PRIVACY NOTICE
Privacy Notice
1. Who we are
1.1 “Company” means Red First Ltd, a company incorporated in England and Wales with company number 16259042 whose registered office is at 2 Burrough Court, Burrough On The Hill, Melton Mowbray, England, LE14 2QS.
1.2 The Company trades as Red First and redfirst.ai and operates https://redfirst.ai (including Red Press and Red Score).
1.3 For personal data described in this Privacy Notice, the Company is the controller.
1.4 Privacy contact: privacy@redfirst.ai. Legal contact: legal@redfirst.ai. Postal: the registered office in clause 1.1.
1.5 The Company is registered with the Information Commissioner’s Office under registration number ZC030038.
1.6 VAT: the Company is awaiting number (not yet issued). VAT number: not yet issued. When a number is issued, it will be stated on https://redfirst.ai and in commercial documents.
2. Scope of this notice
2.1 This Privacy Notice covers personal data collected via the Company’s public website and Red Score only, including when you:
2.1.1 visit https://redfirst.ai or Red Press;
2.1.2 complete Red Score or submit a related enquiry;
2.1.3 place an online order on the Site (including for Red Score, Red Brief, or Red Consultant Certification);
2.1.4 receive B2B sales or marketing communications arising from that website or quiz activity.
2.2 This notice is aimed at business contacts and website visitors. The Company’s products and services are offered on a business-to-business basis.
2.3 Personal data processed in connection with RedOS or other paid platform services under a client agreement is not governed by this Privacy Notice. That processing is described in the client agreement, its data processing agreement, and any in-product notices.
2.4 We do not knowingly offer the website or Red Score to individuals under 18. If you believe we hold personal data of a child, contact privacy@redfirst.ai.
3. Personal data we collect
3.1 Website and analytics data. IP address, device and browser type, pages viewed, referring URL, approximate location derived from IP, date/time of access, and events measured by Google Analytics 4 (Google LLC) (see clause 5).
3.2 Contact data. Name and email address. We may also process telephone number or WhatsApp identifier if you provide them later or if those channels are used for outreach (email; WhatsApp and phone when collected). We do not currently require phone or WhatsApp on the quiz.
3.3 Order and payment data. Billing name, business details, order contents, and payment metadata processed when you purchase via the Site. Card payments are handled by Stripe (Stripe Payments UK Ltd / Stripe, Inc. as applicable); we do not store full card numbers on our systems.
3.4 Business information. Organisation name, role, and other business details you submit in the quiz or enquiry forms.
3.5 Red Score payload. The full quiz submission: all answers, calculated score/results, and the contact and business information collected with that submission.
3.6 Marketing preferences. Records of opt-outs and any preference choices you make. Suppression lists keep only the minimum identifiers needed to honour an opt-out (for example email address or phone number), not the full quiz payload.
3.7 Correspondence. Records of emails and other messages you exchange with us (including WhatsApp or phone notes if those channels are used).
3.8 We do not intentionally collect special category personal data (such as health, political opinions, or biometric data for identification) via the website or quiz. Please do not submit such data in free-text fields. If we detect special category data submitted in error, we will delete it unless we have a lawful Article 9 UK GDPR ground to retain it.
3.9 Providing data. name, email, business information, and quiz answers required to generate and deliver Red Score results. If you do not provide those fields, we cannot generate or deliver your results or follow up on them. Optional fields (if shown) are marked as such on the form.
4. Purposes and lawful bases
4.1 “Data Protection Legislation” means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and any other applicable law relating to the processing of personal data, in each case as amended or replaced from time to time.
4.2 “UK GDPR” has the meaning given to it in section 3(10) (as supplemented by section 205(4)) of the Data Protection Act 2018.
