Provenance

Where the intelligence comes from, what is done with it, and what is never touched.

Written for the compliance officer of a member’s firm · Last updated 29 October 2026

Windfall is a short daily brief for private bankers and wealth managers. Each working morning it names a handful of people in a member’s market who have had a documented financial event, says where that event is recorded in the public register, and suggests how to approach them. It is built entirely from UK public records.

A banker who wants to subscribe is usually asked to explain, in writing, what the service is and what it does with data. This page is that explanation. It is written to be forwarded.

The first fact, because it is the one that matters

Windfall never receives your firm’s client data. There is no upload, no connection to your CRM, no list to send us, and no field in which one could be typed. A member describes the shape of the book they are building using fixed options from a controlled vocabulary: client type, industry, wealth band, region, deal type. Any residual free text passes through a server-side personal-name detector and is stripped before it is stored and before it reaches any model. The promise that we hold none of your client data is kept in code, not in a policy document.

In data protection terms, Windfall Intelligence Ltd is a controller of public-record data plus a thin subscriber profile, being the member’s work email, firm, job title, location and coverage preferences. It is never a processor of a bank’s client data. A firm whose banker subscribes therefore takes on no processor relationship, no data-sharing arrangement and no onward transfer of anything it holds.

Who built it

Windfall was built by its founder, who spent the best part of a decade in private banking and afterwards in fundraising, building books and generating introductions by hand. It is the tool he would have wanted. That background is offered as provenance rather than credential: every fact in the brief stands on the public record named on this page, never on his say-so, and the accuracy checks described below do not depend on who built them.

Where the intelligence comes from

The public registers first, named in full, and then what a company or its advisers have published themselves.

Companies House: The company register, the register of people with significant control, officer appointments and filed accounts, taken from the published bulk data and the public API. Published under the Open Government Licence. Accounts are parsed deterministically from the filed iXBRL rather than interpreted.
The Gazette: The official public record of record. We read statutory insolvency notices, principally the declarations of solvency filed in members’ voluntary liquidations. Published under the Open Government Licence, crawled inside the publisher’s stated window with its robots directives honoured.
The FCA registers: The public registers of regulated firms and approved individuals, used for verification.
The Charity Commission register: The register of charities and, for charities holding substantial investments, the register of their trustees and their annual reports: the trustee’s name, whether they chair the board and when they were appointed. Published under the Open Government Licence.
What companies and their advisers publish: A deal announcement, a newsroom item, a firm’s own page. These are read for one candidate at a time, and every fact taken from them is quoted from the page it came from.

Search and email-finding services, named under the security outline below, are used only to find a way to reach a named person. They are never a source of fact. There is no private dataset behind Windfall and no bought or rented list anywhere in the chain.

Every factual claim in a brief carries a link to the record it came from: the register page, or the announcement itself. A member can check any statement we make in a single click, and so can the person named in it.

What Windfall does not do

The exclusions below are not aspirations. Each is either enforced by code or is a standing decision that has been tested and reaffirmed.

No LinkedIn scraping, ever, and no scraped social data bought from anyone. This was revisited on a full research pass on 6 August 2026 and reaffirmed. Where a brief includes a public professional profile, it is a link resolved under a strict match rule at the moment the brief is assembled; nothing is extracted from it and nothing is stored from it but the link. Where no work address is found from the company’s own records, that link may be given to one of our two vetted email-finding services to look for one, for that person alone, and any address it returns is checked and labelled like every other.

No special category data. None is held, inferred or stated: nothing about health, race, religion, political opinions, trade union membership, sex life or sexual orientation. There is no field in the system to write it to. We hold no day of birth, because Companies House itself withholds it, and no home address as text: the correspondence address published on the register is reduced at the moment we read it to a matching key and a postcode, and the raw string is never stored. We make no inference about anyone’s spending, lifestyle, household or family.

