Privacy and cookies

Version 2026-09-15.2 — 15 September 2026.

1. Who is responsible and how to contact us

Mateusz Wiecek trading as FireBid Radar is responsible for the personal information described here. Write to Flat D, 15 Park View, Stoneyburn, EH47 8AX, United Kingdom or hello@firebidradar.co.uk for privacy questions, requests or complaints. You do not need an account to contact us.

This notice covers the public website, privately arranged account access, procurement research and business correspondence. Paid ordering is not currently open. Test accounts still involve personal information and receive the same privacy protections.

2. Information, purposes and lawful bases

• Business enquiries and sole-trader orders: name, business contact details, correspondence and requested service. We use steps requested before a contract and performance of a contract where the individual is our customer. For a company's representatives, our basis is legitimate interests in responding to enquiries and delivering the business service.
• Accounts and workspaces: email, password hash, verification status, membership, profiles, watchlists and feedback. Our legitimate interests are administering authorised users, delivering useful procurement research and protecting each business's workspace. Contract applies where the individual is the contracting customer. We do not rely on an employer's contract as every employee's lawful basis.
• Security and delivery: session and request information, relevant IP addresses, authentication events, delivery identifiers and suppression records. Our legitimate interests are preventing abuse, diagnosing failures and respecting delivery objections. Account and requested alert emails are service messages; marketing is separate.
• Billing and records: customer and subscription references, amounts, status, invoices and order acceptance. Contract or legitimate interests support administration; legal obligation supports records required by tax law. Stripe handles payment card details; we do not store full card numbers or security codes. Current integration testing does not create a paid subscription.
• Support and rights requests: contact details, the issue and necessary resolution evidence. Support uses contract or legitimate interests as above; handling statutory rights and data-protection complaints also meets legal obligations.
• Public procurement: notices from Find a Tender and Contracts Finder may identify buyer or supplier representatives, sole traders, professional contact details and their role in a procurement. Our legitimate interest is providing traceable procurement research. We distinguish source statements from our assessments. We do not use these contacts as a marketing list, and public availability does not remove people's rights.
• Optional marketing: where offered, a separate opt-in and confirmation record supports consent. You can withdraw at any time without losing service access. Marketing delivery is currently disabled. We keep the minimum suppression evidence needed to honour an objection.

Some workspace notes may contain information a business asks us to process on its behalf. For that limited content, the business determines the purpose and is the controller; we act as its processor under the subscription's processing schedule. Contact your business for its notice, or contact us and we will route your request. Do not put sensitive personal information, criminal-record information, passwords or card data into notes or support messages.

Required account details are needed to provide access. If you choose not to provide them we cannot create an account; you can still browse the public website and contact us. We do not make solely automated decisions producing legal or similarly significant effects about people. Procurement fit and renewal estimates support human business decisions. AI scoring is currently disabled.

Optional Google sign-in

When this option is enabled and you choose “Sign in with Google”, you are redirected to Google. We request your Google Account email address, confirmation that Google has verified it, and a stable Google account identifier. We use these details to authenticate you and connect the correct FireBid Radar account, on the account and security bases described above. We do not request access to your Gmail messages, Drive files, contacts, profile photo or full profile. Your Google password is entered on Google's service and is not provided to FireBid Radar.

We retain the Google account identifier, its link to your FireBid Radar account and the date the link was created. Your email address forms part of your account record. Google access, refresh and ID tokens are not stored in our account database. Temporary sign-in information is held in our server-side session while the process is completed. A sign-in attempt is valid for ten minutes; an abandoned session record is removed through session maintenance, not necessarily after ten minutes.

Google receives our application's identity, requested permissions and return address, plus connection information when your browser visits Google. It processes information under its own Privacy Policy. Opening our sign-in page alone does not load a Google sign-in script or send a sign-in request to Google.

We do not use this authentication information for advertising, marketing lists or AI training. The saved account link is included in your own account-data export and removed during approved account erasure. Recovery copies follow the retention arrangements below. Contact hello@firebidradar.co.uk for help with account access or your data rights. Google sign-in is currently limited to private testing; public customer registration remains closed.

3. Recipients and international processing

Authorised users in your business can see shared workspace content; they cannot access another business's workspace. Hosting is provided by OVHcloud. Postmark delivers service email. Stripe supports billing tests and, when enabled, payment processing, including its own fraud-prevention and regulatory purposes. Our current contact-address forwarding uses Porkbun and Google Gmail. Recovery backups are encrypted before being stored with Dropbox. The separate, owner-restricted ChatGPT Sites demonstration is hosted by OpenAI; it is not the customer application.

