Privacy Policy

INCOGNITO GROUP LTD. (“we”, “us”, “our”) is the data controller for personal data processed through Incognito Fire & Security Professional (“the Service”).

Incognito Fire & Security is a trading name of INCOGNITO GROUP LTD.

This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, how long we keep it, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

This policy describes the UK-based operator's current processing. Other privacy, consumer, transfer, localisation or representative requirements may apply depending on where you are located. Market and language controls do not themselves establish compliance with those laws; jurisdiction-specific review is ongoing and mandatory local rights are not excluded.

Questions or concerns about your personal data: support@incognitofiresecurity.com
Incognito Fire & Security is a trading name of INCOGNITO GROUP LTD.

Account data

When you register, we collect your email address, name, and (optionally) your company name. This data is necessary to create and manage your account and to communicate with you about the Service.

Usage data

We collect data about how you use the Service, including the queries and searches you submit to the AI assistant, fault database searches, session data, and feature usage counts. Query content is processed by our AI provider (Anthropic) to generate responses. We maintain rolling usage counts to enforce fair-use limits. Certain high-risk query categories may be logged in summary form (category and a short excerpt only) for safety monitoring and quality assurance purposes.

Subscription and billing data

We collect and store subscription identifiers, plan type, and subscription status to manage your subscription and verify your access level. For website subscriptions this may include Stripe customer and subscription IDs. For iOS in-app subscriptions this may include Apple product and transaction identifiers. We do not store your card number, expiry date, or CVV.

One-off support payment data

If you choose to leave a voluntary tip for free public content, Stripe collects the payment details and may return the amount, currency, payment status, provider reference, and payer name or email used at checkout. We use those details to administer the payment, investigate payment issues and keep accounting records. We do not receive or store your full card or bank details, and a support payment does not enrol you in marketing.

Technical and device data

We automatically collect technical data including your IP address, browser type, device type, operating system, and access timestamps. This data is used for security monitoring, abuse prevention, and service reliability, and may appear in server access logs maintained by our hosting provider (Vercel).

Support and feedback data

If you contact us for support or submit feedback, we collect the content of your communications and your email address to respond to you and to improve the Service.

Commercial enquiry data

If you submit the advertiser and sponsor enquiry form, we collect your name, work email, company, optional website, proposed placement, intended audience and message so we can assess and respond. The form does not subscribe you to marketing and the details are not placed in our aggregate monetisation event ledger.

Onboarding preferences

During onboarding or settings we may collect your selected country, optional jurisdiction or authority, language, unit preference, professional role, industry, experience level and preferred systems or manufacturers. This data personalises retrieval and presentation and is stored in your profile and/or a versioned browser preference. A temporary geographic hint may inform an initial suggestion, but it is not permanently saved as your chosen market without your action.

We use your personal data to:

• provide, operate, and maintain the Service;
• create and manage your account and verify your subscription status;
• process subscriptions and optional one-off support payments through Stripe;
• send transactional emails (account confirmation, password reset, billing receipts, service notices);
• enforce fair-use limits and service access controls;
• monitor for and prevent abuse, fraud, and security incidents;
• log high-risk queries in summary form for safety monitoring and quality assurance;
• respond to support requests, feedback and commercial enquiries;
• occasionally email people who have registered to ask, in a plain personal message, how the Service is working for them (see below); and
• improve and develop the Service (using aggregated, anonymised data where possible).

Service-improvement emails. We may email you a short, personal message asking what you were looking for when you registered and whether anything stopped you using the Service. We rely on our legitimate interest in improving the Service, use only your registered email address and (where you gave it) your first name, and do not send marketing in these messages. Every such email contains a link to opt out; opening that page changes nothing, and pressing its button adds your address to a suppression list so we do not send you another. You can also ask us to stop by replying or writing to support@incognitofiresecurity.com. We keep the address on the suppression list (and a record of which of these emails we sent you) for as long as needed to honour your request.

Challenge leaderboard. If you finish the free daily challenge you may add a nickname to that day's public leaderboard. The nickname and score are shown publicly and are not linked to an account; please do not use your real name. To allow one entry per network per day we store a salted hash of your IP address (never the address itself) with the entry. To have an entry removed, write to support@incognitofiresecurity.com with the nickname and date.

We do not sell your personal data to third parties. Private account, customer, site, report, calculation, diagnostic and engineering data is never offered to sponsors or advertisers. Incognito Fire & Security Professional, signed-in workflows and native apps remain free of commercial placements. Free public informational pages may contain clearly labelled, first-party sponsorship or affiliate links under our Commercial & Editorial Standards.

We share your personal data only with the following third-party processors, under data processing agreements, and only to the extent necessary to provide the Service:

• Supabase Inc. — provides our database, authentication, and backend hosting. Your account data, profile data, usage counts, and subscription records are stored in Supabase. Supabase operates data centres in the EU and US.
• Stripe, Inc. — hosts checkout, processes website subscriptions and optional one-off support payments, and stores payment method details. Stripe collects card or bank details directly; we receive limited transaction and payer details needed to administer the payment. Stripe may also process data for its own fraud, compliance and legal purposes as described in its privacy notice.
• Apple Inc. — processes iOS in-app subscription purchases and provides purchase receipts and transaction identifiers used to verify app access.
• Anthropic, PBC — provides the large language model (AI) that powers our assistant. The text of queries you submit to the AI assistant is sent to Anthropic’s API for processing. Anthropic is based in the United States; see section 10 regarding international transfers.
• Vercel Inc. — hosts the web application. Vercel processes server access logs including IP addresses and request metadata. Vercel operates globally with infrastructure in the EU and US.
• Resend — sends our transactional, service-improvement and commercial-enquiry email. It receives your email address, our message, and delivery status information.
• Google Analytics — processes optional public website usage data only after analytics consent. Google Analytics is not loaded in the native apps and is not an advertising profile for Incognito.

