Privacy Policy & Data Protection Notice

1. Who We Are

1.1 This Privacy Policy applies to Fire Record, the fire risk assessment platform operated by Elevate Core LLC ("we", "us" or "our"). Fire Record is a trading name of Elevate Core LLC, a company registered in Georgia, whose registered address is Vake District, Zakaria Paliashvili Street, N 41, Entrance 1, Basement, Tbilisi, Georgia. Elevate Core LLC is registered with the UK Information Commissioner's Office (ICO) under registration number ZC292667.

1.2 For the purposes of UK GDPR, we act as:

• Data Controller for account and registration information relating to Users of the Software.
• Data Processor for personal data entered or recorded in the Software by Users in the course of carrying out fire risk assessments, including site walks.

1.3 Contact details for data protection matters:

1.4 Fire Record is for professionals and is not meant for anyone under 18.

UK Representative

Elevate Core LLC is not established in the UK. Under Article 27 of the UK GDPR, we have appointed Julianne Gibbons as our representative in the United Kingdom. You can contact our UK representative about any matter relating to our processing of your personal data at compliance@elevatecore.io.

2. Definitions

2.1 Software: the fire risk assessment platform operated by us, including the Site Walk app.

2.2 User: any individual or organisation using the Software.

2.3 Assessment Data: any data entered or recorded in the Software by Users relating to fire risk assessments, including building information, responsible persons, client information, site walks and associated documentation.

2.4 Personal Data: any information relating to an identified or identifiable individual.

3. Types of Data We Collect

3.1 Account Information

• Name
• Email address
• Telephone number (optional)
• Login credentials
• Account identifiers
• Billing information

3.2 Assessment Data

• Client names
• Client contact details
• Responsible person details
• Building addresses and building information
• Fire safety observations and notes, typed or dictated
• Photographs or documents uploaded during assessments
• Compliance records relating to fire safety management

3.3 Technical Data

• IP address
• Device information
• Browser type
• System logs
• Usage analytics
• Security monitoring data

3.4 Site Walk Data

• Voice recordings and photos from site walks
• Where each photo was taken, if you allow it
• Details of the device used

See section 12, "Site walks".

4. How We Collect Data

4.1 Personal data may be collected through:

• User registration
• Account management
• Data entered into assessments
• Site walks recorded in the Site Walk app
• Customer support interactions
• System logs and technical monitoring

4.2 Some information may be collected automatically through the operation of the Software for security and performance purposes.

5. Purposes of Processing

Personal data is processed for the following purposes:

• Creating and managing user accounts
• Providing access to and operating the Software
• Enabling Users to generate fire risk assessment documentation, including drafts made from site walks
• Storing and managing compliance records and assessment reports
• Providing technical support and service communications
• Maintaining system security and preventing misuse
• Improving the Software and developing new features
• Complying with legal or regulatory obligations

We do not sell personal data to third parties.

6. Legal Basis for Processing

6.1 We process personal data only where a lawful basis exists under Article 6 UK GDPR, including:

• Contractual necessity: processing necessary to provide the Software and fulfil contractual obligations.
• Legitimate interests: maintaining system security, improving the Software and operating our services.
• Legal obligations: complying with applicable laws, including record-keeping obligations relating to fire safety documentation.
• Consent: where Users voluntarily provide optional information or agree to receive communications.

6.2 Users may opt out of non-essential communications at any time.

6.3 Before your first site walk, the Site Walk app asks you to confirm that you understand how recordings are used. This confirmation is a safeguard. It is not the legal basis for processing, which remains as set out in 6.1.

7. User Responsibility for Client Data

Users may upload, input or record personal data relating to their clients, building occupants or responsible persons, including people heard on a site walk.

In relation to such information:

• The User acts as Data Controller
• We act as Data Processor

Users are responsible for ensuring they have lawful authority to collect and process personal data they enter or record in the Software.

8. Data Retention

The Software is designed for the storage of fire risk assessment documentation and compliance records. Data may therefore be retained to allow Users to:

• Access historical assessments
• Maintain compliance records
• Retain documentation required for regulatory or professional purposes

Site walks: see section 12, "How long we keep it".

Where an account is closed, we may delete or anonymise personal data within a reasonable time unless retention is required:

• To comply with legal obligations
• To resolve disputes
• To enforce contractual rights
• For legitimate system integrity or security purposes

9. Data Security

We implement appropriate technical and organisational security measures designed to protect personal data. Measures may include:

• Encrypted communications (HTTPS)
• Secure cloud infrastructure
• Access control systems
• Authentication protections
• Restricted internal access
• Monitoring and logging systems

However, no internet-based service can guarantee absolute security.

