Privacy Policy
At firmä ("we", "us", or "our"), we respect your privacy and are committed to protecting the proprietary assets you entrust to our platform. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service, specifically tailored for Strategic Advisors and Consultants.
Status: Active documentation
Last sync: Jan 2026
01Information we collect
Our platform is designed to be Non-Custodial regarding your intellectual property. We minimize data collection to the absolute essentials required for service delivery.
Account identity
Basic profile information (Name, Email, Organization).
Storage metadata
We request access to file names, folder structures, and permission settings to organize your client portal. We do not store the actual content of your files.
Usage telemetry
Anonymized data on how you interact with the platform to improve performance.
02How we use your information
We use your data solely to facilitate the secure delivery of your professional services:
Automating the creation and management of Client Portals.
Enforcing access control and revocation policies ("Zombie Link" prevention).
Sending critical security alerts regarding your shared assets.
Generating audit logs for your engagements.
03Data sovereignty & sharing
Your client data remains in your own storage — Google Drive, OneDrive or SharePoint. We do not sell your data. We do not share your data with third parties, except:
Service providers
AWS/Vercel (Hosting), Supabase (Database), Polar (Payments), Anthropic (AI assistant) – strictly for infrastructure. See section 05 for what the AI assistant sends and what it does not.
Legal compliance
If compelled by law enforcement (highly specific and rare).
04Security & retention
Encryption protocols and data lifecycle management policies.
Encryption
We employ enterprise-grade encryption (TLS 1.2+) for all data in transit. Since we do not store your files, the security of your documents rests primarily on Google's world-class infrastructure, layered with our access governance.
Purge protocol
When you delete your firmä account, all metadata stored on our servers is permanently erased within 30 days. Your actual files in your own storage remain untouched.
05AI assistant
firmä includes an AI assistant, Brio, which answers questions about an engagement and can propose changes to how its files are organized.
What is sent
When you ask Brio a question, we send Anthropic the question and the engagement details needed to answer it — file and folder names, due dates, statuses, member roles and counts. The contents of your documents are never sent. Brio reads the names and properties of your files, not what is inside them.
Not used for training
We use Anthropic's commercial API. Anthropic does not use what we send to train its models, and retains it only briefly for abuse monitoring under its own terms. We do not use your data to train any model, and we do not send it to any other AI provider.
Nothing without your approval
Brio can rename and move files and create folders, and only ever after you approve each change. It never deletes anything. Every change it makes is recorded in your engagement's audit trail, attributed both to the assistant and to the person who approved it.
What we keep
Conversations with Brio are not stored on our servers — they are saved in your browser, on the device you used, so you can reopen them. They are kept for up to 30 days unless you pin them, and you can delete any of them, or all of them, from the assistant panel at any time. Clearing your browser data removes them too. When you rate an answer, we record the rating and the category you pick, never the question you asked or the answer you received. We also record how many AI requests an account makes, to apply plan limits and bill correctly.
06Your rights
These rights are available to everyone who uses firmä, not only to residents of places that require them. California residents have them under the CCPA/CPRA; residents of Canada under PIPEDA.
Know and access
You can download everything we hold about you from your account settings: your profile, your firm and engagement memberships, your activity in the audit trail, and your AI usage. The export is machine-readable and arrives immediately — you do not have to ask us for it.
Correct
Your name, email and profile details are editable in your settings at any time. Anything you cannot edit yourself, we will correct on request.
Delete
Request deletion from your account settings. We confirm by email when it is done, and in any case within 45 days. Your profile, memberships and sign-in credentials are erased; your files in your own storage are never touched. Two things survive, and we would rather say so plainly: audit records of actions you took remain, because an audit trail a participant can edit is not an audit trail; and a workspace you share with colleagues continues without you, since it is not yours alone to delete.
No sale, no discrimination
We do not sell your personal information and we do not share it for cross-context behavioural advertising, so there is nothing to opt out of. Exercising any of these rights will never change your price, your plan or the service you receive.
08Contact us
For any privacy concerns or data requests, please contact our Data Protection Officer at
info@firmaone.com