Windfall

Provenance

Where the intelligence comes from, what is done with it, and what is never touched.

Written for the compliance officer of a member’s firm · Last updated 15 August 2026

Windfall is a short daily brief for private bankers and wealth managers. Each working morning it names a handful of people in a member’s market who have had a documented financial event, says where that event is recorded in the public register, and suggests how to approach them. It is built entirely from UK public records.

A banker who wants to subscribe is usually asked to explain, in writing, what the service is and what it does with data. This page is that explanation. It is written to be forwarded.

The first fact, because it is the one that matters

Windfall never receives your firm’s client data. There is no upload, no connection to your CRM, no list to send us, and no field in which one could be typed. A member describes the shape of the book they are building using fixed options from a controlled vocabulary: client type, industry, wealth band, region, deal type. Any residual free text passes through a server-side personal-name detector and is stripped before it is stored and before it reaches any model. The promise that we hold none of your client data is kept in code, not in a policy document.

In data protection terms, Windfall Intelligence Ltd is a controller of public-record data plus a thin subscriber profile, being the member’s work email, firm, job title, location and coverage preferences. It is never a processor of a bank’s client data. A firm whose banker subscribes therefore takes on no processor relationship, no data-sharing arrangement and no onward transfer of anything it holds.

Who built it

Windfall was built by its founder, who spent ten years in wealth management and afterwards in fundraising, building books and generating introductions by hand. It is the tool he would have wanted. That background is offered as provenance rather than credential: every fact in the brief stands on the public record named on this page, never on his say-so, and the accuracy checks described below do not depend on who built them.

Where the intelligence comes from

Three public sources, named in full. There is no private dataset behind Windfall and no data broker anywhere in the chain.

Companies House: The company register, the register of people with significant control, officer appointments and filed accounts, taken from the published bulk data and the public API. Published under the Open Government Licence. Accounts are parsed deterministically from the filed iXBRL rather than interpreted.
The Gazette: The official public record of record. We read statutory insolvency notices, principally the declarations of solvency filed in members’ voluntary liquidations. Published under the Open Government Licence, crawled inside the publisher’s stated window with its robots directives honoured.
The FCA registers: The public registers of regulated firms and approved individuals, used for verification.

Every factual claim in a brief carries a link to the register page it came from. A member can check any statement we make in a single click, and so can the person named in it.

What Windfall does not do

The exclusions below are not aspirations. Each is either enforced by code or is a standing decision that has been tested and reaffirmed.

No LinkedIn scraping, ever, and no scraped social data bought from anyone. This was revisited on a full research pass on 6 August 2026 and reaffirmed. Where a brief includes a public professional profile, it is a link resolved under a strict match rule at the moment the brief is assembled; nothing is extracted from it, nothing is stored from it, and no scraped or bulk profile data enters the pipeline at any point.

No special category data. None is held, inferred or stated: nothing about health, race, religion, political opinions, trade union membership, sex life or sexual orientation. There is no field in the system to write it to. We hold no day of birth, because Companies House itself withholds it, and no home address as text: the correspondence address published on the register is reduced at the moment we read it to a matching key and a postcode, and the raw string is never stored. We make no inference about anyone’s spending, lifestyle, household or family.

No one under eighteen. People under eighteen do appear on the register of people with significant control, usually through family shareholdings. They are excluded by a deterministic rule applied as the first precondition of selection, ahead of every other step. That exclusion was built after measurement rather than assumed: a live national run found fifteen such people who would otherwise have been eligible.

No database anyone can browse. Nothing is sold on, no list is rented, and no member can search our records. The service is capped at 200 seats and each member receives three to five names on a working morning. Windfall never contacts the person named, and never contacts anyone on a member’s behalf.

The lawful basis, and the rights of the person named

The lawful basis for processing public-register data is legitimate interests under Article 6(1)(f) of the UK GDPR. The assessment weighing that interest against the individual’s rights is written down, is revised as the product changes, and can be summarised for your firm on request. Subscriber data runs on contract.

Because the data is collected from registers rather than from the individual, Article 14 applies. Individually notifying millions of people named on the register would be disproportionate and would itself be intrusive, so we rely on Article 14(5)(b) and publish a clear public notice instead, which is our privacy notice. That notice is the substitute the article contemplates, and it is written from the assessment so the two cannot drift apart.

The right to object to direct marketing is absolute, and we treat it that way: if someone asks not to appear, they never appear again. That instruction is recorded permanently and survives everything, because our records are rebuilt from the registers each night and a person deleted on Monday would otherwise return on Tuesday. Erasure is built, and was verified against a live full rebuild on 15 August 2026 rather than assumed to work. Retention is a published schedule enforced by a scheduled job: the text of a brief that named someone lives 24 months, the record that remains after it is emptied lives 6 years, and a person’s profile is deleted 90 days after the public filings that brought them into scope stop doing so. The periods are constants read by both the published notice and the job, so the promise and the mechanism cannot come apart.

Windfall Intelligence Ltd is registered with the Information Commissioner’s Office under reference ZC198337. Requests and questions go to privacy@joinwindfall.com and a person answers them.

How a brief is made, and why accuracy is a control

The clearest foreseeable harm in a product like this is a wrong fact about someone’s finances reaching their prospective banker. It is scored as a risk in our impact assessment and answered with machinery rather than good intentions.

