Fireshift / Privacy
Privacy policy
Short version: we collect as little as we can, we don't sell it, and you can ask us to delete it any time by emailing hello@fireshift.ai.
Who we are
Fireshift is run by Nurkan Kirkan, an independent consultant based in Amsterdam, the Netherlands.
- Email: hello@fireshift.ai
- Postal address: [TO CONFIRM: business postal address]
- KvK (Dutch Chamber of Commerce) number: [TO CONFIRM: KvK number]
- VAT number: [TO CONFIRM: BTW/VAT ID]
Fireshift is the controller of the personal data described here, under the EU General Data Protection Regulation (GDPR).
What we collect and why
When you request a scan
The scan form asks for a website domain and your work email. We use them to run the scan, send you the result, and reply if you write back. If you buy something later, we use the same email to deliver it.
Legal basis: taking steps at your request before a contract (GDPR art. 6(1)(b)), and our legitimate interest in following up once about the scan you asked for (art. 6(1)(f)). We won't add you to a newsletter without asking.
When you email us
Your name, email address and whatever you write. We use it to answer you. Legal basis: legitimate interest in replying (art. 6(1)(f)).
When you pay (not live yet)
Payments will run through Lemon Squeezy, which acts as the merchant of record. Lemon Squeezy collects your card and billing details under its own privacy policy. We receive your name, email, country, what you bought and the amount. We never see your full card number. Legal basis: performing our contract with you (art. 6(1)(b)) and Dutch tax law (art. 6(1)(c)).
If we emailed you first
We sometimes email companies whose public website shows a tracking issue Fireshift can fix. We use a work email address published by the company or obtained from business data providers, your name and job title, the company name and domain, and what our scan saw on the public site. We only email company addresses, never personal ones, and we don't email businesses in Germany.
Legal basis: our legitimate interest in offering a relevant service to a business (art. 6(1)(f)). You can object at any time: reply "stop" or email hello@fireshift.ai, and we'll stop and keep only your email on a do-not-contact list so it doesn't happen again.
What we scan
A scan loads a website's public pages and records the tracking tags and network requests any visitor's browser would see. We don't submit forms, create accounts or log in. A scan is about a website, not about people, and we don't try to collect personal data through it.
What we don't do
- No analytics, advertising pixels or cookies on this website.
- No selling or renting of your data.
- No automated decisions with legal or similar effects on you.
Who processes data for us
| Provider | What for | Where |
|---|---|---|
| FormSubmit (formsubmit.co) | Forwards the scan form to our inbox | [TO CONFIRM: FormSubmit hosting location and transfer safeguard] |
| Microsoft 365 | Our email | EU/US; EU-US Data Privacy Framework and Standard Contractual Clauses |
| GitHub (Microsoft) | Hosts this website; sees your IP address when you load a page | US; EU-US Data Privacy Framework |
| Fontshare (Indian Type Foundry) and Google Fonts | Serve the fonts on this site; see your IP address when you load a page | Global CDNs |
| Lemon Squeezy (once payments go live) | Payments, invoices, tax (merchant of record) | US; Standard Contractual Clauses |
When data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
How long we keep it
- Scan requests (domain, email, result): 12 months, then deleted.
- Emails with you: 12 months after the last message, unless they belong to a customer relationship.
- Payment and invoice records: 7 years, because Dutch tax law requires it.
- Outbound prospect data: deleted when you opt out, or after 12 months with no reply.
- Do-not-contact list: your email only, kept for as long as we send outbound, so we can respect your opt-out.
Your rights
You can ask to see, correct, delete or export your data, to restrict how we use it, and to object to our use of it, including for direct marketing. Email hello@fireshift.ai. We'll answer within one month and may ask you to confirm it's your address.
You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority where you live. We'd appreciate the chance to fix it first.
Changes
If we change this policy, we'll update the date at the top. If a change matters for you, we'll tell you by email.