No one under eighteen. People under eighteen do appear on the register of people with significant control, usually through family shareholdings. They are excluded by a deterministic rule applied as the first precondition of selection, ahead of every other step. That exclusion was built after measurement rather than assumed: a live national run found fifteen such people who would otherwise have been eligible.

No database anyone can browse. Nothing is sold on, no list is rented, and no member can search our records. The service is capped at 200 seats and each member receives one to five names on a working morning, most mornings three, never padded. Windfall never contacts the person named, and never contacts anyone on a member’s behalf.

The lawful basis, and the rights of the person named

The lawful basis for processing public-register data is legitimate interests under Article 6(1)(f) of the UK GDPR. The assessment weighing that interest against the individual’s rights is written down, is revised as the product changes, and can be summarised for your firm on request. Subscriber data runs on contract.

Because the data is collected from registers rather than from the individual, Article 14 applies. Individually notifying millions of people named on the register would be disproportionate and would itself be intrusive, so we rely on Article 14(5)(e) and publish a clear public notice instead, which is our privacy notice. That notice, with the objection route and the limits on what we keep, is among the appropriate measures Article 14(7) requires, and it is written from the assessment so the two cannot drift apart.

The right to object to direct marketing is absolute, and we treat it that way: if someone asks not to appear, they never appear again. That instruction is recorded permanently and survives everything, because our records are rebuilt from the registers each night and a person deleted on Monday would otherwise return on Tuesday. Erasure is built, and was verified against a live full rebuild on 15 August 2026 rather than assumed to work. Retention is a published schedule enforced by a scheduled job: the text of a brief that named someone lives 24 months, the record that remains after it is emptied lives 6 years, and a person’s profile is deleted 90 days after the public filings that brought them into scope stop doing so. The periods are constants read by both the published notice and the job, so the promise and the mechanism cannot come apart.

Windfall Intelligence Ltd is registered with the Information Commissioner’s Office under reference ZC198337 and for VAT under number 527 6190 79. Requests and questions go to privacy@joinwindfall.com and a person answers them.

How a brief is made, and why accuracy is a control

The clearest foreseeable harm in a product like this is a wrong fact about someone’s finances reaching their prospective banker. It is scored as a risk in our impact assessment and answered with machinery rather than good intentions.

Facts are assembled deterministically from records already held. A language model writes prose from those facts and is never asked to recall or supply a fact itself. Writing and checking are separate steps, so the model that writes never polices its own work: a second pass scores every entry against a written quality bar and drops anything that fails. Before that, deterministic code enforces the rules a machine can decide, and it can only drop, never soften. An indicative wealth band is computed in code from filed figures before the writer sees it, is chosen from a closed list, and is never a precise figure; below one million pounds nothing is asserted at all, because a band we cannot stand behind is worse than silence. Every named person is screened against the disqualification and insolvency registers before any of that begins. Nothing reaches a member unless it has passed those checks, and each kind of entry is sent only once it has earned that: every new kind is read in full by a person before it goes, and moves to sending by itself only after a run of mornings on which the person reading it changed nothing. Any morning the checks hold is stopped and reported rather than sent, and sending can be paused across the service at once.

Security, in outline

The buyer is a regulated bank, so security is treated as ranking with accuracy rather than sitting below it.

