Privacy policy

GENFIXS LIMITED is a company registered in England and Wales (Companies House number 16786301). Our registered office is 40 Edwin Court, Eccles, Manchester, England, M30 0YH. GENFIXS LIMITED is the controller for personal data collected through this website. We handle it under the UK GDPR and the Data Protection Act 2018.

Our ICO registration number is ZC132896.

There is no dedicated privacy mailbox. Privacy requests go to our info team through the contact form on this website.

The public pages do not ask you to create an account. If you use the contact form, we collect:

• your name
• your email address
• the message you write

The form is emailed so our info team can reply. We use that information to respond to your enquiry.

The dashboard is invite-only. If you are invited to sign in, we store the details needed to recognise you, including an email address and a session. We use those details to provide the signed-in service.

Hosting logs can include an IP address, browser type and the pages requested. We use those logs to keep the site secure and to diagnose faults.

We do not use analytics or advertising tools at the moment.

We do not sell personal data. These providers process it for us:

• Resend sends the contact-form email. Resend stores that data in the United States. Transfers from the United Kingdom rely on Resend’s certification under the UK Extension to the EU-US Data Privacy Framework, and on the UK Addendum to the EU Standard Contractual Clauses in Resend’s data processing addendum.
• Microsoft 365 (Outlook) receives the contact-form email. Microsoft is certified under the UK Extension to the EU-US Data Privacy Framework.
• Vercel hosts the site. Vercel’s primary processing facilities are in the United States. Transfers from the United Kingdom rely on Vercel’s certification under the UK Extension to the EU-US Data Privacy Framework, and on the UK International Data Transfer Addendum together with the EU Standard Contractual Clauses in Vercel’s data processing addendum.
• Supabase provides the PostgreSQL database used for invited dashboard accounts, and file storage for private documents when that storage is configured. Supabase’s data processing addendum uses the UK Addendum to the EU Standard Contractual Clauses for transfers from the United Kingdom.
• Google processes a sign-in when someone chooses Google. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework.

We may also share information if the law requires it, or to protect our rights, users or the public.

We keep contact messages for 2 years after the last contact, then delete them. Resend’s own published retention for email and log data on its platform is 30 days on the Free, Pro and Scale plans. The copy we keep for 2 years is the message received in Microsoft 365.

Hosting logs follow Vercel’s published runtime-log retention for the plan this site uses: 1 hour on Hobby, 1 day on Pro, 3 days on Enterprise, and 30 days when Observability Plus is enabled.

Under the UK GDPR you can ask to access, correct, erase, restrict or object to our use of your personal data, and to receive a copy where the right to data portability applies. You can also complain to the ICO.

Send a request through the contact form. We reply within one month. We may ask for proof of identity before we act on the request.

We do not set analytics or advertising cookies, and we do not show a cookie banner. The cookies below are strictly necessary for security or for a signed-in session.

On this site, sign-in uses these cookies. They are HTTP-only and SameSite=Lax. Over HTTPS the names are:

• __Secure-next-auth.session-token keeps you signed in. A large session may be split into numbered cookies with the same name. It lasts 30 days unless you sign out. It is limited to this website unless a parent-domain setting is turned on.
• __Host-next-auth.csrf-token protects the sign-in request from another site.
• __Secure-next-auth.callback-url remembers where to return after sign-in.
• __Secure-next-auth.state, __Secure-next-auth.pkce.code_verifier and __Secure-next-auth.nonce are set only during a Google sign-in. The state and code-verifier cookies last 15 minutes.

You can complain to the Information Commissioner's Office (ICO): ico.org.uk. Our ICO registration number is ZC132896.

When this policy changes, we update the date at the top of this page. We do not keep an archive of older versions.

See also the Terms of use.