FireXCheck — Fire Safety Management System | An IgnisTech Product

Privacy Policy

Effective Date: 8 June 2026
Last Updated: 8 June 2026

This Privacy Policy explains how IgnisTech ("we", "us", "our") collects, uses, stores, and protects your personal data when you use the FireXCheck platform ("the Service"). FireXCheck is available as a web application at firexcheck.com and as a mobile application on Google Play.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

1. Who We Are

IgnisTech is the data controller for personal data collected through the FireXCheck platform. This means we determine the purposes and means of processing your personal data.

Contact details:
Email: privacy.ignistech@gmail.com
Website: firexcheck.com

Where you use FireXCheck to store or manage personal data about third parties (such as your clients' contact details or employee records), you are the data controller for that data and we act as your data processor.

2. What Personal Data We Collect

2.1 Information you provide directly

Account registration details: name, email address, and password (managed via Clerk authentication).
Company information: company name, address, postcode, phone number, logo, and branding preferences.
Billing information: payment card details and billing address (processed and stored by Stripe; we do not store your full card details).
Site and asset data: site names, addresses, extinguisher details, inspection records, condition assessments, inspection notes, and photographs.
User management data: names, email addresses, and roles of team members you invite to your organisation.
Communications: any messages, support requests, or feedback you send to us.

2.2 Information collected automatically

Device and browser information: IP address, browser type, operating system, and device identifiers.
Usage data: pages visited, features used, timestamps, and interaction patterns.
QR code scan data: when a QR code is scanned, we record the scan event, timestamp, and device information for audit and reporting purposes.

2.3 Information from third-party services

Clerk: authentication data including OAuth profile information if you sign in via a third-party provider (e.g. Google).
Stripe: payment confirmation, subscription status, and billing events.

3. How We Use Your Personal Data

Purpose	Details	Legal Basis
Providing the Service	Managing your account, processing extinguisher records, generating QR codes, producing reports and compliance certificates.	Performance of contract
Billing and payments	Processing subscription payments, managing plan changes, and sending invoices.	Performance of contract
Communications	Sending service-related notifications including inspection reminders, overdue alerts, low stock warnings, and maintenance schedules.	Performance of contract
Service improvement	Analysing usage patterns to improve features, fix bugs, and develop new functionality.	Legitimate interests
Security	Protecting against unauthorised access, fraud, and other security threats.	Legitimate interests
Legal compliance	Meeting our legal and regulatory obligations, including responding to law enforcement requests.	Legal obligation
Marketing	With your consent, sending you information about new features, product updates, or related services.	Consent

4. Who We Share Your Data With

We do not sell your personal data. We share your data only with the following categories of recipients, and only to the extent necessary:

Clerk (authentication provider) — to manage your account login and security.
Stripe (payment processor) — to process your subscription payments. Stripe is PCI-DSS compliant and acts as an independent data controller for payment data.
Hosting and infrastructure providers — we use cloud hosting services to store and serve the application and your data. Our hosting provider processes data on our behalf under a data processing agreement.
Law enforcement or regulatory authorities — where we are legally required to disclose your data, for example in response to a court order or regulatory request.

5. International Data Transfers

Some of our third-party service providers (including Clerk and Stripe) may process your data outside the United Kingdom. Where personal data is transferred internationally, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the UK Information Commissioner's Office (ICO), or transfers to countries with an adequacy decision.

6. Data Retention

Account data: retained for the duration of your account plus 30 days after account closure or subscription cancellation.
Extinguisher and inspection records: retained for the duration of your account. We recommend exporting your data before closing your account.
Billing records: retained for 7 years from the date of the transaction, as required by UK tax and accounting regulations.
QR code scan logs: retained for 12 months for audit and reporting purposes.
Support correspondence: retained for 2 years from the date of the last communication.

When data is no longer required, we securely delete or anonymise it.

7. Data Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

Encryption of data in transit (TLS/HTTPS) and at rest.
Secure authentication via Clerk with support for multi-factor authentication.
Role-based access controls within the application.
Regular security updates and monitoring.
Secure payment processing via PCI-DSS compliant Stripe infrastructure.

No system is completely secure. If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO in accordance with our legal obligations.

8. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

Right of access: You can request a copy of the personal data we hold about you.
Right to rectification: You can ask us to correct inaccurate or incomplete data.
Right to erasure: You can ask us to delete your personal data in certain circumstances.
Right to restriction: You can ask us to restrict the processing of your data in certain circumstances.
Right to data portability: You can request your data in a structured, commonly used, machine-readable format. The Service provides CSV and Excel export functionality for this purpose.
Right to object: You can object to processing based on legitimate interests or for direct marketing purposes.
Rights related to automated decision-making: We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

To exercise any of these rights, please contact us at privacy.ignistech@gmail.com. We will respond to your request within one month.

9. Your Right to Complain

            Important: Under the Data (Use and Access) Act 2025, which amends the Data Protection Act 2018, you have a statutory right to complain directly to us about how we handle your personal data. The requirements set out below come into force on 19 June 2026.
        

9.1 What is a data protection complaint?

A data protection complaint is any expression of dissatisfaction about how we have collected, used, stored, shared, or otherwise processed your personal data, or about how we have responded to a request you have made to exercise your data protection rights.

9.2 How to make a complaint

You can submit a data protection complaint to us by any reasonable means, including:

Email: privacy.ignistech@gmail.com
Post: IgnisTech, Data Protection Complaints (address available on request).
Via any other communication channel through which you contact us, including social media.

There is no required format for your complaint. Simply tell us what you are unhappy about regarding the handling of your personal data, and provide enough information for us to identify you and investigate your concerns.

9.3 Our complaints process

When we receive a data protection complaint, we will:

Acknowledge receipt within 30 calendar days of receiving your complaint, confirming who is handling it and what you can expect.
Investigate your complaint without undue delay and make appropriate enquiries to understand what happened.
Keep you informed of progress during our investigation.
Tell you the outcome without undue delay once our investigation is complete, explaining our findings and any actions taken.

9.4 If you are not satisfied

If you are not satisfied with our response, you have the right to escalate your complaint to the Information Commissioner's Office (ICO):

Website: ico.org.uk
Telephone: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. Cookies

The Service uses cookies and similar technologies to provide essential functionality and improve your experience. We use:

Essential cookies: required for the Service to function, including authentication session cookies and security tokens. These cannot be disabled.
Analytics cookies: to understand how the Service is used and to improve its performance. These are only set with your consent.

For detailed information about the specific cookies we use, please refer to our Cookie Policy.

11. Children's Data

The Service is not directed at or intended for use by children under the age of 16. We do not knowingly collect personal data from children. If you believe that we have collected data from a child under 16, please contact us immediately at privacy.ignistech@gmail.com.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or through the Service at least 30 days before the changes take effect.

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data protection rights, or wish to make a data protection complaint, please contact us:

IgnisTech
Email: privacy.ignistech@gmail.com
Website: firexcheck.com