Privacy policy
Last updated: 1 November 2026
1. Who we are
FIRME (“we”) is committed to protecting its users’ personal information. This policy explains what information we collect when you use firme.co.uk, plan.firme.ca and the growth diagnostic tool, why we collect it, how we use and protect it, and what your rights are. For visitors and customers in the United Kingdom, it is written taking into account the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
FIRME is a business based in Quebec, Canada, and is the controller of the personal information described in this policy. Requests regarding your personal information are handled by the person in charge of the protection of personal information at FIRME, at bonjour@firme.ca.
2. Information we collect
What you provide to us:
- your business name and the description of your situation;
- the information about your business that you confirm or complete (sector, location, website, etc.);
- the competitors you keep or add;
- your answers about your marketing, your technology tools and your operations;
- your email address and the verification code you enter.
What is collected automatically:
- a random session identifier, kept in your browser;
- technical information (IP address, device and browser type, date and time of the visit) processed by the infrastructure hosting the Service, for operation and security purposes.
Public sources: to produce the diagnostic, we consult public information about your business, your website and your competitors (websites, search engines, etc.).
This information generally concerns a business. However, it can be personal information when it identifies a person (your email, the name of an executive, a sole proprietorship).
When you make a purchase. Payment for the complete action plan is processed by Stripe. We neither receive nor keep your card number; we only receive the payment confirmation, your name, your email and the amount, in order to prepare and deliver your plan.
3. Why we use it
- provide you with the diagnostic, the analysis of your competitors, the analysis of your website and your action plan;
- confirm your email with a code and give you access to the complete version of your plan;
- save your analyses so you can find them;
- ensure the operation, security and maintenance of the Service;
- respond to your requests.
We do not use your information for other purposes without your consent. We do not sell it, and we do not send you commercial communications without your consent.
4. Legal bases
Under UK GDPR, we rely on: performance of a contract (providing the diagnostic, your space and your subscription); consent (audience measurement cookies and any optional communications, which you may withdraw at any time); legitimate interests (security, preventing abuse and improving the Service); and legal obligation (for example accounting records). Withdrawing consent does not affect processing already carried out, and may prevent us from providing some features.
5. Artificial intelligence
The diagnostic is produced using automated analysis tools and artificial intelligence. To do this, the content you enter (for example the description of your situation) is sent to technology service providers that carry out this processing for us.
In plan.firme.ca, when you use an AI tool (for example replying to a review or preparing a follow-up), the text needed is sent to the AI provider, including, where applicable, the name of a review author or of a contact you entered. This text is used only to produce the result you asked for. Only enter the information needed in these tools.
For this reason, do not enter sensitive personal information or information about other people. The results are recommendations for information purposes: the Service makes no decision about you and may be wrong.
6. Disclosure to third parties
We neither sell nor rent your information. We only disclose it to our service providers, to the extent necessary: hosting and IT infrastructure, sending emails (verification code), artificial intelligence and public information search. These providers may only use the information to provide their services to us.
We may also disclose information when the law requires or permits it, or as part of a business transaction (for example a sale or a merger), subject to confidentiality commitments.
International transfers. FIRME is based in Canada, and some of our providers host or process information outside the United Kingdom, particularly in Canada, the United States and the European Union. Where information is transferred outside the UK, we rely on the safeguards recognised by UK law, such as adequacy regulations or the contractual clauses offered by our providers, and we take reasonable measures to ensure it is adequately protected.
Our main service providers
To provide the Service, some data may be processed by these providers, most of them outside the United Kingdom (particularly in the United States, Canada and the European Union):
- Cloudflare (servers, database)
- Google Firebase (website hosting)
- Artificial intelligence providers (analysis and writing of results; servers in the European Union and the United States)
- Additional web search tools (public information about the business)
- Serper (public information search about the business)
- Google PageSpeed (speed of the analysed website)
- OpenStreetMap (location and nearby businesses)
- Resend (sending emails)
- Stripe (payment)
- Google Analytics (visit statistics)
- Meta (Facebook and Instagram): measuring the effectiveness of our ads
7. Local storage, cookies and fonts
The Service uses your browser’s local storage to keep a random session identifier, the state of your analysis in progress and temporary results that avoid redoing the same analyses. This data stays in your browser, is reused for a maximum of 7 days and can be cleared at any time in your browser settings (site data).
Audience measurement. With your consent, given through the banner shown at the bottom of the site, we use Google Analytics to measure site traffic and purchases, and the Meta pixel (Facebook and Instagram) to measure the effectiveness of our ads. The Meta pixel receives neither your email nor your phone number. These cookies are only activated if you click “Accept”. If you decline, Google only receives anonymous signals, without cookies. You can change your mind at any time by clearing the site’s data in your browser: the banner will appear again.
The site’s fonts (Inter) are loaded from Google Fonts: your browser then communicates with Google’s servers, which may receive your IP address.
8. Retention
We keep your information only as long as necessary for the purposes described in this policy, then we destroy or anonymize it. Saved analyses linked to your email are kept so you can find them, until you ask for their deletion or they are no longer needed.
9. Security
We apply reasonable measures to protect your information: encrypted connections (HTTPS), limited access to data and email verification by code. However, no method of transmission or storage is infallible.
In the event of a personal data breach that is likely to put your rights at risk, we will notify the competent authorities and, where required, the affected persons, as required by law.
10. Your rights
Subject to the exceptions provided by law, you may:
- access the personal information we hold about you;
- request its correction;
- request its erasure;
- request that its processing be restricted;
- object to processing based on our legitimate interests;
- withdraw your consent at any time;
- receive your information in a structured, commonly used, machine-readable format (portability).
To exercise these rights, write to bonjour@firme.ca. We may ask you to confirm your identity, for example from the email used in the Service. We respond within one month of receiving your request.
11. Complaints
If you believe your rights are not being respected, first contact FIRME’s person in charge of the protection of personal information. You also have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (ICO).
12. Minors
The Service is intended for entrepreneurs and businesses. It is not intended for minors and we do not knowingly collect their personal information.
13. Changes to this policy
We may update this policy. The date of the last update appears at the top of the page. In the event of a significant change, we will inform you in a reasonable way, for example through a notice on the site.
14. Client space, public pages and customer book
What we keep. If you use plan.firme.ca, we keep your email, your progress, your tasks, your weekly results, the competitors you add, as well as the content of your business page or website (texts and images).
What is public. The information you choose to publish on your page or website (business name, contact details, photos, texts) is visible to everyone at its public address on FIRME. You can hide or remove it at any time from plan.firme.ca.
Visitors to your page. When a visitor uses the “Contact us” form, their name, contact details and message are sent by email to the business concerned and added to its customer book. The business is responsible for how it uses this information; FIRME keeps it on its behalf, only to provide the Service.
Customer book. The contacts you add to your customer book are kept for you, confidentially. You are responsible for having the right to keep this information and to use it in accordance with applicable laws.
Payment. Payment for the plan is processed by Stripe. We neither receive nor keep your card number; we only receive the payment confirmation, the amount and the email used.
Deletion. To delete your space, your page or your website, write to us: we delete this information within one month, except what the law requires us to keep.