Privacy Policy
This policy explains what personal data EdgeFirm collects through edgefirm.io, why we collect it, who receives it, how long we keep it, and how you can see, change or remove it. If anything here is unclear, ask us and we will explain it.
1. Who we are and how to reach us
EdgeFirm is a group of three companies that work together:
- EdgeFirm LLC, Austin, Texas, United States
- EDGEFIRM LTD, United Kingdom, company number 15421996
- EdgeFirm (Private) Limited, Pakistan, where our team is based
The company responsible for your data (the "controller") is EDGEFIRM LTD if you are in the UK or the EEA, and EdgeFirm LLC if you are anywhere else. The three companies share enquiry data with each other, and we protect it with the safeguards in section 8.
Privacy contact: privacy@edgefirm.io. Quebec residents: write to the same address and ask for the person in charge of the protection of personal information.
2. What this policy covers
It covers visits to edgefirm.io and its landing pages, enquiries sent through our forms, emails you send us, calls you book with us, our marketing emails, and job applications.
It does not cover:
- Data we handle for our clients. When we build or run a system for a client, we act on the client's instructions and the client's privacy notice applies. If you are a customer or employee of one of our clients, please contact that client. If you contact us instead, we pass your request to the client within 7 working days, tell you we have done so, and help the client answer it.
- Other websites. Links to LinkedIn, Meta, HubSpot or any other site are covered by their own policies.
3. What we collect and why
| What | When we collect it | Why | Legal basis (UK and EEA) |
|---|---|---|---|
| Name, work email, company, phone, what you are looking for, budget range, project description | You submit the contact form, a landing page form, or the AI Framework form | To reply, scope your project and send the file you asked for | Steps you asked for before a contract, or our legitimate interest in answering business enquiries |
| The same details, before you press submit | Only if you tick the optional "keep my details" box. We save once, about 5 seconds after you type a valid email. If you untick the box, we delete what was saved | To follow up if you do not finish | Consent |
| Your choice about marketing emails, the notice version shown to you, and the time | Every form submission | To email you only if you agreed, and to prove what you agreed to | Consent, and our legal duty to keep a record of it |
| Call booking details: name, email, phone, time, and anything you type into the booking form | You book a call through HubSpot Meetings | To hold the meeting | Steps you asked for before a contract |
| Emails you send us, our replies, and our notes from calls | You write to us or talk to us | To answer you and run the project | Steps before a contract, or legitimate interests |
| Job applications: your CV and anything you send with it | You email an application to us | To assess your application | Steps before a contract, or legitimate interests |
| Bot-check data from Cloudflare Turnstile (browser and device signals, IP address) | Forms | To block spam and abuse | Legitimate interests |
| IP address, held in memory for up to 10 minutes | Form submissions | To limit repeated submissions | Legitimate interests |
| Approximate country, taken from your IP address by our host. We do not store it | When you open our pricing page | To suggest the right regional pricing page | Legitimate interests |
| Server logs: IP address, browser, pages, time | Every request | Security and reliability | Legitimate interests |
| Page views, device and browser data | Only if you accept analytics cookies | To see which pages are useful | Consent |
| Advertising data from the Meta Pixel and LinkedIn Insight Tag | Only if you accept marketing cookies | To measure our ads and show them to relevant people | Consent |
| Hashed email, phone, first name and last name, sent from our server to Meta | Only when you have accepted marketing cookies and submit the AI Framework form | To measure which ads lead to enquiries and calls | Consent |
Selling data. We do not sell personal data for money. Some US state laws treat advertising cookies as "selling" or "sharing" data. You can opt out of that at any time by rejecting marketing cookies in "Cookie settings", and we treat a Global Privacy Control signal from your browser the same way.
Hashing. "Hashed" means we turn your email or phone into a fixed code before it leaves our server. Meta can still match that code to an account it already holds, so hashed data is still personal data. We treat it that way.
4. Things we ask you not to send us
- Sensitive data. Please do not put health, financial account, biometric, political, religious or similar details in a form or email. If you do, we delete it from our CRM within 7 working days of noticing and do not use it.
- Other people's details. Only send a colleague's details if they have agreed. If someone sends us your details without your agreement, ask us and we will remove them under section 11.
- Confidential business information. A form or email does not create a duty of confidence. We sign a non-disclosure agreement before you share anything confidential. See our Terms of Use.