4.3 We process personal data only where a lawful basis under the UK GDPR applies. For each purpose we identify one primary basis:
| Purpose | Typical data | Lawful basis and interest |
|---|---|---|
| Operate, secure, and improve the website and quiz | Website/analytics, technical logs | Legitimate interests — operating a secure B2B website and quiz |
| Deliver Red Score results | Full quiz payload | Legitimate interests — providing the informational score and results you requested by completing the quiz |
| CRM, sales follow-up, and profiling for B2B outreach | Contact, business information, quiz answers/score | Legitimate interests — contacting business prospects who engaged with our quiz, prioritising follow-up using quiz context (profiling under Article 4(4) UK GDPR, not Article 22 automated decision-making) |
| B2B email marketing about our products/services | Contact data, preferences | Legitimate interests — promoting B2B services to corporate business contacts, with opt-out in every email (PECR corporate-subscriber rules; see clause 4.5) |
| WhatsApp or phone contact (when enabled and details held) | Phone / WhatsApp identifier, related notes | Legitimate interests and PECR rules for that channel — we will only use WhatsApp/phone where PECR allows; sole traders and personal numbers may require consent |
| Analytics and advertising measurement (Google Analytics 4 (Google LLC)) | Website and analytics data; advertising identifiers where ads features are on | Consent (PECR / UK GDPR) — non-essential analytics and ads personalisation |
| Improve products and train or improve AI systems | Quiz answers, business information, and related contact data (yes_score_and_train) | Legitimate interests — improving scoring quality and AI-assisted products. You may object (clause 9). See clauses 4.7 and 8.3 on limits |
| Comply with law and protect rights | Any relevant category | Legal obligation; legitimate interests — establishing, exercising, or defending legal claims |
| Strictly necessary cookies | Technical identifiers | Legitimate interests — essential site function (PECR exemption) |
4.4 Where we rely on legitimate interests, we have considered your rights and expectations against our interests. A summary of our legitimate-interests assessments for marketing and AI improvement is available on request to privacy@redfirst.ai. You may object — see clause 9. For direct marketing, we will honour an opt-out without question.
4.5 Electronic marketing and PECR. Email is our primary outreach channel. WhatsApp and phone are in scope for the future (email; WhatsApp and phone when collected) but are not required fields on the quiz today. PECR treats channels differently:
4.5.1 Email to corporate subscribers: we rely on legitimate interests / PECR B2B rules, with an unsubscribe link in every marketing email.
4.5.2 WhatsApp (electronic mail under PECR) and phone: we will only contact you on those channels where PECR permits (including consent where required, for example for many individual/sole-trader numbers). When WhatsApp is used, Meta Platforms (WhatsApp) receives message content and identifiers to deliver the message.
4.6 We do not use website or quiz personal data for automated decision-making that produces legal or similarly significant effects within the meaning of Article 22 UK GDPR. Red Score produces an informational score. We may use that score and your answers in our CRM to prioritise human sales follow-up; a human decides whether and how to contact you.
4.7 AI improvement and training. We may use quiz answers, business information, and related contact data both to generate your score and to improve our products, including training or improving AI systems. Basis: legitimate interests with opt-out; no separate training consent tick. Recipients may include OpenAI, L.L.C., Anthropic PBC, OpenRouter, Inc., and Self-hosted AI models operated by the Company (see clause 6). If you object or request erasure, we will stop future use of your personal data for training and delete or de-identify source copies we control. Personal data already absorbed into a trained model may not be fully extractable; where that is the case, we will explain what we can and cannot do when we respond to your request.
5. Cookies and similar technologies
5.1 Cookie information is included in this Privacy Notice (cookie notice folded into this document for v1).
5.2 Strictly necessary cookies may be set so the site loads, stays secure, and remembers essential preferences (for example, your cookie-consent choice). These do not require consent.
5.3 Google Analytics 4 (Google LLC) is non-essential. We use it for measurement and Google Ads personalisation (including Google signals where enabled). It must not run, and its analytics or advertising cookies must not be set, until you consent via our cookie banner or equivalent control. If you refuse or withdraw consent, those GA4 / Google advertising cookies will not be set for that browser. Consent to analytics/ads cookies is separate from completing the quiz.
5.4 Cookie / technology table (v1):
| Cookie / technology | Type | Purpose | Duration | Consent |
|---|---|---|---|---|
| Cookie consent preference | Strictly necessary | Store whether you accepted or rejected non-essential cookies | 12 months | Not required |
Cloudflare __cf_bm / security cookies (as set by Cloudflare Pages (Cloudflare, Inc.)) | Strictly necessary / security | Bot management and secure delivery of the site | Typically up to 30 minutes for __cf_bm; other Cloudflare cookies per their current documentation | Not required for strictly necessary use |
Google Analytics 4 (Google LLC) _ga | Analytics | Distinguish users for measurement | Up to 24 months | Required before set |
Google Analytics 4 (Google LLC) _ga_* | Analytics | Persist measurement session/state | Up to 24 months | Required before set |
Google advertising / signals cookies (e.g. _gcl_au, DoubleClick / IDE where enabled) | Advertising | Ads personalisation, conversion measurement, and related Google advertising features | Up to 24 months (varies by cookie) | Required before set |
5.5 You can withdraw consent for non-essential cookies at any time via the cookie controls on the site and, where applicable, your browser settings. Withdrawing consent does not affect the lawfulness of processing before withdrawal.
5.6 If we later introduce advertising pixels, localStorage-based trackers, or other non-essential technologies, we will update this table before use, or publish a standalone cookie notice (register ref D3) if a folded section is no longer fair.