Facts are assembled deterministically from records already held. A language model writes prose from those facts and is never asked to recall or supply a fact itself. Writing and checking are separate steps, so the model that writes never polices its own work: a second pass scores every entry against a written quality bar and drops anything that fails. Before that, deterministic code enforces the rules a machine can decide, and it can only drop, never soften. An indicative wealth band is computed in code from filed figures before the writer sees it, is chosen from a closed list, and is never a precise figure; below one million pounds nothing is asserted at all, because a band we cannot stand behind is worse than silence. Every named person is screened against the disqualification and insolvency registers before any of that begins. Nothing reaches a member without a human approving it.

Security, in outline

The buyer is a regulated bank, so security is treated as ranking with accuracy rather than sitting below it.

Where the data lives: Postgres on Supabase in London (AWS eu-west-2). Data at rest is in the United Kingdom and the European Economic Area.
Transfers outside the UK and EEA: One routine transfer in the pipeline: to Anthropic in the United States, for drafting the brief text, under standard contractual clauses with a transfer risk assessment and no training on our data. Per-lead contact resolution uses providers in France, the EU and the United States, each recorded in our sub-processor register with its purpose, the data it receives and its transfer basis.
Hosting and suppliers: The ingestion worker runs on Railway (Amsterdam), the web application on Vercel, email through Resend on its EU sending region, billing through Stripe. Each is under its published data processing agreement and each is listed in the sub-processor register.
Keys and access: Production secrets exist only in the hosting dashboards, never in a committed or uploaded file. The web application never holds the database service-role key: the worker and the application run under separate roles, and row-level security is enabled on every table. Multi-factor authentication and full-disk encryption throughout.
Untrusted input: A registered company name is text an outsider chose, so all ingested register text is treated as untrusted model input, sanitised and fenced before it reaches any model. Model output is then checked against values computed in code rather than trusted as prose. A filed document is sent to a model only per candidate and never in bulk.
Minimisation at the boundary: Contact details printed on insolvency notices, and correspondence addresses on the register, are reduced or removed at parse time rather than after storage, so what we do not hold is a property of the pipeline rather than a discipline that could lapse. Upstream response bodies are never written into logs or stored errors.

Windfall holds no ISO 27001 or SOC 2 certification, and says so rather than leaving it to be discovered. It is a small company running an automated pipeline, and the honest position is the architecture above, together with a full adversarial security test of the live surface before launch. Formal assurance is a deliberate later step, not an oversight.

The approach note, and financial promotions

Windfall is not authorised by the Financial Conduct Authority. It gives no investment advice, makes no recommendation about any investment, and issues no financial promotions. The suggested approach in each entry is draft copy for the member and the member’s firm to put through the firm’s usual approvals, never a finished promotion and never something to send as it stands.

If an approach is made, it is the member’s own act and the member’s own processing, under their firm’s obligations and their firm’s supervision. Windfall is not a party to it, is not a joint controller of it, and never makes contact itself.

The documents behind this page

A legitimate interests assessment covering each processing activity; a data protection impact assessment scoring ten risks to individuals, which concludes that no residual risk is high and that prior consultation with the Information Commissioner under Article 36 is therefore not required; an Article 30 record of processing activities; a processor and sub-processor register; a retention schedule; a documented erasure procedure; and the vetting record for every provider that touches personal data. Summaries go to a member’s firm on request.

On a data protection officer, so that the position is stated rather than implied: one is not yet appointed. The question has been assessed in writing and the decision recorded is to engage an external data protection officer service, with the appointment triggered by the first paying member, by the first request from a member’s firm, or by 1 October 2026, whichever comes first. If your firm’s process requires a named data protection officer, say so and that is the trigger.

These assessments are our own. They are written against the system as it actually runs rather than against a plan, and every mechanical claim in them was checked against the running pipeline on the day it was written. They have not yet been through specialist legal review, which is commissioned as the first members join. We would rather tell you that here than have you find it in a call.

For a vendor questionnaire

Controller or processor: Controller, of public-record data and a thin subscriber profile. Never a processor of your client data.
Your client data held: None. There is no route by which it could reach us, and free text is name-stripped server-side before storage or any model call.
Personal data held about your banker: Work email, firm, job title, location, coverage preferences, subscription status and send history.
Sources: Companies House, The Gazette, the FCA registers. Public records only. No scraped social data, no brokered lists.
Data location: United Kingdom and EEA at rest. London for the database.
Onward transfers: Anthropic (United States) under standard contractual clauses with a transfer risk assessment and no training on our data; per-lead enrichment providers in France, the EU and the United States, each in the sub-processor register.
Sub-processors: Registered and maintained, with purpose, data received, location and transfer basis for each. Available on request.
Retention: Published schedule, enforced by a scheduled job. Brief content 24 months; the emptied record 6 years; a person’s profile 90 days after the filings that brought them into scope stop doing so.
Rights and objections: Absolute and permanent on objection; erasure built and verified against a live rebuild. Contact privacy@joinwindfall.com.
Regulatory registration: Information Commissioner’s Office, reference ZC198337. Not FCA authorised, and no financial promotions issued.
Certification: None held. Security architecture as set out above; adversarial testing of the live surface before launch.
Data protection officer: Not yet appointed; external appointment decided in principle and triggered by first revenue, by a firm’s request, or by 1 October 2026.

Contact

Anything on this page can be explained further, and any of the documents behind it can be summarised for your own file. Write to privacy@joinwindfall.com.

If you are the banker rather than the compliance officer, the door is here.