Privacy notice

Version 2026-10-05 · Effective from the same date

This notice explains how (“we”, “us”) handles personal data when you use FSMS Hub (the “Service”), our website and our support. It should be read with our terms and conditions.

1. Our role

Account and business data (who signs in, billing, support): we decide how this is used, so we are responsible for it as the controller.
Customer Content — the plans, documents, records and assessments your organization creates, which may include names of staff, trainers or approvers: we process this on behalf of your organization, following its instructions. Your organization is responsible for it. If you have a question about Customer Content, contact your organization first.
Business customers can ask for our data processing agreement at .

2. What we collect

Type	Examples	Source
Account	Name, email, password (stored only as a one-way hash), roles, terms acceptance, email confirmation	You, or the person who invited you
Organization and billing	Organization and site names, plan, billing contact, invoices, payment status. Card details are handled by our payment provider; we never see full card numbers.	You, our payment provider
Security and records	Sign-in times, IP addresses and browser details on activity logs and electronic signatures, email delivery logs	Your use of the Service
Support	Messages you send us, notes about your requests, support access grants and visits	You, our team
Customer Content	Whatever your organization enters, which may include personal data about staff	Your organization

3. How we use it

To provide the Service under our contract with you: accounts, sign-in, document control, approvals, PDF packs, reminders and billing.
To keep it secure and reliable (our legitimate interest): rate limiting, fraud and abuse prevention, activity and signature records, troubleshooting.
To support you: answering requests, and viewing your organization read-only only when an owner or admin grants support access.
To run and improve the business (our legitimate interest): aggregated counts such as number of sites, approvals or PDF packs. Our platform team sees counts, not your documents.
To meet legal obligations: tax, accounting and lawful requests from authorities.
We send service emails (invitations, approvals, reminders, password resets). We do not send marketing emails without your consent, we do not sell personal data, and we do not use Customer Content to train AI models.

4. Who we share it with

We use these service providers, who process data on our behalf under contracts that require them to protect it:

Provider	Purpose	When
Hosting provider (Hostinger)	Servers, database and backups	Always
Email provider	Delivering service emails	When an email is sent
Payment provider (Stripe)	Card payments and subscriptions	Only for card-paying customers
AI provider (Anthropic)	AI assist suggestions — only the text of the step or document being worked on	Only if AI assist is on for your organization and a user clicks an AI button
Google Fonts	Website fonts — your browser connects to Google to download them	When pages load

We may also share data with professional advisers, a buyer of our business (under confidentiality), or authorities when the law requires it. People your organization shares an auditor link with can see the approved content in that link.

5. International transfers

Some providers may store or process data outside your country. Where the law requires it, we use safeguards such as contractual commitments, and we choose providers with recognised security standards.

6. How long we keep it

Account data: while your account exists. If you are removed from all organizations, you can ask us to delete your account.
Customer Content, activity logs and signature records: for the life of the organization, because approval history must stay intact. When an organization is deleted, its data is removed after the notice period (30 days for organizations we close) and from backups within days.
Email delivery logs: days.
Billing and invoices: as long as tax and accounting law requires.

7. Security

We use encrypted connections, one-way password hashing, role-based access, rate limiting, consent-based support access and audit logs. Electronic signatures include a fingerprint of the signed content so changes can be detected. No system is completely secure; if a breach affects your personal data, we will tell you and the relevant authorities as the law requires.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal data, to object to or restrict some uses, and to withdraw consent. You can:

Update your name and password in Account.
As an organization owner, download all your organization’s data in Settings → Download all data, or delete the organization.
Email for anything else. We reply within 30 days. For Customer Content, we will pass your request to your organization, which decides.

You can also complain to the data protection authority where you live or work.

9. Cookies and local storage

One essential cookie (fg_session) keeps you signed in. It is sent only over secure connections, can’t be read by scripts, and expires after 14 days at most.
Your browser’s local storage remembers small preferences, such as the last organization you opened and announcements you dismissed.
We do not use analytics, advertising or tracking cookies.

10. Children and changes

The Service is for businesses and is not intended for children. We may update this notice; we will show the new version date here and tell you about material changes in the app or by email.

11. Contact

, · Licence · Privacy requests: · General:

This page is a template. Have it reviewed by a qualified lawyer for your company and markets (for example UAE and KSA personal data protection laws) before relying on it.