AddressBrain Privacy and Cookie Policy
Version 1.0. Last updated: 15 October 2026.
This privacy notice sets out how StoreFeeder Ltd [Company Number 06585175], trading as AddressBrain (“AddressBrain”, “we”, “us”), uses and protects any personal information that you provide to us through www.addressbrain.com, the AddressBrain account portal (account.addressbrain.com) and the AddressBrain API (api.addressbrain.com), or which we may receive from other sources. Our registered office address is: 185 Farringdon Road, London, EC1A 1AA.
AddressBrain is a product of StoreFeeder Ltd, which is a wholly owned subsidiary of The Royal Mail Group. We want visitors to our website to be able to take part fully in its functionality, and we are committed to doing this in a way that does not infringe your right to privacy.
Please read the following carefully. By continuing to use this website you accept the practices described within this policy.
2.1. Controller: StoreFeeder Ltd, trading as AddressBrain, is the Data Controller for personal data relating to visitors to our website and to our own customers (the businesses that hold an AddressBrain account, and their employees and agents), including the account, contact and billing details described in section 3.
2.2. Processor: Our customers send search terms to the AddressBrain API (for example a postcode or a partial address typed by one of their own users) so that we can return matching UK addresses. Where any such information relates to an identifiable individual, our customer is the Data Controller of that information and AddressBrain acts as a Data Processor on the customer’s behalf. If you are a user of one of our customers’ websites or services, we recommend that you contact that business directly, as the Data Controller.
We may collect and process the following data about you:
3.1. Identity details: First name, last name and title.
3.2. Contact details: Provided by filling in forms on this site, for example when registering for an account, starting a free trial or requesting information from us: business name, business address, billing address, email address(es) and telephone number(s).
3.3. Technical information: Including the Internet protocol (IP) address used to connect your computer to the Internet, your login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
3.4. Profile data: Your username and password, account preferences, feedback and survey responses.
3.5. Transaction data: Details about payments to and from you and the plans and services you have purchased from us.
3.6. API usage data: Your API keys, the search terms and lookup requests sent to the API using your keys, the date and time of each request, the IP address the request came from, and the number of lookups used against your plan allowance.
3.7. Special category data: We do not collect any special categories of data about you, e.g. your race, ethnicity, religion, political beliefs, sexual orientation, health or biometric data, or trade union membership.
4.1. Royal Mail address data: The addresses returned by the AddressBrain API come from Royal Mail’s Postcode Address File (PAF), which we use under licence from Royal Mail. PAF is a reference list of UK delivery points and business names.
4.2. Analytics, advertising and CRM providers: Where you have consented to the relevant cookies, we receive information about how you found and used our website from the providers described in sections 15 and 17.
We use information held about you in the following ways:
5.1. Legitimate interests: The interest of AddressBrain in conducting and managing our business to give you the best service and the best and most secure experience. We are committed to doing this in a way that does not infringe your right to privacy.
5.1.1. Customer use analysis: To study how customers use our website and services so that we can develop them and grow our business.
5.2. Performance of contract: To carry out our obligations arising from any contract between you and us, or to take steps at your request before entering into such a contract:
5.2.1. Providing the service: To create and manage your account, issue API keys and return results to your lookup requests.
5.2.2. Usage and allowances: To count lookups against your plan allowance, show usage in your dashboard and apply rate limits.
5.2.3. Manage payments and billing: To charge fees for the services provided under contract and collect and recover money owed to us.
5.2.4. Renewal of service: To issue invoices in advance of your renewal date.
5.3. Protection of our business: To administer and protect AddressBrain and this website, including troubleshooting, preventing misuse of the API, data analysis, testing, system maintenance, support and reporting, and to meet our obligations under our licence with Royal Mail.
5.4. Relationship management: To manage our relationship with you, for example:
5.4.1. Problem resolution: To help resolve a problem with the service.
5.4.2. Terms and conditions: To notify you of changes to our terms and conditions.
5.4.3. Service review and surveys: To ask you to take part in a review of our services or future product development.
5.4.4. Product recommendations: To suggest features or plans that may suit how you use the service.
5.4.5. Marketing: To tell you about new services that we feel may interest you, taking into account the marketing preferences you have given us.
6.1. Service providers: We share personal data with suppliers who help us run AddressBrain, for example hosting and infrastructure providers, payment providers, email providers, our CRM (HubSpot), website analytics and advertising providers (Google) and our cookie consent provider (Cookiebot). They may only process your personal data on our instructions.
6.2. Royal Mail Group: We may share personal data with Royal Mail Group Ltd (company number 04138203) and its group of companies, as described in section 8.
6.3. Third party acquisition: In the event that we sell or buy any business or assets, we will disclose your personal data to the prospective seller or buyer of such business or assets. If we are acquired by a third party, personal data held by us about our customers will be one of the transferred assets.
6.4. Legal obligation to share information: If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of our customers, our regulator, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and prevention of money laundering and credit risk reduction.
We are committed to ensuring that your information is secure. In order to prevent unauthorised access or disclosure, we have put in place suitable physical, electronic and managerial procedures to safeguard and secure the information we collect online. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.
For more detail on our technical and organisational security measures, including access controls, encryption, and incident response procedures, please see our GDPR Compliance Statement.
8.1. European Economic Area: The data that we collect from you is transferred to, and stored at, a destination within the European Economic Area (“EEA”). This data will be processed by staff or approved external suppliers that operate from either inside or outside of the EEA. Should your personal data be transferred out of the EEA, we will ensure that a similar degree of protection is afforded to as is required by the UK’s data protection legislation, as set out below.
