Fire Risk Assessment — privacy notice
TO ACTION CIC, company 17515320, c/o Life Dronfield, 21–23 Church Street, Dronfield, Derbyshire, S18 1QB is responsible for account administration, purchases and operating this service. Contact hello@toaction.co.uk about your information or rights.
Information and purposes
We process account email addresses; organisation membership, permissions and assessment assignments; authentication, MFA and session information; building and assessment details; answers, actions, uploaded photos and reports; payment references and status; accepted terms and consent; and necessary security, retry and delivery records. Stripe handles payment-card information; the app does not store your complete card details.
We use account and purchase information to provide and administer the service under the contract, necessary security and reliability information for our legitimate interests in protecting the service and its users, and required financial information to meet legal obligations. Where you act for an organisation, we use necessary business-contact information to manage that relationship. We do not use assessment contents for advertising or sell personal information.
Your organisation determines why personal information is included in its assessment. For that content, it remains the controller and To Action processes it on its documented instructions under the organisation data-processing terms. We independently control the account, billing and security information described above. Avoid uploading unnecessary personal or sensitive information. Contact the organisation first about information it has placed in an assessment; we will assist it where required.
Providers and access
The existing services are Supabase (authentication, database and private files), Vercel (hosting), Stripe (payments), and Resend (transactional email). The mapped Supabase primary project is in London, eu-west-2. That project location is not a promise that every provider, support process or subprocessor operates only in the UK. Provider processing and international-transfer arrangements must be documented before launch; obtain details and applicable safeguards from hello@toaction.co.uk.
Access is restricted by organisation, assessment assignment and current permissions, including private downloads. Restricted operational access is for administration, security and support; it does not give staff permission to impersonate users or silently remove MFA. Reports are sent only to the current authorised assignee; purchase confirmations go to the verified purchaser captured for the purchase.
Retention
Paid assessment access lasts six calendar months. Active assessment answers, photos, reports, cached attachments and content-bearing history are deleted 30 days after access ends. This does not erase required financial references, the accepted contract, or minimal audit and deletion evidence. Those records are retained only as needed for accounting/legal obligations, security incidents or resolving claims. Account and membership information remains while needed to operate the account or other active services; contact us to request closure.
The mapped Supabase Pro dashboard currently retains seven daily database backups. Database backups contain file metadata, not the actual Storage API file bytes. Separate file-backup arrangements and provider delivery/security records have their own retention schedules. They are restricted and not available as renewed customer access. Restoration must reconcile expired access, prior deletion and payment/delivery state before normal operation resumes. A customer’s downloaded copy or email in their own mailbox is outside our deletion control. Historical purchases retain their accepted terms.
Your choices and rights
You can ask for access, correction, deletion, restriction or a portable copy where applicable, and object to processing based on legitimate interests. Rights depend on the processing and legal requirements; we may need to verify your identity. You can complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. Contact us first if you would like us to investigate.
The service uses essential session/security cookies for sign-in and access control. This notice does not authorise marketing or optional tracking. We do not make decisions with legal or similarly significant effects solely by automated profiling. We publish material notice changes and preserve the terms relevant to an existing purchase.
Document version: fra-live-privacy-20261019-v1