10. Third-Party Service Providers

We use trusted third-party service providers to operate the Software, in these categories:

• Cloud hosting and databases
• File storage, in the United Kingdom
• Sign-in and authentication
• AI services (see section 11)
• Payment processing
• Demo bookings and website services

These providers process personal data on our behalf, under contracts that require appropriate data protection safeguards. A list of our current providers is available on request at compliance@elevatecore.io.

11. AI in Fire Record

11.1 Fire Record uses AI to help assessors write their reports. When you use these features, what you type, dictate or record, and some of your photos, are sent to AI service providers acting for us, to turn them into text and draft report content and suggestions for you to review.

11.2 AI suggests and you decide. You check and finish everything before a report is issued.

11.3 Neither we nor the AI services we use train AI models on your data.

12. Site Walks

12.1 The Site Walk app records a fire risk assessor's walk around a building, so that Fire Record can turn it into a draft report.

12.2 What we collect

• Sound: what you say during the walk. It may also pick up other people nearby.
• Photos: the photos you take.
• Your entries in the app during the walk, and the client and building you choose.
• Location: where each photo was taken, only if you allow it. You can say no and still take photos. Your location is never tracked between photos.
• Device information: details of the device and app version you use, and error logs.

12.3 Why we use it

• To turn the walk into a draft report, with its photos, for you to check and finish.
• To help you cover the assessment while you walk.
• To keep the walk with your organisation's reports, as its record of the assessment.
• To keep the app working and fix problems.

12.4 Who is responsible for it

Your organisation decides what is assessed and recorded. As with the rest of its reports, it is the controller of its walks, including anyone recorded during them, and we process them for it (see section 1).

12.5 Who else processes it

AI service providers acting for us process the walk to produce the draft report (see section 11). Photos are only sent to them where needed to place a photo in the report.

12.6 Where it is kept

• Sound and photos: secure cloud storage in the United Kingdom.
• Fire Record's server and database: secure cloud hosting.
• The AI services: mostly in the United States (see section 13).

12.7 Who can see a walk

• In your organisation: the person who recorded it, and your organisation's admins.
• Reports made from a walk: anyone in your organisation who can see that report.
• Fire Record's own team: only when needed to help your organisation, fix a problem or keep the service safe.

12.8 How long we keep it

• On your device: until it is uploaded to Fire Record, then for a short period you can set in the app.
• In Fire Record: with your organisation's reports, until your organisation deletes the walk. A deleted walk stays in Recently deleted for 30 days, where it can be restored. It is then removed for good within 60 days of being deleted.
• Reports made from a walk keep their text and photos for as long as the report is kept.

12.9 Recording other people

• Tell people on site that you are recording.
• Do not record private conversations, and pause if someone asks you to.
• The screen always shows when you are recording, and a walk pauses itself after a period of inactivity.

12.10 Your choices

• Confirming and withdrawing. Before your first walk, the app asks you to confirm that you understand how recordings are used (see 6.3). You can withdraw this at any time in the app's Settings. Until you confirm again, you cannot record walks. Nothing already recorded is lost.
• Location. You can say no when your phone asks, or turn it off later in your phone's settings.
• Deleting a walk. In Fire Record or in the app (see 12.8).
• Deleting your account. In the app (Settings, then Privacy, then Delete my account) or at https://app.firerecord.co.uk/delete-account. We delete your account within 30 days. The reports and walks you made for your organisation stay with it, as its records, with your name and assessor details on them.
• Questions: compliance@elevatecore.io

13. International Data Transfers

Where personal data is transferred outside the United Kingdom, we ensure appropriate safeguards are in place. Some of our service providers, including the AI services in section 11, are in the United States. We use them only with a recognised safeguard, such as the UK–US data bridge or the UK International Data Transfer Addendum.

14. Data Subject Rights

14.1 Individuals have the following rights under UK GDPR:

• Right of access
• Right to rectification
• Right to erasure
• Right to restriction of processing
• Right to data portability
• Right to object to processing

14.2 Requests may be submitted to compliance@elevatecore.io.

14.3 If you are unhappy with how we handle your personal data, please contact us first at compliance@elevatecore.io. You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

15. Data Breaches

In the event of a personal data breach affecting personal data stored within the Software, we will:

• Investigate the incident promptly
• Take appropriate remedial actions
• Notify affected parties where required by law

16. Use of Anonymised Data

We may use anonymised or aggregated data derived from system usage or assessment information for the purpose of improving the Software, analysing performance and developing new features. Such data will not identify individuals.

17. Changes to This Policy

We may update this Privacy Policy from time to time. Updated versions will be published within the Software or on our website. Continued use of the Software after updates constitutes acceptance of the revised policy.

18. Contact

For questions or requests relating to data protection:

Our UK representative: Julianne Gibbons, compliance@elevatecore.io