Company demand stays private.

Controller and contact

The data controller is Flamel Labs OÜ, an Estonian private limited company (registry code 17441665), with registered address Harju maakond, Tallinn, Kesklinna linnaosa, Tartu mnt 67/1-13b, 10115, Estonia. Flamel Labs OÜ operates GCD / GetCompanyData. Contact privacy@getcompanydata.com about this notice or your personal data.

Company searches

GCD stores the submitted company query, optional jurisdiction, match state, source page and time. Browser searches also carry a random identifier stored in that browser. This lets GCD count unique demand, distinguish repeat browser use and rank the companies and official-register connectors to build next. A submitted query is demand evidence; it is not treated as a verified legal entity.

Direct France fallback

If the GCD edge is rate-limited during an explicit France search, the results page may make one credential-free request directly from your browser to the French government’s API Recherche d’entreprises. That service then receives the query, your network address and ordinary browser metadata as an independent recipient. GCD omits the referrer, requests only public identity fields, does not send cookies or credentials, and does not persist the direct official response.

REST, MCP and abuse measurement

GCD records the interface, capability and activation stage needed to compare browser, REST and MCP demand. Resolver calls also retain the normalized company query, optional jurisdiction and match state for 90 days. For REST and MCP, GCD derives a keyed, one-way daily pseudonym from the request IP address and user-agent string. The demand database does not store the underlying IP address or user-agent string. A separate keyed pseudonym enforces short-lived submission limits. These pseudonyms are not used to identify you across other services or for marketing. GCD does not intentionally log API keys, authorization tokens, prompts, unrelated tool arguments, response payloads or official document contents in demand telemetry.

Access requests

When you explicitly save a request, GCD stores the selected company or portfolio query, jurisdiction, work email, organization, access methods, requested products, volume range, price response, source-page attribution and document context. Request creation also uses a keyed, one-way technical pseudonym derived from network and browser metadata to enforce a daily cap. The requested contact details are necessary for GCD to assess and respond to the request; without them, GCD cannot follow up.

Purposes and legal bases

GCD relies on legitimate interests to operate and secure the public service, prevent abuse, understand whether the browser, REST API and MCP interface are useful, and prioritize company and registry coverage. GCD limits the fields, retention and use of telemetry to reduce its privacy impact. GCD processes access-request details to take steps at your request before a possible service agreement and, where needed, for the legitimate interest of responding to and managing that request. Any future unrelated marketing will use a separate choice and legal basis.

Processors and international transfers

Cloudflare provides website delivery, security, serverless processing and D1 storage as a processor. Cloudflare and its subprocessors may process data outside the European Economic Area. Where a restricted transfer occurs, Cloudflare’s Data Processing Addendum applies the relevant Standard Contractual Clauses and additional safeguards. GCD does not publish or sell individual search histories or access requests.

Retention and deletion

Company-search demand and access requests receive a deletion date 90 days after creation. Query-free funnel events may be retained for up to 180 days. Short-lived rate-limit records are removed after three days. A scheduled job purges records after these periods. After completing an access form, you can delete that request immediately using its deletion control. You may also contact privacy@getcompanydata.com with the request ID.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, objection or portability of your personal data. You may object to processing based on legitimate interests. Contact privacy@getcompanydata.com; GCD may need enough information to verify the request without exposing another person’s data. You may also lodge a complaint with the supervisory authority where you live or work, or with the Estonian Data Protection Inspectorate.

Automated decisions and communication

GCD does not use this data to make decisions that produce legal or similarly significant effects about you. Submitting an access request permits communication about that request; it does not subscribe you to unrelated marketing.