This Privacy Notice applies to firehub.no and FacilityFlow AS's related partner, investor and pilot portals, contact forms, waitlists and other website-based interactions. It does not apply to the FireHub application at app.firehub.no, which is covered by a separate Privacy Notice.
1. Who we are
FacilityFlow AS develops and provides FireHub.
| Information | Details |
|---|---|
| Legal entity | FacilityFlow AS |
| Organisation number | 929 273 885 |
| Business address | Ingemann Torps vei 9, 7040 Trondheim, Norway |
| Privacy contact | contact@firehub.no |
2. When this notice applies
FacilityFlow AS is the controller of personal data collected through the website and portals where we determine the purposes and means of the processing.
- enquiries submitted through contact forms and other forms on firehub.no
- registrations to "Get started" with FireHub and other waitlists
- partner, investor and pilot portals
- meeting bookings, feedback and follow-up of enquiries
- NDA processes and related documentation where these are used
- technical security logs connected to the website and portals
When a customer uses the FireHub application to process information relating to its own buildings, employees, residents, tenants or suppliers, that processing is governed separately. Please see the Privacy Notice for the FireHub Application and the customer's Data Processing Agreement.
3. What information we process and why
3.1 Enquiries and contact forms
We may process your name, email address, telephone number if provided, organisation, role, position, the address of the building, number of buildings, the content of your message, the page from which the enquiry originated and any attachments.
The purpose is to respond to and follow up your enquiry. The legal basis will normally be our legitimate interest in responding to enquiries, or taking steps at your request before entering into a contract, under Article 6(1)(f) or Article 6(1)(b) of the GDPR.
3.2 Waitlists and "Get started" registrations
When you register your interest in FireHub, FireHub Personal or another waitlist, we process your contact details and the information you choose to provide so that we can follow up your interest and provide relevant information about availability.
Where the registration is based on consent, you may withdraw that consent at any time.
3.3 Partner, investor and pilot portals
We may process your name, email address, organisation, role, application responses, documents, meeting history and other information you choose to submit. The purpose is to assess and follow up on potential partnerships, investments, pilots and other business relationships.
The legal basis will normally be taking steps before entering into a contract or our legitimate interest in managing and assessing these enquiries.
3.4 NDA and signing processes
If an NDA or another agreement is signed through a portal, we process the information necessary to document the signature and the contractual relationship. If an external identity verification or electronic signature provider is used, relevant privacy information will be provided as part of the signing process.
3.5 Security and operations
We may process IP addresses, browser type, timestamps, login information and technical events to protect the website and portals, detect misuse and troubleshoot technical issues. The legal basis is our legitimate interest in maintaining secure and stable services.
3.6 Bot protection
Forms may use Cloudflare Turnstile to distinguish genuine users from automated traffic and abuse. The service processes technical signals necessary to perform the security check, including IP address and information about the browser environment. Turnstile does not receive the content you enter into the form itself.
3.7 Sales, customer service and feedback: reading with AI
Enquiries to FireHub, for example from the contact form, by e-mail or as feedback, are read and sorted by an AI service from Anthropic. The purpose is to sort the enquiry, pick out the contact details and suggest who should follow it up. A person at FireHub reviews the suggestion before anything is sent or decided.
What goes to Anthropic: name, contact details, address and the content of the enquiry. The legal basis is the same as for the enquiry itself, see section 3.1. Anthropic processes the data on FireHub's behalf and may not use it for anything else.
3.8 The FireHub portal: the customer's documents, buildings and roles
When a customer uses the FireHub portal, FireHub processes the customer's documents, information about the buildings and the roles of the people connected to them. The purpose is to read and organise the documentation, show what exists, what is missing and what needs follow-up, and keep the history. Here the customer is the controller and FireHub the processor, under the data processing agreement with the customer.
The portal uses these sub-processors: Supabase (database and document storage), Netlify (running the portal), Resend (e-mail) and Anthropic (AI reading of the documents). The documents, building information and roles go to Supabase and Anthropic. Names and e-mail addresses also go to Resend when the portal sends e-mail.
3.9 An account when you contact us
When you send the contact form, we create an account for you on the email address you give. We send a code and a link to that address. The account can only be used once you have entered the code or used the link, and chosen a password. If you already have an account with us, we do not create a new one, but send you an email asking you to sign in.