We may also disclose personal data if required to do so by law, court order, or by a regulatory or government authority, or where we believe disclosure is necessary to protect the rights, property, or safety of the Operator, our users, or others.

• Account data (email, name, profile): retained while your account is active and for 90 days after account deletion to allow reactivation and resolve post-deletion disputes.
• Subscription, support-payment and billing records: retained for the applicable customer relationship and up to 7 years where needed for statutory accounting, tax, fraud or dispute purposes.
• Usage counts: retained on a rolling basis for the duration of your subscription.
• High-risk query logs: retained for up to 24 months from the date of logging, then permanently deleted.
• Server access logs: retained for a short period (typically 30–90 days) for security purposes.
• Support communications: retained for up to 2 years after the last communication.
• Commercial enquiries: kept in restricted administrative email systems only while reasonably necessary to evaluate and respond. If a business relationship results, relevant correspondence may be kept for that relationship and applicable legal, accounting or dispute needs. Enquiry contact details are not copied into visitor analytics.
• Privacy-minimised commercial events: retained for up to 25 months before deletion or irreversible statistical roll-up. These rows exclude visitor, session, user and contact identifiers.

When data is no longer required, it is securely deleted or anonymised.

You have the following rights in relation to your personal data:

• Access: request a copy of the personal data we hold about you.
• Rectification: ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”): ask us to delete your personal data, subject to legal retention requirements (see section 8).
• Data portability: request your data in a structured, machine-readable format.
• Restriction of processing: ask us to restrict how we use your data in certain circumstances.
• Object: object to processing based on legitimate interests.
• Automated decision-making: we do not make solely automated decisions that produce legal or similarly significant effects about you.

To exercise any of these rights, email support@incognitofiresecurity.com with the subject line “Data Rights Request”. We will respond within one calendar month. We may need to verify your identity before processing your request.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

You can delete your account and request erasure of your personal data in one of two ways:

1. Via your account dashboard: go to Account settings and select “Delete Account”. You will be asked to type DELETE to confirm. This permanently deletes your account, profile, and associated data.
2. By email: send a request to support@incognitofiresecurity.com with the subject line “Data Deletion Request” and include the email address associated with your account. We will process your request within 30 days and confirm by email.

Following deletion, we will retain only the data we are legally required to keep (principally billing records for accounting purposes) and a minimal deletion audit record. All other personal data will be permanently deleted.

If you have an active paid subscription, please cancel it before requesting account deletion to avoid continued billing.

We use cookies and local storage entries necessary to operate the Service. Optional website analytics include Google Analytics and privacy-limited first-party conversion measurement used to understand aggregate traffic and the signup-to-subscription journey. We do not currently use advertising cookies, affiliate click tracking or third-party ad scripts, and we do not sell personal data.

• Authentication cookies (Supabase): session tokens that keep you signed in. These are strictly necessary and cannot be disabled while using the Service. They expire when you sign out or after a period of inactivity.
• Theme preference: a local storage entry recording your light/dark mode preference. Stored locally on your device only; not transmitted to our servers.
• Google Analytics: public page-view and event measurement used to understand which pages are being visited and where the website needs improvement.
• First-party conversion measurement: random browser visitor and session identifiers are replaced server-side with one-way pseudonymous hashes. Events contain only coarse page, channel, market, platform and action categories—not search text, AI prompts, reports, site details, names or email addresses.

We do not use Meta Pixel or advertising trackers. Static, clearly labelled first-party sponsor material may be displayed without tracking. Any future non-essential commercial measurement will require a separate choice; analytics consent will not be reused for that purpose.

Some of our third-party processors are based outside the UK. Your data may be transferred to and processed in the United States and other countries:

• Anthropic (US): query data sent to the AI assistant is processed in the United States. Transfers are safeguarded by the UK International Data Transfer Agreement (IDTA) or Standard Contractual Clauses (SCCs) as appropriate.
• Stripe (US): payment processing involves limited personal data transfer to the US. Stripe maintains SCCs and is certified under applicable international transfer frameworks.
• Supabase and Vercel: may use infrastructure in both the EU and US; transfers are conducted under appropriate safeguards.
• Resend and Google: email-delivery data and consented website analytics may be processed outside the UK. Transfers are governed by the relevant provider data-processing terms and an applicable UK transfer mechanism, such as adequacy regulations, the UK Addendum to SCCs or an IDTA.

We take steps to ensure that international transfers are made under appropriate safeguards that provide protection equivalent to UK GDPR requirements.

We take reasonable technical and organisational measures to protect your personal data, including:

• database row-level security enforced at the Supabase layer;
• server-side storage of all API secrets and credentials;
• HTTPS encryption for all data in transit; and
• authentication required to access all personal data.

No system is perfectly secure. If you believe your account has been compromised, please contact us immediately at support@incognitofiresecurity.com.

The Service is intended for professional use by adults (18+) in the fire and security industry. We do not knowingly collect personal data from persons under 18. If you believe a minor has registered, please contact us and we will delete their account promptly.

We may update this Privacy Policy from time to time. We will notify you of material changes by email and/or a prominent notice within the Service at least 14 days before the changes take effect. Where consent is the lawful basis for new processing, we will ask for it rather than treating continued use as consent.

For questions, concerns, or data rights requests:

Email: support@incognitofiresecurity.com
Incognito Fire & Security is a trading name of INCOGNITO GROUP LTD.

You also have the right to complain to the ICO: ico.org.uk/make-a-complaint | Tel: 0303 123 1113