Where the data lives: Postgres on Supabase in London (AWS eu-west-2). Data at rest is in the United Kingdom and the European Economic Area.
Transfers outside the UK and EEA: One routine transfer in the pipeline: to Anthropic in the United States, for drafting the brief text, under standard contractual clauses with a transfer risk assessment and no training on our data. Per-lead contact resolution uses providers in France, the EU and the United States, each recorded in our sub-processor register with its purpose, the data it receives and its transfer basis.
Hosting and suppliers: The ingestion worker runs on Railway (Amsterdam), the web application on Vercel, email through Resend on its EU sending region, billing through Stripe. Each is under its published data processing agreement and each is listed in the sub-processor register.
Keys and access: Production secrets exist only in the hosting dashboards, never in a committed or uploaded file. The web application never holds the database service-role key: the worker and the application run under separate roles, and row-level security is enabled on every table. Multi-factor authentication and full-disk encryption throughout.
Untrusted input: A registered company name is text an outsider chose, so all ingested register text is treated as untrusted model input, sanitised and fenced before it reaches any model. Model output is then checked against values computed in code rather than trusted as prose. A filed document is sent to a model only per candidate and never in bulk.
Minimisation at the boundary: Contact details printed on insolvency notices, and correspondence addresses on the register, are reduced or removed at parse time rather than after storage, so what we do not hold is a property of the pipeline rather than a discipline that could lapse. Upstream response bodies are never written into logs or stored errors.

Windfall holds no ISO 27001 or SOC 2 certification, and says so rather than leaving it to be discovered. It is a small company running an automated pipeline, and the honest position is the architecture above. A full adversarial test of the live surface, run by the house itself, is scheduled and has not yet been done; when it has, its date will appear here. Formal assurance is a deliberate later step, not an oversight.

The approach note, and financial promotions

Windfall is not authorised by the Financial Conduct Authority. It gives no investment advice, makes no recommendation about any investment, and issues no financial promotions. The suggested approach in each entry is draft copy for the member and the member’s firm to put through the firm’s usual approvals, never a finished promotion and never something to send as it stands.

If an approach is made, it is the member’s own act and the member’s own processing, under their firm’s obligations and their firm’s supervision. Windfall is not a party to it, is not a joint controller of it, and never makes contact itself.

The documents behind this page

A legitimate interests assessment covering each processing activity; a data protection impact assessment scoring ten risks to individuals, which concludes that no residual risk is high and that prior consultation with the Information Commissioner under Article 36 is therefore not required; an Article 30 record of processing activities; a processor and sub-processor register; a retention schedule; a documented erasure procedure; and the vetting record for every provider that touches personal data. Summaries go to a member’s firm on request.

These assessments are our own. They are written against the system as it actually runs rather than against a plan, and every mechanical claim in them was checked against the running pipeline on the day it was written. They have not been through specialist legal review. We would rather tell you that here than have you find it in a call.

For a vendor questionnaire

Controller or processor: Controller, of public-record data and a thin subscriber profile. Never a processor of your client data.
Your client data held: None. There is no route by which it could reach us, and free text is name-stripped server-side before storage or any model call.
Personal data held about your banker: Work email, firm, job title, location, coverage preferences, subscription status and send history.
Sources: Companies House, The Gazette, the FCA registers and the Charity Commission register; companies’ and advisers’ own published announcements, quoted. No scraped social data, no bought or rented lists.
Data location: United Kingdom and EEA at rest. London for the database.
Onward transfers: Anthropic (United States) under standard contractual clauses with a transfer risk assessment and no training on our data; per-lead enrichment providers in France, the EU and the United States, each in the sub-processor register; and the public Wikidata service (United States), which receives a forename and surname when we check whether a person is widely written about.
Sub-processors: Registered and maintained, with purpose, data received, location and transfer basis for each. Available on request.
Retention: Published schedule, enforced by a scheduled job. Brief content 24 months; the emptied record 6 years; a person’s profile 90 days after the filings that brought them into scope stop doing so.
Rights and objections: Absolute and permanent on objection; erasure built and verified against a live rebuild. Contact privacy@joinwindfall.com.
Regulatory registration: Information Commissioner’s Office, reference ZC198337. Not FCA authorised, and no financial promotions issued.
Certification: None held. Security architecture as set out above; a self-run adversarial test of the live surface is scheduled, not yet done.

Contact

Anything on this page can be explained further, and any of the documents behind it can be summarised for your own file. Write to privacy@joinwindfall.com.

If you are the banker rather than the compliance officer, the door is here.