In the account you see your enquiry and what we write to each other. You can add the buildings, who else should follow the enquiry, suggested times for a meeting and documentation you have.
We process your name, email address, telephone number, organisation, position, address, information about the buildings, the messages between us and the files you upload. We also retrieve public information about the building from the Norwegian Mapping Authority (Kartverket) and about the organisation from the Brønnøysund Register Centre. The code is not stored in plain text. It is valid for 15 minutes, and the link for one day.
The purpose is to respond to the enquiry and prepare any offer. The legal basis is taking steps before entering into a contract and our legitimate interest in following up the enquiry, under Article 6(1)(b) and Article 6(1)(f) of the GDPR. If the enquiry comes through one of our partners, the partner sees what is needed to follow it up.
4. Service providers and processing on our behalf
We use external service providers where necessary to operate the website and portals. They may process personal data only in accordance with their contractual obligations and for the purposes for which the relevant service is used.
| Provider | Purpose | Primary processing location or note |
|---|---|---|
| Supabase | Database, authentication and portal data | AWS eu-west-1, Ireland, for the relevant FireHub portal project |
| Netlify | Hosting and delivery of the website or portal where Netlify is used in production | Global infrastructure. Transfers outside the EEA are governed by the provider's data processing terms and an applicable transfer mechanism |
| Resend | Transactional email and notifications | Resend states that customer data is stored in the United States. Transfers are governed by contractual safeguards and the provider's applicable transfer mechanisms |
| Cloudflare | Turnstile bot protection and security | Global processing may occur. Transfers are governed by Cloudflare's data processing terms and the applicable transfer mechanism |
| Anthropic | AI reading and sorting of enquiries (section 3.7), and AI reading of the customer's documents in the portal (section 3.8) | United States. Transfers are governed by Anthropic's data processing terms and an applicable transfer mechanism |
We do not sell personal data.
5. Transfers outside the EU and EEA
Some providers may process personal data outside the EU and EEA. Where this occurs, we use a valid transfer mechanism under Chapter V of the GDPR, such as an adequacy decision, the European Commission's Standard Contractual Clauses or another lawful mechanism, together with any required safeguards.
6. How long we keep information
We retain personal data for as long as necessary for the purpose for which it was collected and, after that, only where we have a legitimate or legal reason to retain it.
- Enquiries and applications are deleted or anonymised once follow-up has ended and we no longer need to retain the history.
- An account created when you contacted us is deleted when you ask, or when the enquiry has ended. If the account has had no activity and no sign-in for 90 days, we review it and delete it if the enquiry is not to be followed up. If you become a customer, the agreement applies.
- Waitlist data is deleted when the purpose has been fulfilled, you unsubscribe, or the information is no longer necessary.
- Contract and NDA documentation may be retained for as long as necessary to document the contractual relationship or protect legal claims.
- Security logs are retained only for as long as necessary for security, troubleshooting and documentation of incidents.
- Information that must be retained by law is kept for the period required by law.
7. Cookies and analytics
Strictly necessary cookies and similar technologies may be used for security, login and essential technical functionality.
Optional analytics or marketing technologies are activated only where there is a valid legal basis and, where required, after you have given consent. The relevant tools and purposes will be described in the website's cookie settings before they are activated.
PostHog, which has been selected for product analytics in the FireHub application itself, is not covered by this website notice unless it is later also activated on firehub.no.
8. Your rights
Under applicable data protection law, you may have the right to access, rectify or erase your personal data, restrict processing, receive your data in a portable format and object to processing based on legitimate interests. You may withdraw consent at any time without affecting the lawfulness of processing carried out before the withdrawal.
Contact us at contact@firehub.no if you wish to exercise your rights. We will respond within the time limits required by applicable data protection law.
You may also lodge a complaint with the Norwegian Data Protection Authority if you believe your personal data is being processed unlawfully.
9. Security
We use technical and organisational measures such as access controls, encrypted communications, role-based access, logging and security controls to protect personal data against unauthorised access, alteration, loss or misuse.
10. Changes
We update this notice when our services, providers or processing activities change. The current version will be published on firehub.no.
11. Contact
FacilityFlow AS Organisation number 929 273 885 Ingemann Torps vei 9, 7040 Trondheim, Norway Email: contact@firehub.no