Privacy policy

1. Introduction

This Privacy Policy explains how Ashton Fire ("we", "us", or "our"), operating Fire Guidance Genius, collects, uses, and protects your personal data when you use our service. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR).

2. Data Controller

For the purposes of data protection legislation, the data controller is Ashton Fire. If you have any questions about this policy or how we handle your data, please contact us at enquiries@fireguidancegenius.com.

3. Information We Collect

3.1 Account Information

When you create an account, we collect:

• Email address
• Name
• Password (stored as a salted password hash)
• Account creation date

3.2 Operational Data (always collected)

To provide and operate the annotation and collaboration service, we collect:

• Annotations you create, edit, or delete (content, timestamp, associated document)
• Comments and forum posts you create
• Content moderation and abuse prevention data

Why we collect this data: This information is necessary to provide the core functionality of our annotation and collaboration platform. It is NOT subject to cookie consent as it is essential for the service you signed up for. This data is processed under the legal bases of contractual necessity (to provide the service) and legitimate interest (service operation, abuse prevention, content moderation).

Opting out: If you wish to remain anonymous, you can use the "Anonymous" option when creating annotations or forum posts. This will not associate your content with your user account.

3.3 Optional Analytics Data (requires consent)

If you consent to analytics cookies, we additionally collect:

• Document viewing patterns (which documents you view, pages viewed, time spent)
• Search queries and results
• UI interactions (button clicks, navigation patterns)
• Page performance metrics

You can withdraw consent for analytics tracking at any time in your Profile Settings. This will NOT affect the operational data mentioned in section 3.2, which is necessary for the service. Analytics events may include document usage, search activity, UI interactions, and performance metrics.

3.4 Technical and Security Information

We automatically collect certain technical and security information necessary for the service to function securely:

• IP address (for security and session management)
• Browser type and version
• Operating system
• Error logs and performance data
• Device fingerprint (browser characteristics such as screen resolution, timezone, hardware concurrency) - used for multi-factor authentication and device recognition to enhance security and reduce authentication frequency

Why we use device fingerprinting: Device fingerprinting helps us recognise your device for security purposes, particularly for multi-factor authentication. This allows us to reduce how often we ask you to verify your identity, whilst maintaining strong security. This is considered strictly necessary for the security of the service.

3.5 Preferences

We store your personalisation preferences:

• Theme preference (light/dark mode)
• Font size preference
• Colour scheme preferences
• Layout and display preferences
• Notification preferences

3.6 AI Questions and Answers

When you use the AI assistant we record:

• Who asked, and when
• Your question, the answer given and the guidance passages it cited
• Which AI model answered, whether it answered or declined, and what the request cost to run
• Any feedback you give on an answer

Who can see it: You can see your own conversations. If you belong to an organisation, its organisation moderators can see who in the organisation used the assistant, when, the questions asked and the answers given, but never what requests cost. They only see this for organisations they moderate. Fire Guidance Genius administrators can see questions and answers across organisations for service quality, safety and support. Please do not put personal data about other people, or confidential client information, in your questions. See our AI Policy for how we expect the assistant to be used.

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Contractual necessity: Processing account information and authentication data to provide the service
• Legitimate interests: Security monitoring (including device fingerprinting for MFA), error logging, fraud prevention, and service security
• Consent: Analytics and performance monitoring for service improvement (you can withdraw consent at any time)
• Legal obligation: Retaining certain data for security and compliance purposes

Our legitimate interests: We have a legitimate interest in protecting our service and users from security threats, fraud, and unauthorised access. Device fingerprinting for multi-factor authentication serves this purpose and is proportionate to the security benefits it provides.

5. How We Use Your Information

We use your information to:

• Provide and maintain the Fire Guidance Genius service
• Authenticate your identity and manage your account
• Store and display your annotations and contributions
• Answer your questions with the AI assistant, apply usage limits, and review answers to improve their quality
• Personalise your experience based on your preferences
• Analyse usage patterns to improve the service (with your consent)
• Monitor and prevent security threats
• Respond to your support requests
• Send important service notifications

6. Cookies and Similar Technologies

6.1 Essential Cookies

We use essential cookies and local storage that are strictly necessary for the service to function:

• Authentication tokens (to keep you logged in)
• Session management
• Security features

These cannot be disabled as the service would not work without them.

