Privacy policy.

1. Who we are

Freemi is a software company based in Dublin, Ireland. We build Freemi Custom, the operating system shaped to how your business works: bookings and payments, customer records and messages, invoices and gift cards, your website, newsletters and the books.

This policy covers this website and Freemi Custom. It is written for two audiences: the business deciding whether to use Freemi, and anyone who wants to understand what happens to information once it is in the system.

2. Controller or processor: the distinction that matters

Most of this policy turns on one point, so it comes first.

Freemi is the controller for a narrower set of things: the account details of the people who use the software, our billing records, the enquiries sent through this website, and the ordinary analytics described in our cookie policy.

This is not a technicality. It decides who a customer asks when they want a copy of their record, who answers a regulator, and who is accountable if something goes wrong. In every case involving your customers’ information, that is your business, with our help.

3. What we process

We do not buy personal data, we do not sell it, and we do not use your customers’ information to advertise anything to anyone.

4. Why we process it, and on what basis

Freemi Custom is not built to hold special-category data. If your business chooses to record any, the condition for processing it rests with your business as controller. Your data processing agreement with us sets out the instructions we act on.

5. Where your data is held

Your data is held with trusted cloud hosting providers, who may store and process it outside the EEA. It sits in your own workspace, never mixed with another business, behind a sign in.

We are an Irish company and the GDPR applies to what we do regardless of where the servers sit. If your business needs data held inside the EEA as a condition of using Freemi, tell us before you sign rather than after. It is a fair requirement and we would rather have the conversation early.

6. International transfers

Where personal data is transferred outside the EEA, those transfers rely on the safeguards our infrastructure and service providers put in place, principally the European Commission’s Standard Contractual Clauses, and, where the provider is certified, the EU-US Data Privacy Framework.

We will give you the current transfer documentation for every provider in the table below on request, in writing, as part of a due-diligence pack. We would rather send you the actual documents than a paragraph claiming they exist.

7. Sub-processors

These are the kinds of trusted providers that may process personal data on our behalf. The named list is available on request, as part of a due-diligence pack.

There is no analytics provider on this list, and that is deliberate. The page counts for this website run on our own infrastructure, inside our own hosting account. No separate analytics company receives anything.

We will tell you before adding a sub-processor that materially changes this picture, and you may object.

8. What the AI sees, and what it does not

Freemi drafts. Your team sends. That sentence is the whole design, and it has consequences worth spelling out.

• A model is sent the specific content needed for a specific task: classifying an incoming message, drafting a reply, or summarising a request. It is not given standing access to your database.
• Anything requiring professional judgement is routed to an authorised person rather than answered automatically. You decide, per workflow, what may run on its own, and your team signs that off before anything reaches a customer.
• The audit trail records which actions were automatic and which were taken by a person.
• You refine the rules over time. The system does not quietly change its own behaviour based on your customers.

9. How long we keep it

While you are a customer, your data remains in the system because that is what the system is for. Retention periods for customer and financial records are set by your own professional and statutory obligations, not by us, and your data processing agreement records what you have instructed.

When you leave: you export your data, and we delete our copy. Backups age out on their ordinary cycle rather than being surgically edited, and we will confirm the cycle in writing. Audit records of administrative actions are kept for their own retention period, because a log you can delete is not a log.

10. Your rights

Under the GDPR you have the right to be told what is held about you, to get a copy, to have mistakes corrected, to have data erased in some circumstances, to restrict or object to processing, to portability, and to complain to a supervisory authority. In Ireland that is the Data Protection Commission, dataprotection.ie.

Where Freemi is the controller, which is your own account details, our billing records and enquiries through this site, ask us and we will handle it.

11. If you are a customer

If you have asked the business and got nowhere, contact us anyway and we will make sure the request reaches the right person there.

12. Security

The detail lives on our security page. In short: roles are enforced on the server rather than by hiding buttons in the interface, so someone without permission is refused and the attempt is logged; every important action carries an actor, a timestamp and the values before and after; and the trail is exportable so you are never dependent on us to account for something.

We do not claim certifications we do not hold. If your due-diligence process needs a specific control evidenced, ask, and you will get a straight answer including where we fall short.

13. If something goes wrong

If a personal data breach affects your business, we will tell you without undue delay and in any case in time for you to meet your own 72-hour obligation as controller. You will get what happened, what was affected, what we have changed, and the audit trail. We would rather make an awkward call early than a worse one late.

14. Children

Freemi is sold to businesses, not to individuals, and this website is not directed at children. Customer records held by a business may relate to children, for example a booking made for a child; where they do, the business is the controller and its own safeguarding and consent arrangements apply.

15. Changes to this policy

If we change something that matters, we will change the date at the top and tell existing customers rather than relying on you to re-read the page. Adding a sub-processor, changing where data is held, or changing what the AI is permitted to do all count as mattering.

16. Contact

Use the contact page and say that your message is about privacy. A person reads it, and you will get a written reply. If you need a signed data processing agreement, a sub-processor list for a due-diligence pack, or answers to a security questionnaire, say so and we will send them.

The rest of it