Plain-English summary written by us, not a solicitor. We've tried to describe accurately what we do; if anything's unclear, ask.
This page covers how Firnox Ltd ("we", "us") handles personal data on the site at firnox.com. The data controller is Firnox Ltd, registered in England and Wales, company number 13598161.
When you use the site we collect:
We use the following processors to run the service:
Each processor handles data only for the purpose described. We don't sell or rent personal data to anyone, and we don't share it with advertisers.
We use a small number of strictly-necessary cookies: a session cookie so you stay logged in, a CSRF cookie to protect form submissions, and a cookie carrying a Cloudflare Turnstile challenge result on pages with public forms. These are exempt from the consent requirement under UK PECR because they're needed to provide the service you've asked for, which is why we don't show a cookie banner.
Umami, our analytics tool, doesn't set cookies or use browser storage. It counts unique visitors server-side via a daily-rotating hash of your IP and user-agent, which is never written to your browser and which we never see in unhashed form.
When you play an embedded YouTube video, Google may set cookies in your browser. We use the privacy-enhanced "no-cookie" embed, which defers any cookie-setting until you actually click play. If you'd rather not load YouTube, don't play those embeds; the rest of the site works without them.
Under UK GDPR you have the right to access the personal data we hold about you, ask us to correct it, ask us to delete it, and object to certain processing. To exercise any of these, send a message via the contact form, ideally from the email address on your account so we can match your request to your record. We respond within one calendar month, usually much sooner.
If you're unhappy with how we've handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.
Account data is kept while your account exists, plus a short period after deletion for accounting and dispute-resolution reasons. Payment records are retained for the period required by UK tax law (currently six years). Server logs (nginx access and application logs) are rotated and aged out by the standard rotation policy on our hosting, on the order of a few weeks.
If you unsubscribe from the newsletter we keep your topic preferences on file so that if you resubscribe later your previous choices are restored without you having to redo them. You can request full deletion of your subscriber record at any time using the contact form.
If we make material changes to this policy we'll note them here and, where it affects existing users, send a notification. The date below is the last update.
Last updated: 2026-05-08.