Privacy Policy

1. Controller

Firespace Ltd (company number 15545803, 66 Paul Street, London, EC2A 4NA, United Kingdom) is the controller of the personal data described here, except where we process data on behalf of a customer (see section 3). We are registered with the UK Information Commissioner’s Office under reference ZC258403. Contact: support@firespace.co.

2. What we collect

Depending on how you interact with us:

• Account data: name, email address, password (stored hashed), avatar, language and preferences.
• Workspace data: the projects, milestones, documents, financial records, notes and files you or your organisation create on the platform.
• Communications: messages you exchange with us by email, through the website contact form or through messaging channels such as WhatsApp connected to our support desk, including your phone number and profile name on that channel.
• Technical data: IP address, browser and device information, timestamps and security logs generated when you use the platform.

3. Data we process for our customers

When a customer uses the platform to manage its own contacts, conversations or records, that customer is the controller of those data and Firespace Ltd is the processor. We process them only under the customer’s instructions and the agreement with that customer.

4. Why we use your data and on what basis

• To provide the platform and our services, and to manage your account: performance of a contract.
• To keep the platform secure, prevent abuse and keep records of activity: our legitimate interests.
• To answer your enquiries and support requests: legitimate interests, or performance of a contract.
• To send transactional emails such as invitations, verification and password resets: performance of a contract.
• To comply with accounting, tax and other legal obligations: legal obligation.
• For anything else, such as optional communications: your consent, which you can withdraw at any time.

5. Where your data is kept

Our infrastructure is hosted in the European Union: servers in Germany (Hetzner), databases in Frankfurt (Neon) and object storage in the EU (Cloudflare R2). Sensitive documents stored in the platform vault are encrypted at rest with keys held separately from the data.

Some providers may process limited data outside the UK or EU, for example email delivery. Where that happens we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, as applicable.

6. Who we share it with

We do not sell personal data. We share it only with:

• Service providers that host or operate the platform for us: Hetzner (servers), Neon (databases), Cloudflare (network, storage and security), Resend and Zoho (email), Meta (WhatsApp Business messaging when you contact us on that channel).
• Professional advisers, such as accountants, where required.
• Authorities, when the law requires it.

7. How long we keep it

Account data: while your account is active. When you delete your account, your personal details are removed from every service within the platform and your memberships end; work records that belong to a workspace stay with that workspace without your personal data.

Communications and support conversations: up to 24 months after the last exchange, unless a contract or legal obligation requires longer.

Technical and security logs: up to 12 months.

Accounting records: as required by law, normally 6 years.

8. Security

We use encryption in transit (TLS) and at rest, access controls per workspace and role, secrets kept outside the codebase, backups stored encrypted, and monitoring of deployments and access. No system is perfectly secure; if a breach affects you, we will inform you and the authorities as the law requires.

9. Cookies and local storage

The website and platform use only the cookies needed to keep you signed in and to protect forms against abuse. Your language and theme preferences are stored in your browser. We do not use advertising or third-party tracking cookies.

10. Your rights

Under the UK GDPR and, where it applies, the EU GDPR, you can ask us to access, correct, delete or export your personal data, to restrict or object to its processing, and to withdraw consent. Account holders can delete their account from their profile; the deletion cascades through every service of the platform.

To exercise any right, write to support@firespace.co. We answer within one month. You can also complain to the UK Information Commissioner’s Office (ico.org.uk) or to your local data protection authority.

11. Children

The platform is intended for businesses and adults. We do not knowingly collect data from anyone under 16.

12. Changes

We may update this policy. The date at the top shows the current version. Material changes will be announced to account holders before they take effect.