6. Recipients and processors
6.1 We use the following processors (and, where stated, communications providers) for website and quiz personal data:
| Recipient | Role | Location | Transfer tool |
|---|---|---|---|
| Cloudflare Pages (Cloudflare, Inc.) | Hosting the Red Score front-end and related static site delivery | United States (provider establishment) and global edge locations | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| Fly.io | Application and database hosting for quiz/backend services | United Kingdom and/or European Economic Area regions where the Company configures workloads; support access may involve the United States | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| Neon (Neon, Inc.) | Managed PostgreSQL database for quiz and related application data | United States (provider establishment); database region as configured by the Company | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| GoHighLevel | CRM and outbound B2B communications (email; WhatsApp/phone when enabled) | United States and other locations used by the provider | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| Google Analytics 4 (Google LLC) | Website and quiz analytics, including Google Ads personalisation and related advertising measurement features where enabled | United States and other Google processing locations | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| OpenAI, L.L.C. | AI model API for scoring assistance, product improvement, and training-related processing where used | United States and other OpenAI processing locations | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| Anthropic PBC | AI model API for scoring assistance, product improvement, and training-related processing where used | United States and other Anthropic processing locations | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| OpenRouter, Inc. | AI inference gateway routing prompts to underlying model providers | United States and other OpenRouter / routed-provider processing locations | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| Self-hosted AI models operated by the Company | AI scoring, improvement, and training on Company-controlled infrastructure (including Fly.io) | Regions where the Company hosts workloads (see Fly.io) | Not a third-party transfer — processing by the Company as controller |
| Meta Platforms (WhatsApp) | Delivery of WhatsApp messages when that channel is used | United States and other Meta processing locations | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
| Stripe (Stripe Payments UK Ltd / Stripe, Inc. as applicable) | Payment processing for online orders on the Site | United Kingdom, European Economic Area, and United States as applicable to the Stripe entity and infrastructure used | UK Addendum to EU Standard Contractual Clauses and/or adequacy where applicable |
6.2 Google provides Google Analytics 4 (Google LLC) under Google’s measurement and advertising terms. Our configuration includes measurement and Google Ads personalisation (including Google signals where enabled). Google may process analytics and advertising data as described in Google’s privacy notice and data-processing terms; advertising features mean Google may use data for ads personalisation and related purposes beyond pure first-party measurement.
6.3 We may also share personal data with:
6.3.1 professional advisers (lawyers, accountants) under confidentiality obligations where needed;
6.3.2 authorities or counterparties where required by law or to establish, exercise, or defend legal claims;
6.3.3 a buyer or successor in connection with a corporate transaction, under appropriate protections.
6.4 We do not sell personal data.
6.5 If we add or replace a recipient that materially changes how website or quiz personal data is handled, we will update this notice.
7. International transfers
7.1 Several recipients in clause 6 process personal data outside the UK, including in the United States.
7.2 Where a transfer of personal data outside the UK occurs, we use a transfer mechanism recognised under Data Protection Legislation — typically the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, and/or an adequacy regulation — as indicated for each recipient in clause 6.1.
7.3 You may request a copy or summary of the relevant safeguards for a named recipient by emailing privacy@redfirst.ai, unless disclosure would prejudice security or legal privilege.
8. Retention
8.1 We keep personal data only as long as needed for the purposes above, including legal, accounting, or reporting requirements.
8.2 Periods:
| Category | Retention |
|---|---|
| Website server / security logs | 90 days, unless needed longer for a specific security investigation |
| Red Score and enquiry leads (not converted to a client relationship) | 24 months from last meaningful contact, meaning a reply from you, a scheduled call or meeting, or a substantive email exchange about our services (not a mere email open or link click) |
| Marketing suppression / opt-out lists | Indefinite, limited to minimum identifiers needed to honour the opt-out |
| Cookie consent records | 12 months |
| AI improvement / training source copies | Same as lead retention, or earlier deletion/de-identification if you object or we no longer need the data; see clause 8.3 |
| Client relationship personal data under a client agreement | As set out in that agreement / data processing agreement (outside this notice) |
8.3 AI models. Deleting source records does not always remove influence already present in a trained model. We will: (a) stop using your personal data for future training after a valid objection or erasure request; (b) delete or de-identify source copies and training-set copies we control where feasible; and (c) tell you honestly if a model cannot be “untrained” as to your data.
9. Your rights
9.1 Under the UK GDPR you may have the right to:
9.1.1 access your personal data;
9.1.2 rectify inaccurate personal data;
9.1.3 erase personal data in certain circumstances;
9.1.4 restrict processing in certain circumstances;
9.1.5 data portability in certain circumstances;
9.1.6 object to processing based on legitimate interests, including objecting to direct marketing (which we will always honour) and objecting to use of your quiz or contact data for AI training/improvement;
9.1.7 withdraw consent where processing is based on consent (including GA4 analytics and Google advertising cookies), without affecting prior lawful processing;
9.1.8 not be subject to Article 22 automated decision-making (see clause 4.6).
