Privacy Policy
This Privacy Policy explains how FireBuddy ("we", "us", "our") collects, uses, stores, shares and protects personal data when you use the FireBuddy payments dashboard and related services (the "Service"). It applies to both the businesses who use FireBuddy ("Merchants") and to the customers of those Merchants whose data the Merchants store in FireBuddy.
1. Who we are
FireBuddy is operated from Ireland. Contact for any privacy matter: hello@firebuddy.info. We act as data controller for our Merchants' account data and as data processor for the customer data that Merchants store in our system.
2. What data we collect & why
From Merchants (you, signing up)
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name, email, phone, business name, address | Create + maintain your account; send transactional emails | Contract |
| Fire API credentials (client ID, secret, refresh token) | So the Service can talk to your Fire account on your behalf | Contract |
| QuickBooks OAuth tokens (when you connect) | Sync invoices + expenses to your accounting software | Contract |
| Subscription / billing info | Manage your paid subscription | Contract |
| Login times, IP addresses, audit-log entries | Security monitoring + incident response (see docs/security/incident-response.md) | Legitimate interest |
From Merchants' customers (you, paying a FireBuddy Merchant)
| Data | Why we need it | Lawful basis |
|---|---|---|
| Name, email, phone | Issue receipts and invoices; let the Merchant contact you about your payment | Merchant's contract with you |
| Payment metadata (amount, reference, date) | Display the payment status; let the Merchant reconcile their bank | Merchant's contract with you |
| Booking details (date, time, services) | Confirm the appointment | Merchant's contract with you |
We do not collect, store, or have access to your card numbers, IBANs, or other bank credentials when you pay a Merchant through FireBuddy — those are handled directly by Fire and shown only on the payment screen.
3. How we use your data
- To provide, maintain and improve the Service.
- To process payments, invoices, bookings and direct debits that a Merchant has initiated.
- To send transactional communications (receipts, payment confirmations, booking reminders) on Merchants' behalf.
- To prevent fraud, detect abuse, and respond to security incidents.
- To comply with our legal obligations (e.g. tax records retention, anti-money-laundering, court orders).
We do not use your data for advertising and we do not sell your data to anyone.
4. Who we share data with
We share data only with providers we need to deliver the Service, and only the minimum required:
- Supabase — our hosting + database provider. Data stored in EU data centres.
- Cloudflare — content delivery and DDoS protection.
- Fire (fire.com) — the underlying bank for Merchants. Payment instructions you create through FireBuddy are forwarded to Fire.
- Mailcub — transactional email delivery (receipts, password resets).
- Intuit / QuickBooks — only if a Merchant explicitly connects their QuickBooks account. Then we send the invoice / expense records the Merchant authorises.
- WhatsApp Business — only if the Merchant has enabled WhatsApp notifications for their customers.
- Anthropic — AI text processing, only when a Merchant uses an AI feature (e.g. reading an uploaded bank statement, suggesting transaction categories, or generating a spending overview). What is sent is limited to the text needed for that task — e.g. statement text or transaction descriptions, which may include names or references that appear on the Merchant's own bank statement. Anthropic processes this under its commercial Data Processing Addendum (including Standard Contractual Clauses) and does not use it to train AI models. AI features are optional; nothing is sent unless the Merchant triggers them.
- Team members the Merchant invites (e.g. their accountant) — see only what the Merchant's permissions allow, and bank accounts can be excluded per-account from the accountant's view.
- Microsoft (Clarity) — website analytics, and only if you accept analytics cookies. Nothing is sent to Microsoft unless you do. See section 9 for what it records and how to change your mind.
- Law enforcement / regulators — only where legally required (e.g. a valid court order, AML obligation).
5. International transfers
Your data is stored in the European Union. Where a sub-processor (e.g. WhatsApp Business, or Microsoft Clarity if you accept analytics cookies) processes data outside the EU, we rely on European Commission adequacy decisions or Standard Contractual Clauses to ensure equivalent protection.
6. How long we keep your data
- Merchant account data — for as long as your account is active, plus 6 years after closure (Irish Revenue + Companies Registration Office retention requirement).
- Payment + invoice records — 6 years from the end of the relevant accounting period.
- Imported bank statements + transactions — kept while your account is active as part of your accounting records (same 6-year statutory period). You can delete any imported statement or account (and its transactions) yourself at any time from the dashboard.
- Audit logs — 18 months rolling.
- Marketing emails — until you unsubscribe.
7. Your rights under the GDPR
If you're in the EU/EEA or UK you have the right to:
- Access the personal data we hold about you;
- Correct data that is inaccurate or incomplete;
- Erase your data (subject to legal retention obligations);
- Restrict or object to certain processing;
- Port your data to another provider in a machine-readable format;
- Withdraw consent at any time where processing is based on consent;
- Lodge a complaint with the Irish Data Protection Commission (dataprotection.ie) or the UK ICO (ico.org.uk).
To exercise any of these rights, email hello@firebuddy.info. We'll respond within 30 days.
8. Security
We take security seriously and apply technical and organisational measures appropriate to the risk:
- All data in transit is encrypted with TLS 1.2+.
- All data at rest is encrypted at the database level.
- Row-level security policies prevent merchants from accessing each other's data — every change is reviewed against a published RLS Conventions doc and audited daily.
- Sensitive credentials (Fire client_secret, QuickBooks refresh tokens, API keys) are stored encrypted and never returned to the browser.
- Admin actions are written to an append-only audit log.
- We have a written incident-response runbook and follow the GDPR Article 33 72-hour breach notification process.
9. Cookies & tracking
FireBuddy uses a small number of strictly-necessary cookies and similar storage to keep you signed in and to remember your dashboard preferences. These are required for the Service to work and are not optional. We use no advertising trackers and no social media pixels anywhere.
Optional analytics — Microsoft Clarity
With your consent we use Microsoft Clarity to understand how our pages are used. Clarity is an analytics tool that records how a visitor interacts with a page — clicks, scrolling, mouse movement and the pages visited — and can replay that session, along with aggregate heatmaps. It therefore involves individual session-level recording, not just anonymous counts.
- Legal basis: your consent (GDPR Art. 6(1)(a)). The Clarity script is not loaded at all until you choose “Accept” on the cookie banner. If you decline, or simply ignore the banner, nothing is loaded and nothing is sent.
- Who receives it: Microsoft, as an independent controller for its own product purposes as well as our processor. Microsoft processes this outside the EU; we rely on the transfer safeguards in Microsoft’s data protection terms.
- What we do with it: we look at aggregated behaviour to find pages that confuse people. We do not use it to profile individuals and it never feeds an automated decision about you.
- Changing your mind is one click — see below. Withdrawing is as easy as giving consent, and withdrawal does not affect anything done before you withdrew.
Your cookie choice
10. Children's data
The Service is intended for businesses and is not directed at anyone under 18. We do not knowingly collect data from children.
11. Automated decision-making
We do not make decisions about you using solely automated means that produce legal or similarly significant effects.
12. Changes to this policy
If we make material changes, we'll notify you by email or in-product banner at least 30 days before they take effect.
13. Contact
For any privacy question, data access request, or breach report: hello@firebuddy.info.