6.2 Analytics Cookies (Optional)

With your consent, we use:

• Vercel Analytics: To understand how users interact with documents and features
• Custom Analytics: To track UI interactions and improve user experience

Analytics events may include document usage, search activity, UI interactions, and performance metrics. We only use optional analytics where you have enabled analytics cookies.

6.3 Functional Cookies (Optional)

We store your personalisation preferences (theme, font size, layout options) in our database as part of your account information - this does not require consent as it's essential account data.

With your consent to functional cookies, we additionally cache these preferences in your browser's local storage for faster loading. If you decline functional cookies, your preferences still work - they're just loaded from our database each time rather than from local cache, which may be slightly slower.

6.4 Managing Cookie Preferences

You can manage your cookie preferences at any time using the cookie consent banner that appears on your first visit, or by updating your preferences in your account settings.

6.5 Storing Your Consent Choices

Why we store your consent preferences: When you make cookie consent choices (including opting out of analytics), we store your preferences in your account. This allows us to:

• Remember your choice so you don't see the consent banner on every device
• Sync your privacy preferences across all your devices
• Respect your opt-out decision and ensure we do NOT track you if you rejected analytics
• Comply with UK GDPR requirements to demonstrate we obtained and respected your consent

This is a legal requirement under UK GDPR Article 7 (keeping records of consent) and serves our legitimate interest in respecting your privacy choices. The consent preference itself (a simple yes/no record) is minimal data necessary to honour your decision. Without storing this, we could not respect your opt-out across sessions and devices.

7. Third-Party Services

We use the following third-party services that may process your data. Active providers may vary depending on deployment configuration and enabled environment variables.

• Vercel: Frontend hosting and deployment infrastructure
• Render: Backend hosting and database infrastructure
• SMTP2GO: Email delivery for account and service notifications
• Microsoft: OAuth and Azure identity services where you use Microsoft sign-in
• OpenAI and Anthropic: AI features where enabled by deployment configuration; your question and the guidance passages retrieved to answer it are sent to the provider that generates the answer
• Azure Blob Storage: Document storage where enabled by deployment configuration
• Vercel Analytics: Website analytics (only with your consent)

These services have their own privacy policies. We recommend reviewing them where relevant:

• Vercel Privacy Policy

8. Data Retention

We retain your data for the following periods:

• Account data: Until you delete your account, plus 30 days for backup purposes
• Annotations, comments, and forum posts: Retained while your account is active; after account purge, content may be retained in anonymised form where needed to preserve collaborative document context
• Analytics data: Aggregated data retained for up to 2 years; individual session data for 90 days
• AI questions and answers: Kept while your account is active. When you delete a conversation its text is removed, but a usage record (time, model and cost, without the text) is kept to apply usage limits and for billing
• Security logs: Retained for 12 months for security and fraud prevention
• Session data: Deleted when you log out or after 30 days of inactivity

When an account is purged, personal account identifiers are deleted or anonymised. Some content may remain available without identifying account details where removal would affect other users' collaborative records.

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right to access: Request a copy of the personal data we hold about you
• Right to rectification: Request correction of inaccurate data
• Right to erasure: Request deletion of your personal data ("right to be forgotten")
• Right to restrict processing: Request that we limit how we use your data
• Right to data portability: Receive your data in a machine-readable format
• Right to object: Object to processing based on legitimate interests
• Right to withdraw consent: Withdraw consent for analytics at any time

To exercise any of these rights, please contact us at enquiries@fireguidancegenius.com. We will respond within one month.

10. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Salted password hashing for passwords, and encryption for sensitive data where appropriate
• Secure HTTPS connections
• Regular security audits
• Access controls and authentication
• Regular backups with encryption

Whilst we take reasonable steps to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.

11. International Data Transfers

Your data may be transferred to and stored on servers located outside the United Kingdom. When we transfer data internationally, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the UK Information Commissioner's Office (ICO)
• Adequacy decisions recognising equivalent data protection standards

12. Children's Privacy

Our service is not intended for children under the age of 13. We do not knowingly collect personal data from children. If you believe we have collected data from a child, please contact us immediately at enquiries@fireguidancegenius.com.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or through a prominent notice on our service. The fixed "Last Updated" date at the top of this policy indicates when it was last revised.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at enquiries@fireguidancegenius.com.

15. Complaints

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113
Website: www.ico.org.uk