The short version: we collect the minimum we need to do business with you, we don't sell your data, and you can ask us to show you what we hold or delete it at any time.
1. Who we are
Birmi App Solutions (the "data controller") trades from 77 Stockwell Road, Birmingham, B21 9RL, United Kingdom. We're registered with the UK Information Commissioner's Office (ICO) for data protection purposes.
Our Data Protection contact: contact@birmiappsolutions.it.com.
2. What information we collect
We collect:
- Contact details — name, email, phone, company, billing address — when you enquire, send us a brief, get a quote, or hire us.
- Project information — anything you tell us in briefs, calls, emails or chats: requirements, budgets, content.
- Payment information — handled by our payment processor (Stripe / your bank). We don't store full card numbers on our systems.
- Device information — for repairs: device model, IMEI / serial, fault description, photos at intake.
- Account credentials — only those you provide so we can do the work (e.g. CMS logins, hosting access). Stored encrypted; deleted on project close.
- Website analytics — anonymous page views, device type, country, referrer. We don't use cross-site advertising trackers.
- Chat transcripts — messages you send to our AI chat assistant or contact form.
3. Why we collect it
- To respond to enquiries and produce quotes.
- To deliver and support the services you've hired us for.
- To invoice and process payments, and meet HMRC record-keeping obligations.
- To improve our website (anonymous, aggregated).
- To send occasional service updates (only with your consent — we don't do marketing spam).
4. Legal basis for processing
Under UK GDPR we rely on the following lawful bases, depending on the activity:
- Contract — to deliver the work you've engaged us for.
- Legitimate interests — running our business, replying to enquiries, basic site analytics. We balance this against your rights.
- Legal obligation — keeping financial records (HMRC requires 6 years).
- Consent — for non-essential cookies and any marketing emails. You can withdraw consent at any time.
5. Who we share data with
We use carefully chosen third-party processors to run our business. Each is bound by data-processing terms and acts on our instructions only:
- Email & calendar — Google Workspace
- Accounting — Xero (UK)
- Payments — Stripe, your bank
- Hosting — Vercel / AWS (UK and EU regions where possible)
- Project management — Linear / Notion
- AI chat assistant — Anthropic (see section 6)
- Analytics — Plausible (cookieless, GDPR-friendly)
We do not sell your personal data, ever. We may disclose data if required by law, court order, or to protect our legal rights.
6. AI chat data
The chat box on this site is powered by an AI model. Messages you send to it are processed by our AI provider to generate replies. We do not use these messages to train AI models. Conversations are not linked to a profile unless you click "Email this chat to Birmi", which sends the transcript to us as an email so we can follow up.
Don't share sensitive personal data, payment details or credentials in the chat — use email or phone for those.
7. Device repair data
When you bring in a device, we record the device model, identifying numbers (e.g. IMEI/serial), the reported fault, and photographs of any pre-existing damage. We do not intentionally access your personal files. If a repair requires us to power on the device, we recommend you sign out of accounts and remove the screen lock or provide it temporarily — your choice. After collection, repair tickets are retained for 12 months for warranty purposes, then anonymised.
8. How long we keep your data
- Enquiry data with no project: 12 months, then deleted.
- Active client records and project files: duration of the engagement.
- Financial records (invoices, receipts): 6 years (HMRC requirement).
- Repair tickets: 12 months, then anonymised.
- Chat transcripts emailed to us: handled like other client emails.
- Backups containing personal data: rotated and overwritten within 90 days.
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate data corrected.
- Have your data erased ("right to be forgotten") — subject to legal retention obligations.
- Restrict or object to certain processing.
- Receive your data in a portable format.
- Withdraw consent where consent was the basis.
- Lodge a complaint with the Information Commissioner's Office (ICO).
To exercise any right, email contact@birmiappsolutions.it.com. We'll respond within 30 days.
10. Security
We protect data with sensible technical and organisational measures: encrypted laptops, password managers with 2FA, encrypted backups, role-based access to client systems, and vendor due diligence. No system is 100% secure — if a breach happens, we'll notify you and the ICO within 72 hours where required.
11. Children
Our services are aimed at businesses and adult consumers. We do not knowingly collect data from anyone under 16. If you believe we have, contact us and we'll delete it.
12. Changes to this policy
We may update this policy occasionally. We'll change the "Last updated" date at the top. Material changes will be flagged on the site or by email if you're an active client.
Questions, requests, or concerns:
You can also complain to the UK ICO at ico.org.uk — though we'd love a chance to put things right ourselves first.