Last updated: 17 October 2026
Who we are
RegCanary is a product of MEMA Consultants Ltd, which is the data controller for the personal data described here. MEMA Consultants Ltd is registered in England and Wales (company number 11869187) at Office 1810a, 60 Tottenham Court Road, Fitzrovia, London W1T 2EW, and is registered with the Information Commissioner's Office (registration number 1018109).
You can reach us about anything in this notice at hello@regcanary.com.
What we collect and why
We collect only what each feature needs. Browsing the public pages does not require an account.
| Purpose | What we hold | Lawful basis |
|---|---|---|
| Your account and workspace | Your email address, the firm details you add (such as firm name, FCA reference number, permissions and business lines), and what you save, watch or annotate. | Contract: providing the service you signed up for. |
| Signing you in | Your email address, a single-use sign-in token (kept only as a one-way hash), session records including the device label and last-seen time, and the sign-in email itself. | Contract, and our legitimate interest in keeping accounts secure. |
| Demo requests | Name, work email, company, role, location, your message, plan of interest, preferred date and time, your IP address and browser details. A hidden form field catches automated spam. | Legitimate interests (answering a business enquiry you sent us) and steps you ask us to take before a contract. |
| Weekly briefing | Your email address, the IP address and browser details from when you subscribed, and whether you have confirmed or unsubscribed. We email a confirmation link first and only send the briefing after you click it. Every briefing carries an unsubscribe link. | Consent, given by confirming your subscription. Withdraw it at any time by unsubscribing. |
| Personalised briefings | Your firm's name, FCA reference number, permissions and the obligation areas that apply to it, combined with regulatory publications, to write firm-specific summaries (see AI processing below). | Contract, for workspace users. |
| Security, reliability and abuse prevention | IP address, request details and error records held by our hosting and application logs; rate limiting on forms. | Legitimate interests: keeping the service secure and working. |
| Measuring how the site is used | Page address, referrer, country and device or browser type, collected by Vercel Web Analytics on some pages. See Analytics below. | Legitimate interests, because it does not use cookies or follow you across sites. If we add anything that stores data on your device for analytics, we will ask for your consent first. |
We do not sell personal data and we do not use it for advertising.
Analytics and your choice
On some pages in production we use Vercel Web Analytics to count visits. Vercel describes it as cookie-free: it records the page address, referrer, country and device or browser type, and does not follow you across other sites. We use it to see which pages are useful and to spot problems.
The banner offers Essential and Accept. At the moment neither choice switches anything on or off, because we do not run any analytics that store cookies or other data on your device. The banner records your choice on your device so that, if we ever add that kind of analytics, we will respect it: it would run only after you chose Accept.
Your current choice: checking…
This clears the stored choice and shows the banner again, so you can pick again. You can also clear it by clearing this site's data in your browser.
AI processing
We use a blend of third-party AI model providers to analyse regulatory publications and, for workspace users, to write briefing text that explains what a publication means for a firm. For firm-specific briefings, the text sent to the model includes the firm's name, FCA reference number, permissions and obligation areas, alongside the publication details. No account email address is sent.
The country research box, where you type a question about a country's rules, searches our own stored content. Your question is not sent to an AI provider.
AI output can be wrong. It is there to help you find and read the right material, not to replace your own judgement or legal advice.
International transfers
Our site is hosted in London and our email is sent from the UK region by default. Some of the providers above may process data outside the UK. Where personal data goes to a provider outside the UK, we rely on appropriate safeguards as UK data protection law requires. Contact us if you would like to know about the safeguards that apply.
How long we keep data
- Sign-in links: valid for 15 minutes and usable once.
- Sessions: a sign-in lasts up to 7 days, then you sign in again.
- Cookies and browser storage: as listed in the tables above.
- Account and workspace data: kept while your account is active and deleted on request, unless we have to keep something to meet a legal obligation.
- Weekly briefing subscriptions: kept while you are subscribed. If you unsubscribe we keep a record that you did, so that we do not email you again. Ask us if you want it erased.
- Demo requests: kept for as long as we need them to deal with your enquiry and any resulting relationship, and deleted on request.
- Server and hosting logs: held by our hosting provider under its standard log retention.
Your rights
Under UK GDPR you have the right to:
- ask for a copy of the personal data we hold about you (access);
- have inaccurate data corrected (rectification);
- have your data erased in the cases the law allows (erasure);
- ask us to restrict how we use your data;
- object to processing that relies on our legitimate interests;
- receive the data you gave us in a portable format (portability); and
- withdraw consent at any time where we rely on it, for example by using the unsubscribe link in any briefing. Withdrawing does not affect anything done before.
To use any of these, email hello@regcanary.com. We may need to check who you are first. We aim to reply within one month.
Contact and complaints
Questions about this notice or how we handle your data: hello@regcanary.com, or write to MEMA Consultants Ltd, Office 1810a, 60 Tottenham Court Road, London W1T 2EW.
If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would appreciate the chance to put things right first.
We will update this page when what we do changes, and change the date at the top when we do.