Privacy policy

FirstFlag ("we", "us") publishes this website and operates the FirstFlag service. We are the data controller for personal data processed through both. You can reach us at hello@firstflag.co.

When you contact us or subscribe we collect your name, work email address, firm name and billing details. When you use the site we collect standard technical data such as IP address, browser type and pages visited, via server logs and our analytics tools (PostHog, hosted in the EU; Vercel Analytics; and Google Analytics where enabled).

PostHog also records how pages are used: clicks, scroll depth, and on our public marketing pages a replay of the session. Replay and click capture are switched OFF on the subscriber portal and on individual home dossiers, and the private link that addresses a portal is stripped from analytics data before it is sent, so neither the link nor the contents of those pages reaches the analytics tool. If you give us your email address at a regional preview, later activity in your browser is linked to it.

The FirstFlag service itself compiles information about care providers from public sources: the Care Quality Commission and Companies House. CQC's regulatory data, meaning ratings, scores and inspection text, is published under the Open Government Licence v3. That licence does not extend to personal data, so it is not what we rely on for the names and roles of company directors and registered managers taken from the public registers. Those are personal data. We process them as a controller under UK GDPR on the legitimate interests basis set out below, and you can object to that processing at any time using the contact address above.

We use your data to provide and bill for the service, respond to enquiries, and send service updates. We do not sell personal data. We do not send marketing email without your consent. Our lawful bases are performance of a contract, legitimate interests (operating and improving a business intelligence service built on public records) and consent where required.

We use a small number of processors to run the service: hosting infrastructure, payment processing (Stripe) and analytics (PostHog, Vercel Analytics, and Google Analytics where enabled). PostHog stores its data in the European Union. Each processes data under its own agreement with us and only on our instructions. We may disclose data where the law requires it.

We keep account and billing data for as long as you hold a subscription and thereafter as required for tax and accounting purposes (normally six years). Enquiry correspondence is kept for up to two years. Public-register data is refreshed from source and holds no special retention period.

Under UK data protection law you can request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. Write to hello@firstflag.co and we will respond within one month. If you are unhappy with our handling you can complain to the Information Commissioner's Office (ico.org.uk).

The public site sets no cookies beyond those needed for analytics, which is one PostHog cookie identifying your browser between visits, plus any Google Analytics cookies where that is enabled. Subscribing to a regional preview sets one further cookie that keeps your sample dossiers unlocked. The internal dashboard sets a single session cookie for authentication. We do not use advertising cookies and we do not sell or share any of this with advertisers.

We will post any changes to this policy on this page and update the date above. This policy is governed by the law of England and Wales.