These providers may process information outside the UK. The applicable protection depends on the service, recipient and destination: UK adequacy regulations, or appropriate contractual safeguards such as the UK Addendum to standard contractual clauses where required. Postmark's terms include a processing agreement addressing UK transfers; Stripe publishes role-specific processing and transfer terms. Consumer storage or email accounts do not automatically have the same processing terms as a business service. Contact us for details of the arrangements applicable to your information and copies or descriptions of safeguards, with confidential information removed where necessary.

We share information with professional advisers or authorities where needed for legal obligations or legal claims, and do not sell personal contact lists. Visiting an external source or payment portal brings that provider's own notice into scope. No customer workspace content is sent to AI scoring in the current configuration.

For optional Google sign-in, Google acts as an independent controller; its controller terms identify Google LLC for UK personal data. This is separate from our email service. Google's controller terms and transfer information describe the UK Extension to the EU–US Data Privacy Framework for covered transfers to certified US entities and contractual safeguards where required. You can contact us for the safeguards applicable to your information.

4. How long we keep information

Account and workspace information is retained while the service is in use. At closure we review it for deletion or de-identification within 30 days, except for specific records needed for law, unresolved matters or another person's rights. Inactive preview accounts are reviewed after 90 days. These are controlled review targets, not a promise that every system automatically deletes every copy on that day.

Support messages have a 180-day review target from receipt; open disputes and unresolved cases are held until their need ends. Unnecessary message content is then redacted. Security records are reviewed on a 90-day target, with incident evidence retained only as needed. Public notice history is retained while needed to explain current records and supported renewal estimates, with an annual necessity review and earlier review of personal contact fields on request.

Self-employment tax records normally need to be kept for at least five years after the relevant 31 January filing deadline, longer where HMRC rules or a specific dispute require it. This does not justify keeping all account activity for that period. We keep minimal acceptance, complaint and suppression evidence separately for its justified purpose.

Postmark normally retains message content and activity for 45 days; delivery suppression information may remain longer. Our recovery rotation keeps seven daily, four weekly and six monthly snapshots. Removing a snapshot and reclaiming its storage are separate operations; provider recovery copies may also have a further retention period. Backups are access-restricted, used for recovery and expire through maintenance. If a backup is restored, applicable deletion and suppression instructions must be reapplied before normal use resumes.

5. Your rights, objections and complaints

Depending on the applicable basis, you may request access, correction, erasure, restriction or portability, object to legitimate-interest processing and withdraw consent. You have an absolute right to object to direct marketing. We assess other objections in light of your circumstances. Some information may need to be retained; we explain the reason and applicable rights rather than treating every request as automatic deletion.

Email hello@firebidradar.co.uk, including if you are named in a public notice or no longer have account access. We normally respond to rights requests within one calendar month. Where the law permits a different deadline, an extension or necessary identity checks, we explain this. We seek only proportionate identity evidence. The signed-in Privacy page provides a limited account copy and a request form; that download is not the whole search for a formal access request.

For a data-protection complaint, describe what happened and the outcome you seek. We acknowledge it within 30 days, investigate without undue delay, keep you informed and explain our outcome. You may complain to the Information Commissioner's Office. You need not use our process to exercise your legal rights.

6. Cookies, storage and email tracking

The static public website uses local styles and images, a calculator that runs in your browser, and no advertising pixels or optional analytics. Calculator inputs are not transmitted to us or saved in browser storage. The application uses the following first-party storage for security and signed-in access:

• __Host-firebid_customer_csrf on app.firebidradar.co.uk protects forms against forged requests; up to 364 days; Secure, HttpOnly and SameSite=Lax, limited to that host.
• __Host-firebid_customer_session on app.firebidradar.co.uk authenticates the user and selected business workspace; browser-session cookie with a server-side maximum of 12 hours; Secure, HttpOnly and SameSite=Lax, limited to that host.
• Our private test environment uses fpr_csrftoken and fpr_sessionid for the corresponding purposes, durations and protections. Browser session-restoration settings may affect when a browser removes a session cookie.

Google sign-in uses our existing server-side session without adding a Google tracking script to our sign-in page. If you choose it, Google's own pages and cookies are governed by Google's notices and your choices with Google.

These cookies are necessary for the requested application functionality and are not used for marketing. The application's HTMX navigation has workspace history caching disabled, so it does not intentionally save workspace page snapshots in local storage. Refusing necessary storage can prevent sign-in or forms from working. External sites, including Stripe and the separate ChatGPT Sites host, use their own storage; this notice does not claim to describe every cookie on those domains.

Service email is configured to disable Postmark open and link tracking. We still process delivery outcomes, bounces and suppression information needed to operate email. Optional analytics, advertising or other non-essential storage requires a separate review and, where required, prior consent with an equally accessible refusal and withdrawal option. We do not treat consent to a subscription as marketing consent.

7. Changes

We update this notice when processing changes and communicate material changes to affected users. Changes to a notice do not by themselves authorise a new purpose or replace a required consent.