Privacy Policy

Last updated: 26 September 2026

Who this covers

Data controller: Fieldnote Security, operated by Kiet Hoong through [COMPANY LEGAL NAME TBC], a limited company registered in England and Wales (Company No. [COMPANY NUMBER TBC]). For the purposes of UK GDPR, the company is the data controller for any personal data collected through this site or during an engagement. Contact: [email protected].

What data is collected

• Name, email address, company name, and domain/website URL submitted through the contact form on this site.
• Any message or context you add to that form.
• During a paid engagement: the domain(s) and target(s) you authorize for scanning, and the technical findings that scan produces (DNS records, open ports, headers, and similar data about the target, not about you personally).
• If you use the AI chat assistant: the messages you send it, and your IP address (used only to enforce a limit on how many messages can be sent per hour, to prevent abuse).

Why it's collected (lawful basis)

• Contract necessity - to deliver the assessment or report you've requested, once an engagement is agreed.
• Consent - for the contact form submission itself, which you give by completing and sending it.
• Legitimate interest - for the AI chat assistant's IP-based rate limit, which exists to prevent abuse of the service (e.g. automated spam or excessive use that could affect its availability for other visitors). You have the right to object to this - if you'd prefer this isn't collected, you can choose not to use the chat assistant.

How long it's kept

• Final client reports and authorization forms: retained for 6 years, matching the UK Limitation Act 1980 standard limitation period for contract claims.
• Raw scan data (detailed technical output, JSON artifacts): retained for 12 months following report delivery, then deleted.
• Free-tier scan submissions from prospects who did not become paying clients: retained for 12 months, then deleted if no engagement followed.
• AI chat assistant: your IP address is held for up to 1 hour in a rate-limit counter, then automatically deleted - this is the only thing stored. The content of your messages is not logged or stored by Fieldnote Security; it is sent to Cloudflare Workers AI (see Third parties below) only to generate a reply, and is not kept afterwards.

Data is deleted, not just archived, at the end of each period above. You can request earlier deletion at any time by contacting [email protected], subject to the exceptions above where retention supports a legal or contractual purpose.

Third parties

The contact form on this site is processed by Formspree, a third-party form-handling service. Submitting the form sends your details to Formspree's infrastructure before they reach the company. Formspree's own handling of that data is governed by Formspree's Privacy Policy.

If you use the AI chat assistant, your message is sent to Cloudflare Workers AI to generate a reply. Cloudflare's own handling of that data is governed by Cloudflare's Privacy Policy.

No other third party receives data collected through this site.

Cookies and tracking

This site does not currently use cookies, analytics, or any tracking technology. If that changes in the future - for example, if analytics is added - this policy will be updated to reflect it before that change goes live.

The AI chat assistant keeps your conversation visible in your browser only, using your browser's built-in sessionStorage - this is not a cookie and isn't used for tracking or analytics. It's cleared automatically when you close the browser tab, and is never sent anywhere except back to Fieldnote Security's own chatbot service to continue the same conversation.

If you use the light/dark theme switch in the site header, your choice is saved in your browser's built-in localStorage under the name fns_theme, holding only the value light or dark, so the site remembers it on your next visit. It is not a cookie, contains no personal data, isn't used for tracking or analytics, and is never sent to Fieldnote Security or anyone else. You can remove it at any time by clearing this site's data in your browser.

Your rights

Under UK GDPR you can ask to access, correct, or delete the personal data held about you, or ask that its use be restricted. To make any of these requests, email [email protected].

Complaints

If you're unhappy with how your data has been handled, you can raise it directly first, or complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

[ICO registration number - add once registered]

Changes to this policy

This policy may be updated as the business and its data practices develop. The date at the top of this page reflects the most recent revision.