Privacy notice

Fred is built and run by Makappen Ltd, registered in England and Wales (company no. 11985285), registered office 33 Boston Road South, Holbeach, Spalding, Lincolnshire, England, PE12 7LR. We work from Winchester. We're registered with the Information Commissioner's Office (registration ZC177280), and you can reach us any time at hello@fredfireops.co.uk.

We don't have a formal data protection officer - at our size the law doesn't require one - so data questions come straight to us at that address.

For information about you and your firm - your account, your team's logins, your firm's details - we're the controller: we decide how it's used and we're responsible for looking after it. This notice covers that.

For the records your firm keeps in Fred about its own customers - site contacts, addresses, service history, certificates - your firm is the controller and we're the processor: we handle that data only on your firm's instructions. Our Data processing addendum governs it, and your firm's own privacy notice is the one that applies to it.

If you have a Fred login:

• Your name, email address, phone number and qualifications, as your firm entered them.
• Your password, stored only as a one-way cryptographic hash - we can't read it. If you add a passkey (Face ID, Touch ID, a fingerprint), we store only its public key and a label like 'iPhone'; the biometric itself never leaves your device.
• Your firm's details: name, address, contact details, accreditations, branding and document settings.
• If your firm connects a sending mailbox (Gmail or Microsoft 365): the mailbox address and an encrypted connection token. The permission Fred requests can only send - it can't read the inbox.
• If your firm connects a payment account: the account identifiers the provider gives us - never card or bank details.
• An activity trail of changes in your workspace - who changed what, and when - kept as part of your firm's records.
• If you asked us for a call or joined the early-access list on the website: your email, the firm name if you gave one, and when you asked.

Giving us your account details isn't optional: your name, email and your firm's details are needed to create a workspace and sign you in, so without them we can't provide Fred to you or your team. Asking for a call or joining the early-access list, by contrast, is entirely your choice.

UK data protection law asks us to name a lawful basis for each use. Ours are:

• To provide your firm's subscription to the account owner who agrees it on the firm's behalf. Basis: performing our contract with your firm.
• To give the rest of your team access to that workspace - their sign-in, and the records, documents and reminders they work with. Team members don't sign the contract themselves, so here our basis is our legitimate interest in running the workspace your firm signed up for.
• To keep the service secure - hashed passwords, session management, rate-limiting sign-in attempts, the activity trail. Basis: our legitimate interest in running a safe service.
• To keep our own business records, such as billing. Basis: legal obligation.
• To get in touch when you ask us for a call on the website. Basis: taking the steps you asked for before a contract.
• To email the early-access list as Fred opens up. Basis: your consent, which you can withdraw any time by asking us to remove you.

We don't sell personal information, we don't run advertising, and we don't use tracking or analytics tools on the site or in the app.

When an engineer uses capture or import, the photos, dictated transcript or scanned register pages they provide are sent to Anthropic, our AI provider, to be turned into draft records. That happens only when someone chooses to use the feature - nothing is sent in the background.

Our agreement with Anthropic doesn't permit your data to be used to train their models. The transcript and photos stay in your firm's workspace as the record of what each draft was based on.

A small set of providers help us run Fred. They handle information on our instructions, and this is all of them:

• Vercel, who host the website and app. The compute runs in London; Vercel is a US company, so UK-approved safeguards cover it.
• Supabase, who run the database and the private file storage for photos and floor plans, in London.
• Anthropic, the AI provider described above, in the US under UK-approved safeguards - and only when your team uses the AI features.
• Stripe and GoCardless, who process the payments your firm collects, on your firm's own provider account.
• Intuit, who run QuickBooks - only if your firm connects its QuickBooks account. Fred then sends the customer name, email and billing address, and the invoice lines, so the invoice appears in your books.
• Twilio, who deliver the text-message reminders Fred sends on your firm's behalf. They receive the customer's mobile number and the message, which names the site and the visit date.
• Google or Microsoft, only if your firm connects its own mailbox - Fred then sends email through your account under the permission you granted.
• Resend, who deliver our own internal note when someone asks for a call or joins the early-access list.
• Sentry, who receive a report when something in Fred breaks, so we can fix it. A report carries the error, the page it happened on and the technical trace, and is set up to leave out request contents, addresses and anything typed in. It is not analytics and it does not record your screen. Sentry is a US company, so UK-approved safeguards cover it.
• TypeSafe, who read the question someone on your team types into Ask Fred, and the names of the things Fred can do, to pick which one answers it. No records leave Fred. TypeSafe is a US company. We have asked them for the UK-approved safeguard for the transfer, and it is not yet in place.

The Data processing addendum carries the same list with each provider's location and transfer safeguard. Beyond these, we'd only share information if the law required it - a court order, for example.

Fred's database, file storage and compute all run in London. Some of our providers are US companies, though: Vercel, Anthropic, Stripe, Sentry and TypeSafe process data in the US, and Supabase, who run our London database and storage, can reach it from the US for support. Where data is processed or accessed from outside the UK, we rely on the safeguards UK data protection law recognises for the transfer, such as the UK Extension to the EU-US Data Privacy Framework. For TypeSafe, that safeguard has been requested and is not yet in place.

• Your account and your firm's workspace: for as long as the account is open.
• When a workspace closes, we return or delete the firm's data as the firm instructs, within 30 days of the instruction - keeping only what the law requires us to keep, such as our own billing records (6 years).
• Sign-in sessions expire after 30 days, and expired session records are cleaned up automatically.
• A call request or the early-access list: until we've finished bringing on new firms from it, or you ask us to remove you.

If you leave a firm but keep your login, your account stays so you can be invited elsewhere. Ask us and we'll delete it, as long as it isn't the sole owner of an open workspace.

Under UK data protection law you can ask us to:

• show you the information we hold about you
• correct it if it's wrong
• delete it
• give you a copy to take elsewhere
• restrict or object to how we use it - pause some uses, or tell us to stop

Email hello@fredfireops.co.uk and we'll sort it out, normally within a month.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

If a fire-protection firm looks after your building and keeps its records in Fred, that firm is the controller of your information - so requests about it go to the firm, and their privacy notice applies. We help the firm answer them, and we never use your information for our own purposes.

Fred uses a small number of strictly necessary cookies and no tracking - the Cookie policy lists every one. Our Security page describes how your information is protected: encryption in transit and at rest, tenant isolation between firms, hashed passwords and passkeys.

If we change what we collect or how we use it, we'll update this page, change the date at the top, and let you know in the app when it matters.