Privacy Policy

Last updated: 8 October 2026

Data Controller

Fira Software Ltd
Company No. 07700391
Polegate, East Sussex, United Kingdom

Data We Collect

We collect minimal data necessary to provide our services:

  • Booking form: Name, email address, company name, requirement type
  • Contact form: Name, email address, message content

Website accounts and saved reports:

If you sign in, we process your email address, account identifier and profile information supplied by your chosen sign-in provider. We use these to authenticate you, provide your account and associate reports you choose to save with you. Account information and private saved reports are retained until you remove the report or request account deletion, subject to any records we must retain for legal obligations.

Hosting, authentication and service providers

We use Cloudflare for website delivery and security, Vercel for hosting, Supabase for authentication and database storage, and Resend for service emails. These providers process the data needed to operate the service, including connection information such as IP addresses and request metadata in infrastructure logs. Google or Microsoft processes sign-in information if you choose that provider. OpenAI receives the requested hostname or report identifier and the tool results when you use the ChatGPT plugin. Authorised Fira Software personnel can access service records for support, security and administration. If you allow website analytics, Google Analytics processes page views, interactions and browser/device information to help us understand website use. Booking providers process information you submit for an appointment. Payment details for separate website purchases are handled by Stripe; the ChatGPT plugin does not request payment details.

Third-Party Services

Our booking system may use Cal.com or Calendly for scheduling. These services have their own privacy policies:

  • Cal.com Privacy Policy: cal.com/privacy
  • Calendly Privacy Policy: calendly.com/privacy

Cookies

Essential cookies and browser storage support authentication, security and the report-saving flow. The plugin save cookie expires after 24 hours. Optional Google Analytics loads only if you choose Allow analytics. You can choose Essential only or change your choice below; we remember the choice for up to 180 days. Rejecting analytics does not prevent scanning or saving reports. The service records described in the ChatGPT section are stored on our servers separately from optional browser analytics.

Data Retention

We retain your data only as long as necessary for the purposes it was collected. Contact and booking data is retained for 24 months after your last interaction with us, unless we enter into a business relationship.

ChatGPT plugin

When you use the FiraQuantumSafe plugin, we receive the requested public hostname or plugin report ID and return an HTTPS assessment to ChatGPT. We store the hostname, measurements and a random report ID for retrieval for 30 days. Anyone with that report ID can retrieve it during this period. Expired reports are inaccessible and removed on the next scan request. The plugin does not receive your ChatGPT conversation history or access your website account scans. To prevent abuse, we temporarily store a daily keyed hash of the connection IP address in rate-limit records, which expire within 24 hours and are removed on subsequent scan requests. The plugin does not store raw client IP addresses, email addresses or account identifiers. OpenAI processes your use of ChatGPT under its own privacy policy. If you choose to save a report on our website, we link a private copy to your signed-in account and keep it until you remove it or delete your account. A necessary, HTTP-only save cookie expires after 24 hours. We keep scan-completion, save-start, registration and repeat-check records for up to 90 days to measure use of this feature; completed saves and registrations include your account ID. Older measurement records are removed on subsequent save requests. Saving does not make your private report history available to ChatGPT.

Your controls for plugin data

You can use the public ChatGPT scanner without a website account. Saving a private copy is optional. You can download or remove a saved copy from your account report library. To request account deletion, early deletion of a public report, or access to or deletion of usage records linked to you, contact us using the address below and include the report ID or account email where relevant. We may verify your identity before acting on private account data. Disconnecting the plugin in ChatGPT stops future access through that connection; it does not delete existing reports or your website account. Deleting a report from our service does not remove responses already held in your ChatGPT history, which you control through OpenAI.

Your Rights (GDPR)

Under GDPR, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure of your data
  • Object to processing
  • Data portability

Contact for Data Requests

For any data-related requests, please contact us at: [email protected]

We will respond to all legitimate requests within 30 days.