9.2 To exercise rights, email privacy@redfirst.ai. Say whether you want to stop marketing, stop AI training use, delete your quiz data, or something else — so we action the right request. We may need to verify your identity.
9.3 You may complain to the Information Commissioner’s Office (https://ico.org.uk/). We would welcome the chance to resolve concerns first via privacy@redfirst.ai.
10. How we obtain data
10.1 We collect data directly from you (quiz, forms, email, and other messages) and automatically via the website, Cloudflare delivery, and Google Analytics 4 (Google LLC) (only after consent where required).
10.2 We do not currently buy marketing lists. If that changes, we will update this notice and ensure a lawful basis and PECR compliance before use.
11. Security
11.1 We apply appropriate technical and organisational measures under Article 32 UK GDPR, including access controls, encryption in transit where appropriate, and staff/contractor confidentiality expectations. No method of transmission or storage is completely secure.
12. Changes to this notice
12.1 We may update this Privacy Notice from time to time. The updated version will be posted on https://redfirst.ai with a revised date. Material changes affecting how we use personal data already collected will be brought to your attention where required by Data Protection Legislation (for example by email or a prominent site notice).
13. Company details (trading disclosures)
13.1 For Companies Act and e-commerce transparency:
| Detail | Value |
|---|---|
| Legal name | Red First Ltd |
| Company number | 16259042 |
| Place of registration | England and Wales |
| Registered office | 2 Burrough Court, Burrough On The Hill, Melton Mowbray, England, LE14 2QS |
| Website | https://redfirst.ai |
| Privacy email | privacy@redfirst.ai |
| Legal email | legal@redfirst.ai |
| ICO registration | ZC030038 |
| VAT number | Status awaiting number (not yet issued); number not yet issued |
13.2 Prices for paid services are stated in the Commercial Schedule to the applicable client agreement, not in Red Score. Online contract steps for paid services are described in the relevant client terms when you purchase, not in this Privacy Notice.
Site addendum - event bookings and waitlist
This section covers personal data collected through the event booking and waitlist flows on this website. It is carried forward from the previous version of this page pending incorporation into the Privacy Notice above. Where it conflicts with the Privacy Notice, the Privacy Notice prevails.
Booking and waitlist data
- Booking data. Name, email, terms and marketing consent flags, and the time you provided them. Required to take payment and deliver the event.
- Intake data (collected after payment). Phone, company, role, business website, business size, LinkedIn URL, what you hope to get from the session, and how you heard about us.
- Dietary and accessibility requirements (in-person events only, optional). These fields are optional and left blank by default. Information you enter may reveal health information or religious belief, which is special category personal data under Article 9 UK GDPR. We ask for it only to make reasonable arrangements at the venue, we rely on your explicit consent under Article 9(2)(a) given by choosing to complete the field, and we share it only with the venue or caterer to the extent needed. You do not have to provide it, and you can ask us to delete it at any time by emailing privacy@redfirst.ai.
- Payment data. Card details are entered directly into Stripe’s hosted checkout. We never see or store card numbers; we receive a transaction reference and the amount paid.
- Waitlist data. Name, email, business details, and what you are hoping to get from the programme.
Lawful bases for these flows
| Purpose | Lawful basis |
|---|---|
| Taking and administering your booking, sending confirmations and calendar invites, contacting you about the event you booked | Performance of a contract - Article 6(1)(b) UK GDPR |
| Sending you information about future events where you ticked the marketing opt-in | Consent - Article 6(1)(a). Withdraw at any time by replying “unsubscribe” to any marketing email or emailing privacy@redfirst.ai |
| Dietary and accessibility arrangements at an in-person event | Explicit consent - Article 9(2)(a), alongside Article 6(1)(b) |
| Internal analytics on how attendees find us (the “how did you hear about this?” field) | Legitimate interests - Article 6(1)(f) |
| Holding you on the waitlist and contacting you when places open | Legitimate interests - Article 6(1)(f), responding to a request you made |
Retention for these flows
- Booking records: 7 years from the event date, for accounting and tax.
- Dietary and accessibility requirements: deleted within 30 days of the event.
- Waitlist data: until the waitlist closes or you ask us to remove you.
Recipients for these flows
The recipients are those already listed in the Privacy Notice above - Stripe (payment), GoHighLevel (CRM and event communications), Neon (database), Fly.io (application hosting) and Cloudflare (site delivery) - plus the venue or caterer for an in-person event, where you have given dietary or accessibility information.
Maintained in our legal document register and published to this site automatically. Source: docs/privacy-notice.md @ privacy-notice-v1.0.0 (f28be0ac).