This notice is for people whose data appears in results of agosint, and for the agents that call it.
Jakub Kopecky, shveik.dev. Contact for every request about personal data: agosint@shveik.dev.
The service returns data that official public registers and open infrastructure services publish: the company registers of the Czech Republic (ARES), Norway (Bronnoysund), the United Kingdom (Companies House), France (API Recherche d'entreprises, with Sirene and RNE data), Finland (PRH), Germany (the Handelsregister portal), the SEC's EDGAR filing system, the GLEIF legal entity identifier index, Wikidata, the VIES VAT validation service, the OFAC, EU and UK sanctions lists, domain registries (RDAP), RIPEstat, the TLS certificate of a domain and, when you ask for a company behind a website, the legal notice pages of that site, read once at your request. We do not collect it from the people it is about. Where a register publishes officers, managing directors, owners or authorised signatories, a result can contain their names, roles and, in the German register, the other details the register publishes about them, such as date of birth and town of residence. Every result names its source and retrieval time.
We republish public register data on request so that software agents can check who a company is, who stands behind it and how its domain and network are set up, for due diligence, supplier and counterparty checks, fraud prevention and research. The basis is our legitimate interest and that of our customers in access to public register information (GDPR Article 6(1)(f)), which the registers themselves publish for that purpose. We keep the data minimal: results are looked up when a call is made and kept in memory for a few hours; the stored copy of a delivered result is deleted after 24 hours. We do not build profiles and we do not sell lists.
The payment ledger keeps, for every paid call: the paying wallet address, the network, the amount, the route (a label such as company/cz, never the name you looked up), the transaction hash, a hash of the request, and for 24 hours the delivered answer (so that a retry of the same payment returns it). Counters of requests are kept without names. The text of a query, such as the name you looked up, is not written to our application logs or telemetry; our web server's access log records the time, the method, the path without any query string, the status, the size and the client address. We set no cookies and run no advertising or tracking.
You can ask for access, correction, objection or erasure. To have your name or a company record removed from the service's results, write to agosint@shveik.dev with the register id or the exact name as it appears in the register, and a way to reach you. We put the id or name on a suppression list that is applied to every result; a matching record is then replaced by a notice that it was removed on request, and a person with that name is left out of the officers of a company. We aim to apply a request within seven days and to answer it within one month. The suppression list only removes the data from this service: the register itself is not changed by us, and you should address the register for corrections at the source. You can also complain to your data protection authority.
Results go to the agent that paid for the call. Our servers are in the European Union.