Privacy Policy

Last updated: 5 July 2026 · Data controller: freedompms

1. Who we are

freedompms operates FreeDom at app.freedompms.com. For privacy enquiries: support@freedompms.com.

2. Scope

This Policy explains how we collect, use, store, and share personal data when you use the Service, visit our app, or contact us. It applies to individual users. Corporate or team offerings may be covered by separate agreements later.

3. Data we collect

Account data: email address, authentication identifiers, subscription status (free/Pro), and profile fields stored in our database.
Project data: tasks, programmes, surveys, meetings, notes, contacts, key dates, uploaded images/logos, and related metadata you enter in the app.
Payment data: billing is processed by Stripe. We receive customer IDs, subscription status, and limited billing metadata — not full card numbers.
Technical data: IP address, browser/device type, session tokens, error logs, and usage data needed to run and secure the Service.
Local device data: the PWA may store cached data and offline queues in your browser/local storage on your device.
Communications: emails you send us and transactional emails we send (e.g. magic links).

4. How we use data

Provide, operate, and maintain the Service (including sync and offline features).
Authenticate users and manage subscriptions.
Process payments and prevent fraud.
Send service-related emails (magic links, account notices).
Improve reliability, security, and support.
Comply with legal obligations.

We do not sell your personal data.

5. Legal bases (UK GDPR)

Contract: to provide the Service you request.
Legitimate interests: security, fraud prevention, service improvement, and communicating about your account — balanced against your rights.
Legal obligation: where required by law (e.g. tax or regulatory requests).
Consent: where we rely on consent (e.g. optional marketing if introduced later), you may withdraw at any time.

6. Processors and sharing

We use trusted providers who process data on our instructions:

Supabase — database, authentication, file storage.
Stripe — payment processing.
Resend (or equivalent) — transactional email delivery.
Netlify — application hosting.

We may also disclose data if required by law, to protect rights and safety, or in connection with a business transfer (e.g. incorporation or sale), with appropriate safeguards.

7. International transfers

Some providers may process data outside the UK/EEA. Where this occurs, we rely on appropriate safeguards (such as UK IDTA/standard contractual clauses or provider certifications) as applicable. Details are available from providers’ documentation or on request.

8. Retention

Account and project data: retained while your account is active and for a reasonable period afterward to allow recovery, resolve disputes, or meet legal obligations.
Billing records: retained as required for tax and accounting (typically up to 6 years in the UK).
Logs and security data: retained for limited periods unless needed longer for investigation.

You may request deletion (see Section 10). Deletion may be irreversible. You are responsible for exporting or backing up data you need before deletion.

9. Security

We use industry-standard measures including encrypted connections (HTTPS), access controls, and row-level security in our database. No method of transmission or storage is 100% secure. We cannot guarantee absolute security and are not liable for unauthorised access beyond our reasonable control (see our Terms of Service).

10. Your rights

Under UK data protection law you may have the right to:

Access your personal data.
Correct inaccurate data.
Request erasure (subject to legal exceptions).
Restrict or object to certain processing.
Data portability where applicable.
Withdraw consent where processing is consent-based.
Lodge a complaint with the UK Information Commissioner’s Office (ICO).

To exercise rights, email support@freedompms.com. We may need to verify your identity. We respond within one month where required.

11. Children

The Service is not intended for users under 16. We do not knowingly collect data from children. Contact us if you believe a child has provided data.

12. Cookies and local storage

We use essential cookies/local storage for authentication, session management, theme preferences, offline cache, and sync queues. These are necessary for the Service to function. If we add non-essential analytics or marketing cookies later, we will update this Policy and obtain consent where required.

13. Changes

We may update this Policy from time to time. The “Last updated” date will change. Material changes may be notified by email or in-app notice where appropriate.

14. Contact

Privacy requests and questions: support@freedompms.com