Privacy Policy

This policy explains what personal data we collect through firma.ai, why we collect it, who we share it with, and what you can ask us to do about it. It covers this website only. It does not cover the Firma software you run in your own environment, which processes data on your infrastructure under your control.

1. Who we are

Firma AI, Inc. is a Delaware corporation and is the controller of the personal data described in this policy. You can reach us at privacy@firma.ai.

Our registered office in the State of Delaware is 1209 Orange Street, Wilmington, New Castle County, Delaware 19801, and our registered agent at that address is The Corporation Trust Company. Legal notices may be served there. For anything to do with your data, please use the email address above, which reaches us directly.

2. What we collect

Information you give us. The demo request form on this site collects:

• your name
• your work email address
• your company
• your role, which is optional
• anything you choose to write in the free text field about the agents you run

That is the only form on the site, and those are the only fields. If you email us instead, we hold whatever you put in the email.

Information collected automatically. Our hosting provider records standard web server data on every request: IP address, browser user agent, the page requested, and a timestamp. This is used to serve the site and to detect abuse.

Analytics, only if you agree. We use Google Analytics to understand how the site is used, which pages people read and where visitors arrive from. It sets cookies in your browser and collects your approximate location derived from your IP address, your device and browser, the pages you view and how you move between them. None of this happens until you accept: on arrival it runs in a mode that stores nothing and sends no identifier. We do not use it for advertising, we have not enabled Google Signals or ad personalisation, and we do not attempt to identify individual visitors from it. We do not run advertising trackers or session recording on this site.

The walkthrough videos are embedded from Google Drive and are held back behind a placeholder until you accept cookies or press the button on the video. Our typefaces load from Google Fonts on every page, which tells Google your IP address, and is the one third-party request that happens before you can decide. The Cookie Policy covers all of this, and the Cookie settings link in the footer lets you change your answer at any time.

3. Why we use it, and our legal basis

• To answer your demo request and talk to you about Firma. Legal basis: steps taken at your request before entering a contract, GDPR Article 6(1)(b).
• To keep a record of who we have spoken to and follow up. Legal basis: our legitimate interest in running and growing the business, GDPR Article 6(1)(f).
• To keep the site available and secure. Legal basis: our legitimate interest in protecting our systems, GDPR Article 6(1)(f).
• To measure how the site is used, through Google Analytics. Legal basis: your consent, GDPR Article 6(1)(a), together with Article 5(3) of the ePrivacy Directive for storing the cookies. You can withdraw consent at any time, and the Cookie Policy explains how.

We do not use your data to train models, and we do not use it for automated decision-making or profiling.

4. Who we share it with

We do not sell personal data, and we do not share it for cross-context behavioural advertising. We use a small number of service providers who process data on our instructions:

• Netlify, for website hosting.
• Formspree, for receiving and storing demo requests submitted through the form.
• Google Workspace, for email and for storing the demo requests we receive.
• Slack, where a notification of each demo request is posted to a private internal channel.
• Google Analytics, for measuring how the site is used.

We will also disclose personal data where we are legally required to, or to establish or defend legal claims.

5. Where your data goes

We are based in the United States and our providers, including Formspree, process data in the United States. If you are in the European Economic Area, the United Kingdom, or Switzerland, your data is transferred outside your region. We rely on the European Commission's Standard Contractual Clauses, and the UK Addendum where applicable, as the transfer mechanism.

6. How long we keep it

• Demo requests and email correspondence: 24 months from our last contact with you, then deleted. Ask us sooner and we will delete it sooner. Our form provider keeps a copy for 30 days, after which the record we hold is the one in our own inbox.
• Server logs: retained by our hosting provider for a short period, currently 30 days, then discarded.
• Analytics data: retained by Google for 14 months from a visitor's last activity, then deleted automatically. The analytics cookies themselves expire after 24 months, or sooner if you clear them.

7. Your rights

If you are in the EEA, the UK, or Switzerland, you have the right to access your data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive a copy in a portable format, and to withdraw consent where we rely on it. You also have the right to complain to your national data protection authority.

If you are a California resident, you have the right to know what we collect and why, to request deletion, to request correction, to opt out of the sale or sharing of personal information, and not to be discriminated against for exercising any of these rights. We do not sell or share personal information, so there is nothing to opt out of, but the right stands.

To exercise any right, email privacy@firma.ai. We will respond within 30 days. We may ask you to confirm your identity first, so that we do not hand your data to someone else.

8. How we protect it

The site is served over HTTPS. Access to demo requests is limited to the people at Firma who need it, on accounts protected by multi-factor authentication. No system is perfectly secure, and we do not claim otherwise.

9. Children

This site is aimed at businesses. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe we have, write to us and we will delete it.

10. Changes to this policy

If we change this policy we will publish the new version here and update the date at the top. If the change is significant and we hold your contact details, we will tell you directly.

11. Contact

Questions, requests, or complaints: privacy@firma.ai.