5. Automated tools and decisions
We tag each enquiry by what you said you are looking for, so it reaches the right person and gets the right priority. A person reads every enquiry. We do not make decisions that have legal or similarly significant effects on you by automated means alone.
6. Who receives your data
Service providers that act on our instructions. They may use your data only to provide their service to us.
- Vercel: website hosting and server logs.
- HubSpot: our CRM and call booking.
- Resend: sends our notification and confirmation emails.
- Our email provider, which hosts the company inboxes that receive a copy of every enquiry.
- Cloudflare: Turnstile bot check on forms.
- Google (Tag Manager and Analytics): only with analytics consent.
Advertising platforms that also use data for their own purposes. Meta (Pixel and Conversions API) and LinkedIn (Insight Tag) receive data only with marketing consent. For the data collected by the Meta Pixel on our site, Meta and EdgeFirm are joint controllers. Meta's own privacy policy and the Meta Controller Addendum explain what Meta does with it.
Others, only when needed.
- Our group companies, under the agreement in section 1.
- Professional advisers such as lawyers and accountants, under a duty of confidence.
- Courts, regulators or police, when the law requires it. We disclose only what the request needs.
- A buyer or investor, if all or part of EdgeFirm is sold or restructured. They must keep to this policy, and we tell you before your data comes under a different privacy policy.
7. Advertising choices
You can withdraw marketing consent at any time in "Cookie settings" in the footer. The page reloads and the Meta and LinkedIn tags stop running. We also remove the Meta and Google cookies they set on our domain. Your choice applies to this browser only. If you use another browser or device, set it there too.
8. International transfers
Our team works from Pakistan, and most of our providers are in the United States. Your data will be processed outside the country you live in. When data leaves the UK or the EEA we use one of these safeguards: an adequacy decision, the EU-US Data Privacy Framework (and its UK extension) for certified providers, the EU Standard Contractual Clauses, or the UK International Data Transfer Agreement or UK Addendum. We choose the safeguard that fits each provider and the transfer to our team in Pakistan. You can ask us for a copy of the safeguard that applies to your data.
9. How long we keep it
| Data | How long |
|---|---|
| Enquiries that do not become a project, and booking records | 24 months after our last contact with you |
| Unfinished form fills | 90 days, unless you then submit the form |
| Copies of enquiries in our email inboxes | Same as the enquiry |
| Marketing consent | Until you withdraw it. If you have not opened or clicked anything for 24 months, we stop emailing you |
| Client records, contracts and invoices | Length of the contract plus 6 years |
| Job applications | 6 months after we decide, unless you agree we can keep it longer |
| Server logs | Set by our hosting provider, Vercel |
| IP address for rate limiting | Up to 10 minutes, in memory only |
| Google Analytics data | Up to 14 months |
| Meta and LinkedIn advertising data | Set by Meta and LinkedIn under their own policies |
| Your cookie choice | 12 months, then we ask again. If you reject everything we ask again after 6 months |
| Record of a removal request, and the suppression entry that stops us contacting you again | 3 years after the request |
When a period ends we delete the data or make it anonymous so it can no longer identify you.
10. How we protect it
Data travels over encrypted connections. Only staff who need your data for their work can see it. We choose providers that make written security commitments. No system is perfectly secure. If a breach is likely to harm you, we tell you and the regulators the law requires us to tell, within the time the law sets.
11. Your rights, and our 7 working day removal promise
You can ask us to:
- give you a copy of your data and tell you how we use it
- correct it
- delete it
- restrict or stop how we use it, including for marketing, which we always stop
- send it to you or another company in a common electronic format
- withdraw any consent you gave. This does not undo what we did lawfully before you withdrew.
We give these rights to everyone, wherever you live, at no charge. The law where you live may give you more, and section 13 lists the extra points by region.
How to ask. Email privacy@edgefirm.io from the address we hold, or write to us. You do not need a special form or the name of a law. Someone can ask for you if they show us your written permission.
Checking it is you. We ask you to confirm the request from the email address we hold. We only ask for more if we cannot match you, and we use anything extra only to check your identity, then delete it.
Our timescales. Working days are Monday to Friday, except public holidays in England and Pakistan. Timescales run from the day anyone at EdgeFirm receives your request, by any route, unless a line below says they run from confirming it is you.
