, kept for 6 years as required for tax. Card details go to Stripe — we never see or store them. Lawful basis: contract + legal obligation.
• Invoice details — at checkout, Stripe collects your billing address and, if you choose to give them, your business name and VAT number, so they appear on your invoice. Stripe keeps them with your billing record for your next purchase and checks a UK VAT number against HMRC's records. Kept with your purchase records. Lawful basis: contract + legal obligation.
• Scan records — which schemes a scan matched, the business profile it used (including your answers to the follow-up questions above, and facts about your project such as its cost and the jobs it would create), and the business name and Companies House number it was for, so we can see what the product is doing and fix it. They never include your address, the descriptions you write of your business or project, the answers about the founders, or the details of anyone you'd hire or train: only whether you're hiring. Anonymous scans are recorded without any account. Lawful basis: legitimate interests.
• Usage analytics — only if you accept analytics cookies. Lawful basis: consent.
• Help and complaints messages — if you use the help form, what you write, your email address, your name if you give it, the page you came from (without anything after the “?”), the type of browser you used, and your account if you're signed in. We use it to reply and to put things right. It's stored in our database and emailed to our inbox. Lawful basis: legitimate interests (answering you and fixing problems).
• Error reports — when something breaks, a report of what went wrong goes to Sentry so we can fix it. Error reports are sent for every visitor, whether or not you accept analytics cookies, and they carry no personal details. We never attach your name, email address or IP address, and cookies, anything you typed into a form, email addresses in error messages and the part of a web address after the “?” are removed before a report is sent. Sentry stores nothing on your device. Lawful basis: legitimate interests (keeping the service working).

Who processes it for us

• Supabase — database, authentication and sign-in emails.
• Vercel — hosting; the site and its functions run there.
• Stripe — payments, receipts and invoices, including the billing address, business name and VAT number collected at checkout.
• Resend — sends our emails (receipts, reminders, the newsletter).
• Anthropic — when you ask for a draft, your business details and the scheme's rules are sent to Anthropic's Claude to write it. Hiring-plan details are not sent, and founder age or women-led answers are sent only for a scheme limited to young or women founders.
• OpenAI — turns scheme-search words into search vectors.
• Companies House — we query the public register with the company name or number you type.
• PostHog (analytics) — only when switched on, and only after you accept analytics cookies.
• Sentry (error reports) — for every visitor, with personal details removed before anything is sent (see above).

Some of these providers process data outside the UK. Where they do, we rely on the transfer safeguards in each provider's data processing agreement.

Email

Emails tied to your purchase (receipts, sign-in links, report updates you've asked for) are service messages. We'll only send marketing where the law allows — with an unsubscribe link in every message, always.

A results copy or a reminder is sent only because you asked for it. Every reminder email has a link to stop that reminder, and every results or reminder email has a link to unsubscribe from all Gov Owed emails, which stops every reminder and takes you off the Grant Radar in one click. Receipts for anything you buy still come. You can also email hello@govowed.uk and we'll do it for you.

How long we keep things

Account and report data: while your account is active, deleted on request. Purchase records: 6 years (tax law). Scan and usage records: while we need them to run and improve the service, and deleted on request. Help and complaints messages: while we need them to answer you and look back at what happened, and deleted on request. Results copies and reminders: your answers, matches and reminders are deleted 12 months after you last asked us for something, or sooner on request; a reminder ends once it has been sent or the scheme has closed. Grant Radar consent: the record of what you ticked and when is kept with the rest, and after those 12 months only while you're still on the Grant Radar, so we can show you asked for it.

Your rights

Under UK GDPR you can ask for access, correction, deletion, restriction, portability, or object to processing. Email hello@govowed.uk and we'll respond within a month.

Complaints

If something has gone wrong with how we handled your data, email hello@govowed.uk with “Complaint” in the subject. We'll acknowledge it within 5 working days and give you a full response within 30 days. You can also complain to the ICO at ico.org.uk.

Cookies

Essential cookies keep you signed in. Analytics cookies are set only if you choose “Accept all” in the cookie notice; “Essential only” is just as easy. “Accept all” also lets us keep a note on your device of the ad or link that first brought you here, so it can be added to your account when you sign in. No advertising cookies, no cross-site tracking.