Privacy notice

Last updated 28 September 2026 · Nomadopoly Ltd trading as RiskDiver

1. Who is responsible

Nomadopoly Ltd is the data controller — a company registered in England and Wales under number 17344194, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office (registration number ZC258570). Data protection enquiries: support@riskdiver.com.

2. What we collect from customers

• Account data — your email address, your workspace, and the email addresses of team members you invite. Sign-in is by emailed code; there is no password.
• Your portfolio — the companies you monitor, how you relate to them, and (if you record it) what each relationship is worth. This is confidential: it is never shared, and share links never show it.
• Billing — handled by Stripe. We never see your full card number.
• Help chat — the questions you ask in Help, and the answers, kept with your account.
• Free watch — if you ask us to watch one company free, your email address and that company. Nothing is sent until you confirm by email.
• Technical data — IP addresses and request logs, kept briefly for security. For the free check and sign-in limits we keep only scrambled (hashed) forms of your connection and a cookie.

3. Company data, including directors

RiskDiver uses public records from Companies House. Some signals name people — for example "Director Jane Smith resigned" — because the public register does. Our lawful basis is legitimate interests: helping businesses understand the companies they trade with, using information published for exactly that kind of scrutiny. Our public company pages show company-level facts only and never name individuals; ask us at the support address and we will remove a company's public page from search. We show company-level signals only and do not build profiles of individuals. If you appear in this data and object, contact us.

4. Why we process data, and our lawful basis

• To provide the service, alerts and briefings — performance of our contract with you.
• To take payment — performance of our contract.
• To answer Help questions — performance of our contract.
• To send free watch emails (a note if the company's risk changes, a short weekly note, and how to upgrade) — your consent, given when you confirm. Stop any time from any of those emails.
• To keep the service secure and prevent abuse — legitimate interests.
• To meet tax and accounting obligations — legal obligation.

We do not sell personal data, and we do not use it for advertising or cross-site tracking.

5. Who we share it with

• Stripe — payments.
• Postmark — sign-in codes, alerts and briefings.
• Anthropic — processes Help chat questions to answer them.
• Hetzner — hosting, in Germany.
• Our mailbox provider — for the business emails described in section 6.
• Telegram — replies to those emails are passed to the RiskDiver team through Telegram.

Where a provider processes data outside the UK, we rely on UK adequacy regulations or standard contractual clauses.

6. If you hear from us before you are a customer

We sometimes email businesses that may benefit from RiskDiver — for example a company that has just won a public contract or set up invoice finance, or one in an industry where several firms have recently gone into administration or liquidation, all of which are published publicly. We contact registered companies at business addresses taken from public sources: official award notices and the company's own website. We record where each address came from. Our lawful basis is legitimate interests.

An email may mention a fact from the recipient's own company record at Companies House and link to that company's RiskDiver report; this uses public company information only. Links in these emails carry a reference so we can tell which email someone came from, and if that person or a colleague at the same company later signs up, we note which email led to it. We use this only to learn which of our emails are useful; it involves no cookies. Every email says who we are and how to stop. Ask once — by the link, or by replying — and we won't contact you again; that request is kept permanently so it is always honoured. Business contact details we hold for this purpose are deleted after 18 months without contact.

7. How long we keep things

• Account, portfolio and Help data — while your account is open, then deleted within 90 days of closure.
• Billing records — six years, as HMRC requires.
• Request logs — 30 days.
• Prospect business contact details — deleted after 18 months without contact.
• Free watch — while it's active; an unconfirmed request is deleted after 30 days, and a stopped watch after 90 days.
• Do-not-contact list — kept indefinitely, holding only what is needed to honour the request.

8. Cookies

Essential cookies only: one keeps you signed in, and one protects forms and remembers your free check. No tracking or advertising cookies.

To see how many people arrive at which page, and from where (a search engine, or a link in one of our emails), we count visits without cookies: we keep only a daily total per page and source, never your IP address, device or anything that identifies you.

9. Your rights

You can ask for a copy of your data, or for it to be corrected, deleted or restricted, and you can object to processing based on legitimate interests. Email support@riskdiver.com. You can also complain to the Information Commissioner's Office at ico.org.uk.