Privacy

This is a small read-only research server. It holds no accounts and no user content.

What is logged

• Every request: the full URL including the query string — so search terms are logged — plus the client IP, user agent, timestamp and response status, through Cloudflare Workers Logs.
• OAuth clients registered by a connector, the grants they hold and the issued tokens, stored in Cloudflare KV (tokens hashed/encrypted at rest).
• Access keys, held only as an irreversible hash, with the name and any contact address supplied when the key was issued.
• Usage per access key: a daily call count, and one event per request recording the tool used, the plan, the outcome, the response time and the user agent. Neither holds the query text.
• A request record, kept for 90 days: for each request, who made it, which tool, the search terms or document path asked for, the status, how many results came back and a one-line summary of the answer. This is what lets the operator see how the service is being used and answer a question about a specific request. It holds the text of your queries; it does not hold the documents returned, only their number and a line naming the first.
• Nothing else: no cookies, no third-party scripts, no advertising or profiling of any kind.

Personal data in the mirrored documents

Separately from anything logged about you: the regulators' own publications contain personal data, and this mirror reproduces them. Prospectuses and shareholder circulars carry directors' names, biographies, postal addresses, contact details and telephone numbers; enforcement announcements name individuals referred for suspected violations. National identity numbers are removed from the text served and searched here.

Everything else is reproduced as the regulator published it, at the url cited with every result; the regulator's own page remains the authoritative copy.

Retention

Request logs are kept for Cloudflare's default Workers Logs retention and are not exported elsewhere. The request record described above is deleted after 90 days by a nightly job. Per-request usage events are kept about three months; daily per-key counts are kept up to 400 days and are deleted automatically after that. Access tokens expire within 24 hours; a connector's sign-in ends after 30 days without use, and a registered client that goes unused for 30 days is deleted; expired records are deleted. Revoking an access key ends the sessions it approved.

Processors

Cloudflare (Workers, D1, KV, R2) processes and stores this data. There are no other processors.