Privacy Policy

Last updated: September 14, 2026

This policy explains how Firmstead HQ collects, uses, stores and shares information when businesses use our website, applications and services.

Information we handle

We process account and company details, employee profiles and time records, GPS location data when an authorised business enables Team GPS, customer and vendor information, projects, tasks, estimates, change orders, invoices, payment references, inventory, orders, communications, and files uploaded by users. Stripe processes payment-card details; Firmstead HQ does not store complete card numbers.

Website analytics

We collect limited first-party usage information such as pages visited, an anonymous visitor identifier, general device category, referral source and country code supplied by our hosting provider. We use this information to understand adoption, improve reliability and prepare the service for wider availability. We do not record complete IP addresses in the analytics dashboard or sell analytics information.

Why we use information

We use information to provide and secure the service, apply permissions and subscriptions, process billing, send operational notices, support customers, prevent misuse, maintain audit records and improve reliability. We do not sell personal information.

Business customer responsibilities

The subscribing business controls the workforce, customer and business data it enters. It must provide appropriate notices, obtain any consent required for employee monitoring or GPS tracking, assign access carefully, and respond to relevant individual-rights requests. Firmstead HQ acts as a service provider or processor for that data.

Sharing and international processing

We share information only with service providers needed to operate the service, such as hosting, storage, email and payment providers, or when legally required. Providers may process information outside the user’s country subject to applicable safeguards.

Retention, deletion and rights

We retain information while an account is active and as needed for security, legal and financial obligations. A confirmed deletion request enters a 30-day recovery period before scheduled deletion, except where law requires retention. Depending on location, individuals may have rights to access, correct, delete, restrict or object to processing and complain to a regulator.

Security and children

We use access controls, encrypted transport, password hashing, restricted sessions and company-level separation. No online service is risk-free. Firmstead HQ is a business service and is not directed to children.

Contact

Privacy questions and rights requests can be sent through the support page. A business customer’s employees should normally contact their employer first.