Privacy notice

1. Your account

We hold your email address, the name and firm details you give at sign-up, and the security details needed to run your account, such as verification status and sign-in events. We use them to run your account and to send security emails such as verification and password resets. We keep them while your account exists.

2. The people you screen

When you screen someone you send us a name and, optionally, a date of birth and nationality. We use it only to run the check you asked for and show you the result. Every check produces a record you can download.

You stay in control. Keep a case in Scovell to re-screen later, or download the record and delete the case. Cases are deleted when you confirm them closed, and automatically 30 days after they were opened. Screening through the API or an AI agent works the same way.

3. Adverse media (optional)

If you turn on adverse media, the name, and the birth year and nationality if you gave them, are sent to our news search providers and to an AI model that assesses whether an article is about the same person. Sanctions and PEP checks never involve an AI model.

4. How we keep Scovell accurate

When you record a decision on a match we keep an anonymised record of how it was made. These records help keep Scovell as accurate as possible. Names are scrambled into a one-way code, and the record never contains a date of birth, nationality, address, or anything linking it to you, your client or your case.

The one exception is a similar name that turned out to be a false positive. We keep that name on its own, with nothing attached to it, so the matching learns which look-alike names cause noise. We never use these records to profile the people screened. Ask us and we will remove a record.

5. Where your data is held

Google Cloud (Firebase) in London, europe-west2. Emails are sent through Google Workspace. Sign-in uses local browser storage; we do not use tracking cookies.

For links with a referral label, we record each page request, its time, browser user agent, network/ASN name and whether a page-render signal arrives. We also record the first interaction type and time, time until the page is hidden or left, and the number of screens run from that visit; no key values or pointer positions are stored. This helps distinguish email security scanners from likely human visits. We use Team Cymru DNS lookups to derive the network from the IP address; the lookup includes the address, but our visit records do not retain it. Google Cloud may retain IP addresses in its normal infrastructure logs. These visits are not linked to screening inputs or accounts.

6. Your rights

Under UK GDPR you can ask for a copy of your data, or for it to be corrected or deleted, by emailing scovell@rotundahq.com. You can also complain to the Information Commissioner's Office.

7. Intellectual property and use of the service

Scovell™ is a Rotunda™ product. Scovell and Rotunda are trade marks of Rotunda. Our software, original content and proprietary screening implementation are protected by intellectual property rights. You must not copy our proprietary methodology, reverse engineer the service or attempt to extract its source code or non-public implementation details, except with our written permission or where applicable law permits it and that right cannot be excluded by contract. Section 9 of our Terms of Use sets out the full restrictions and permitted uses.

This intellectual property notice does not limit your data protection rights or our obligations regarding your personal data.