Privacy Policy
Last updated October 22, 2026. CW Watchlist Screening is operated by Controlwright ("we", "us"). This policy explains what information the service handles and why.
Who this applies to
The service is sold to investment advisory firms ("firms"). A firm is the customer and decides which people and companies it screens. For the names and details a firm submits, the firm is the controller of that information and we process it on the firm's behalf. For account and billing information about the firm and its users, we are responsible for that information ourselves.
What we collect
- Account information: firm name, user names, work email addresses, roles, and sign in activity.
- Screening information the firm submits: names, dates of birth, countries and related details of prospects, clients, and other parties, along with the results, reviewer notes, and decisions.
- Monitoring information: the names a firm chooses to monitor, and the alerts produced when government lists change.
- Billing information: handled by Stripe. We do not see or store full card numbers.
- Technical information: basic logs needed to run and protect the service.
How we use it
- To run screening, monitoring, reports, and the audit trail the firm relies on.
- To send service emails such as sign in links and alert notices. Alert emails contain counts and a link only. They do not contain names or match details.
- To bill the firm and enforce plan limits.
- To secure the service and investigate abuse.
We do not sell personal information, and we do not use submitted screening data for advertising or to train models.
Who we share it with
We use a small set of service providers to operate the service: Supabase (database and authentication), Vercel (hosting), Stripe (payments), and Resend (email delivery). They process information only to provide their services to us. We may also disclose information when the law requires it.
Government list data
Screening results come from public government sanctions and restricted party lists, including the US OFAC, Commerce BIS and State Department lists, the United Nations Security Council list, the UK Sanctions List, and the EU Consolidated Financial Sanctions List. That data is public and is not personal information supplied by a firm.
Retention
Screening records, reviews, and audit entries are kept as a permanent record for the life of the firm's account, because firms use them to show their compliance program to regulators and examiners. They cannot be edited after they are written. When a firm ends its subscription, it may ask us to export or delete its data, subject to any legal duty to keep it.
Your choices
A person whose name was screened by a firm should contact that firm about their information. Firm users can ask us to correct account information or to export or delete the firm's data through the contact page below.
Security
See our security page for how we protect information.
Changes
We will update the date above when this policy changes and will notify firms of material changes.