Data sources & attribution

Last updated: 2026-05-06

Plain-English summary. Prospera is built on publicly available data. The biggest source is the UK Companies House public register, used under the Open Government Licence. We also read company websites, search engines, DNS records, and a small number of paid third-party providers (Hunter, SerpAPI). This page lists every source we use, why we use it, and what we do with the data.

Our principles

We use only public sources or licensed/paid APIs.
We do not systematically scrape sites that prohibit it in their terms of service.
We respect robots.txt and rate limits when fetching public web pages.
We honour every opt-out / erasure request; once opted out, your details stay on a permanent suppression list so re-imports never re-create your record.
We never sell personal data.
We attribute Open Data sources where required by their licence.

Companies House (UK statutory company register)

Companies House is the UK Government register of incorporated businesses. It is public by Act of Parliament — every UK limited company is required by statute to file its directors, address, accounts and other information.

We use the official Companies House Public Data API to retrieve: company names & numbers, registered office addresses, SIC codes, incorporation dates, officer appointments & resignations, persons-with-significant-control, filing history, charges, insolvency cases, and filed accounts (iXBRL or PDF).

Open Government Licence v3.0 attribution.
Contains public sector information licensed under the Open Government Licence v3.0.
Source: Companies House (gov.uk/companies-house).

The company's own publicly-accessible website

For each lead, we may fetch up to ~16 pages of the company's own website (the homepage and a list of canonical contact-page paths: /contact, /about, /team, /people, /leadership, /legal, etc.). We extract:

Email addresses the company has chosen to publish (e.g. info@, sales@, named contacts on a team page).
Phone numbers in tel: hrefs and free text.
Tech-stack signals (which CMS, analytics, chat widget the site uses).
Social-media links, VAT number, accreditations (ISO 9001, Cyber Essentials etc.), tagline.

We honour robots.txt and use a small number of bounded fetches per lead. We do not crawl outside the canonical contact-style paths and we do not store full HTML beyond what's needed to extract the structured fields above.

Search-engine results (via SerpAPI)

SerpAPI is a paid search-result aggregator that returns Google's public index for a search query. We use it to identify:

The official website for a UK company (verified by matching the registration number on the page).
The company's public LinkedIn page URL.
Recent public news mentions.
Director profiles on LinkedIn (used to validate director records).

The data we receive from SerpAPI is the Google search-result snippet, not the underlying page content. SerpAPI is the data source; the pages it indexes remain controlled by their owners.

Our position on LinkedIn data is deliberately conservative:

We identify a company's LinkedIn page URL via SerpAPI search results — that's a search-engine output, not LinkedIn data.
We store the URL on the company record so users can click through to LinkedIn manually.
We do not systematically scrape LinkedIn page content. LinkedIn's terms prohibit automated access, and they actively block our requests; relying on them would also be problematic under UK GDPR.
Best-effort fetches of public LinkedIn pages may be attempted, but typically fail. Where they do succeed, we extract only data that is publicly visible without authentication.
If an individual asks us to remove their LinkedIn-linked record, we delete it and add the company to our suppression list.

DNS records

We perform a single DNS query per lead to read the company's public MX (mail-exchange) records. This tells us which email infrastructure the company uses (Microsoft 365, Google Workspace, Mimecast, etc.). DNS records are public by design — they are how mail-routing on the internet works. No authentication is involved.

Hunter.io

Hunter is a third-party email-pattern provider. Our integration:

Sends a domain (e.g. example.co.uk) and receives back the company's email pattern (e.g. {first}.{last}@) plus a list of publicly-listed email addresses Hunter has gathered for that domain.
Optionally verifies a single proposed email address for deliverability.

Hunter is the data controller for its own database. Our use is subject to Hunter's terms and privacy policy.

OpenAI

OpenAI's models are used to generate plain-English company summaries, "why-now" outreach rationales, and to interpret user-typed search criteria. We send only what's needed for the immediate task and do not allow OpenAI to use our data for model training (we use API endpoints with training-opt-out by default). Outputs are AI-generated and may contain inaccuracies; users are required by our Terms to verify against source data before acting.

Other infrastructure providers

See the Sub-processors page for the full list, including hosting, payments, and transactional email.

Source-of-truth links

Companies House public-information service: find-and-update.company-information.service.gov.uk
Open Government Licence v3.0: nationalarchives.gov.uk/doc/open-government-licence/version/3
UK Information Commissioner's Office: ico.org.uk
Telephone Preference Service: tpsonline.org.uk