- We acknowledge your request within 2 working days.
- Marketing opt-outs: done within 7 working days of receiving them. We do not ask you to prove who you are to stop marketing.
- Deletion, correction and restriction: done within 7 working days of confirming it is you.
- A copy of your data: within one month, usually sooner.
- If we cannot meet a date, we tell you before it passes, explain why, and give a new date. We never go past the deadline the law sets where you live.
What deletion covers. We delete or anonymise your data in every system we control: our CRM (including unfinished form fills, notes and tags), call booking records, email inboxes and notification copies, marketing email lists, any advertising audience we uploaded, and any exports or working files. We tell each service provider that holds a copy to delete it.
What we cannot delete directly. Data that Meta, LinkedIn or Google collected through their own cookies or accounts is held by them under their own policies. We remove you from anything we control on those platforms and send you the links to ask them directly. Data already sent to Meta as a hashed event cannot be called back by us.
What we keep, and why. We tell you about each item we keep:
- a suppression entry with your email address and the date, so we never add you back or contact you again. We use it for nothing else.
- records the law makes us keep, such as invoices and contracts, until that duty ends.
- data we need to make or defend a legal claim, until the claim is settled.
- a record that we handled your request, so we can prove it.
Backups. Deleted data can stay in provider backups or recycle bins for a limited period set by the provider. We do not restore or use it in that time. If a backup is ever restored, we delete your data again.
Your removal status report. By the end of the 7 working days we email you a report that lists each system, what we did there (deleted, anonymised, suppressed or kept), the date, the reason for anything kept, and any step still waiting on a provider, with its expected date. We email you again when the last step closes.
When we may refuse. We may refuse or limit a request if we cannot confirm who you are, if it would reveal someone else's data, if the law requires us to keep the data, or if the request is clearly unfounded or excessive. We tell you why in writing and how to complain.
Appeals. If we refuse, reply with "appeal" in the subject line. Someone who did not handle the first request reviews it and answers within 45 days.
12. How to complain
Tell us first at privacy@edgefirm.io. We acknowledge a complaint within 30 days, usually within 2 working days, keep you updated, and tell you the outcome in writing. You can also complain to your data protection regulator at any time. Section 13 lists them.
13. Extra points by region
| Where you live | Law | Regulator | Extra points |
|---|---|---|---|
| UK | UK GDPR and Data Protection Act 2018 | ICO | Right to object to direct marketing at any time |
| EEA | GDPR | Your local data protection authority | EU representative in section 1 |
| United States | State privacy laws such as California and Texas | Your state Attorney General, or the California Privacy Protection Agency | Right to opt out of targeted advertising. We will not treat you differently for using a right. |
| Canada | PIPEDA and CASL | Office of the Privacy Commissioner of Canada | Marketing email needs your express consent |
| Quebec | Law 25 | Commission d'accès à l'information | Tracking is off until you turn it on. |
| Australia | Privacy Act 1988 and the Australian Privacy Principles | OAIC | Section 5 is our statement on automated decisions, required from 10 December 2026 |
| New Zealand | Privacy Act 2020 | Office of the Privacy Commissioner | Notice when we collect your data from someone else (IPP3A, from 1 May 2026) |
| Saudi Arabia | Personal Data Protection Law | SDAIA | The rights in section 11 apply |
| UAE, Qatar, Oman, Kuwait | National data protection laws | Your national data protection authority | The rights in section 11 apply |
| Singapore | PDPA | PDPC | We do not call or text Singapore numbers for marketing without checking the Do Not Call registry |
| Malaysia, Thailand, Japan, South Korea | National data protection laws | Your national data protection authority | The rights in section 11 apply |
15. Marketing emails
We email you about our services only if you ticked the optional marketing box or asked us to. Every email names EdgeFirm, gives our postal address and has an unsubscribe link. Unsubscribing takes effect within 7 working days at the latest, and usually at once. Unsubscribing from marketing does not stop replies to an enquiry you are still discussing with us. We do not call, text or WhatsApp you for marketing unless you asked us to.
16. Children
Our services are for businesses. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it within 7 working days.
17. Changes to this policy
We publish changes here and update the date and version number. We record that version number with each form you submit. If a change means we would use data you already gave us for a new purpose that needs consent, we ask you first and do nothing new until you agree.