8.2. We may share your personal data with Royal Mail Group Ltd (company number 04138203) and its group of companies. This may involve transferring your data outside the UK.
8.3. We ensure your personal data is protected by requiring that Royal Mail Group Ltd and its group of companies follow the same rules when processing your personal data. These rules are called “binding corporate rules”.
8.4. Whenever we transfer your personal data out of the UK, we will ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:
8.4.1. We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data. Countries within the EEA are recognised by the UK as having adequate protections in place in relation to personal data.
8.4.2. Where we use service providers who are based outside the UK and the EEA, we may use specific contracts approved for use in the UK which give personal data the same protection it has in the UK.
8.4.3. Where we use service providers based in the US or other countries outside the UK and EEA, we ensure appropriate safeguards are in place for any transfer of personal data. These safeguards may include standard contractual clauses in a form approved for use in the UK, including where applicable the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. Please contact us at dataprotection@storefeeder.com if you would like further information about the specific safeguards applied to any such transfer.
8.5. Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK.
8.6. Passwords and API keys: Where we have given you (or where you have chosen) a password or API key which enables you to access your account or the API, you are responsible for keeping it confidential. We ask you not to share a password or API key with anyone.
9.1. Storage limitation: We will only retain your personal data for so long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements (typically six years after the end of any contract with you).
9.2. API lookup logs: Records of requests made to the AddressBrain API, including the search terms sent, are kept for 13 months and are then deleted.
9.3. Retention period: To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data; the potential risk from unauthorised use or disclosure of your personal data; and the purposes for which we process your personal data and whether we can achieve those purposes through other means and the applicable legal requirements.
9.4. Data deletion: In some circumstances you can ask us to delete your data: see section 11 for more information about your rights regarding your personal data.
9.5. Data anonymisation: In some circumstances, we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
This policy may be updated from time to time. Please check back frequently to see any updates or changes to our privacy policy.
Where processing of your personal data is based on consent, you can withdraw that consent at any time.
You have the following rights. You can exercise these rights at any time by contacting us at dataprotection@storefeeder.com. You have the right:
a) To ask us not to process your personal data for marketing purposes. We will inform you (before collecting your data) if we intend to use your data for such purposes or if we intend to disclose your information to any third party for such purposes;
b) To ask us not to process your personal data for scientific or historical research purposes, where relevant, unless the processing is necessary in the public interest;
c) To request from us access to personal information held about you. To submit a subject access request, contact us at dataprotection@storefeeder.com;
d) To ask for the information we hold about you to be rectified if it is inaccurate or incomplete;
e) To ask for data to be erased provided that the personal data is no longer necessary for the purposes for which it was collected, you withdraw consent (if the legal basis for processing is consent), you exercise your right to object, set out below, and there are no overriding legitimate ground for processing, the data is unlawfully processed, the data needs to be erased to comply with a legal obligation or the data is children’s data and was collected in relation to an offer of information society services;
f) To ask for the processing of that information to be restricted if the accuracy of that data is contested, the processing is unlawful, the personal data is no longer necessary for the purposes for which it was collected, or you exercise your right to object (pending verification of whether there are legitimate grounds for processing); and
g) To ask for data portability if the processing is carried out by automated means and the legal basis for processing is consent or contract.
To exercise any of these rights or should you have any issues, concerns or problems in relation to your data, or wish to notify us of data which is inaccurate, please contact us at dataprotection@storefeeder.com or write to:
StoreFeeder Ltd (AddressBrain)
FAO Compliance Manager
Unit 2, Colliers Way,
Phoenix Business Park,
Nottingham,
NG8 6AT
If you have any concerns with how we have handled your enquiry, write to us at the following address outlining your concerns with an indication of the action you expected to have been taken. Once received, we will respond to acknowledge the receipt of your concerns with an indication of an expected timeline of how long it may take to review concerns raised, dependent upon the complexity of the issues raised:
StoreFeeder Ltd (AddressBrain)
Urgent Data Protection Complaint
Managing Director: Brian Williamson
Unit 2, Colliers Way,
Phoenix Business Park,
Nottingham,
NG8 6AT
If you remain dissatisfied with our response to your enquiry, you have the right to contact the Information Commissioner’s Office (ICO) to discuss your concerns and agree any relevant next steps. The latest contact details for the ICO can be found here: https://ico.org.uk/global/privacy-notice/how-you-can-contact-us/
Cookies are small text files that can be used by a website or domain to make a user’s experience more efficient. Cookies help us provide you with a better website experience by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
The law states that we can store cookies on your device if they are strictly necessary for the operation of this site. For all other types of cookies, we need your permission. You can choose to accept or decline the other forms of cookies through the cookie banner shown when you first visit the site. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
We use Cookiebot to manage cookie consent and to scan this site regularly for the cookies it sets. The current list of cookies, what each one does and how long it lasts is shown below, along with the option to change or withdraw your consent at any time.
Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.
Where you have consented to the relevant cookies, we use the following tools to understand how our website is used, to measure and improve our advertising, and to manage enquiries:
You may choose to restrict the collection or use of your personal information. Whenever you are asked to fill in a form on the website, look for the box that you can click to indicate whether you want the information to be used for marketing purposes. You can change this choice at any time by contacting us, and you can change your cookie choices at any time using the cookie settings in section 15.