Privacy Policy

1. Scope

This Policy applies to information collected through:

• the Phoenix Consultants Group website;
• the FireFlight Data Systems website;
• website contact forms, assessments, and inquiry forms;
• the FireFlight platform and related implementation, support, and professional services;
• sales, account, billing, and customer-support interactions; and
• analytics technologies used on our websites.

This Policy does not replace the terms of any signed contract, order form, data processing addendum, or Master Software-as-a-Service Agreement. If a signed agreement conflicts with this Policy, the signed agreement controls to the extent of the conflict.

2. Information We Collect

Information you provide directly

We may collect information you submit to us, including:

• name, business email address, phone number, company name, job title, and mailing address;
• messages, questions, assessment responses, and other information submitted through forms;
• account, billing, and transaction-related information;
• support requests, technical information, and communications with our team;
• project information, project data, documents, records, files, and other content supplied by customers or authorized users; and
• information about employees, contractors, customers, contacts, leads, vendors, assets, inventory, inspections, incidents, safety activities, compliance activities, work records, and other business operations when customers choose to store or manage such information in FireFlight.

Information collected automatically

When you visit our websites, we may automatically collect limited technical and usage information, such as:

• IP address and approximate location;
• browser type, device type, operating system, and screen size;
• pages viewed, referring pages, session duration, and navigation paths;
• clicks, scrolling, mouse movements, and similar interaction data; and
• cookie identifiers and other analytics-related identifiers.

3. How We Use Information

We may use information to:

• provide, configure, host, secure, maintain, and support the Services;
• respond to inquiries, assessments, support requests, and sales questions;
• create and administer accounts, projects, subscriptions, and customer relationships;
• migrate, configure, and organize customer data and workflows;
• process billing and payments;
• monitor website performance, diagnose technical issues, and improve usability;
• protect the Services, customers, and users from misuse, fraud, or security threats;
• comply with legal obligations and enforce our agreements; and
• create aggregated or de-identified operational and statistical information that does not identify a customer, user, or individual.

We do not use Customer Data to train generally available machine-learning models made available to other customers unless the customer has provided prior written consent.

4. Analytics and Cookies

We use analytics technologies to understand how visitors use our websites and to improve performance and usability.

Google Analytics

Google Analytics may use cookies or similar technologies to collect information about website traffic, sessions, device and browser characteristics, approximate location, referring pages, and interactions with our websites. Google processes this information under its own terms and privacy practices.

Microsoft Clarity

Microsoft Clarity helps us understand how visitors interact with our websites through features such as heatmaps and session recordings. Clarity may collect clicks, scrolling, mouse movements, page navigation, browser and device information, and related technical data. Sensitive form fields and user-input data should be masked or excluded from recordings according to our configuration and Microsoft's product controls.

Your choices

You may control cookies through your browser settings and, where available, our cookie or analytics consent controls. Disabling analytics cookies may affect our ability to understand website usage but should not prevent access to the public websites.

5. Customer and Project Data

Customers retain ownership of Customer Data submitted to FireFlight. Phoenix processes Customer Data only as needed to provide, secure, support, and improve the Services, as directed by the customer, or as required by law.

FireFlight may process customer and project-related information selected by the customer, including business contacts, leads, accounts, projects, project records, operational data, work records, inspections, safety and incident records, compliance and regulatory information, permits, obligations, assets, inventory, purchasing, estimates, proposals, invoices, and related documents.

Phoenix hosts and operates FireFlight on infrastructure owned and controlled by Phoenix at 9 Wilson Drive, Northfield, New Jersey 08225. Phoenix does not use a third-party public cloud provider to host Customer Data.

6. How We Share Information

We may disclose information only as reasonably necessary in the following circumstances:

• Service providers. We may use limited service providers that perform functions on our behalf. For example, PayPal may process billing contact and payment information. Payment card numbers are collected and stored by PayPal, not by Phoenix.
• Legal and compliance purposes. We may disclose information when required by law, court order, subpoena, or other valid legal process, or when reasonably necessary to protect rights, safety, systems, customers, or users.
• Business transactions. Information may be transferred as part of a merger, acquisition, reorganization, financing, or sale of all or part of our business, subject to appropriate confidentiality and legal protections.
• With customer direction or consent. We may disclose information when a customer or authorized user directs us to do so or provides consent.

Our current subprocessor information is available at https://phxconsultants.com/legal/subprocessors.

7. No Sale of Personal Information

Phoenix does not sell personal information, Customer Data, or project data to third parties. We do not disclose personal information to third parties in exchange for money.

8. Data Retention and Deletion

We retain information only for as long as reasonably necessary to provide the Services, maintain business and legal records, resolve disputes, enforce agreements, and meet legal obligations.

For FireFlight Customer Data, unless a signed agreement states otherwise:

• customers may export Customer Data during the subscription term;
• after expiration or termination, Phoenix retains Customer Data for 30 days and makes it available for export;
• after that period, Phoenix deletes Customer Data from active systems within 30 days; and
• Phoenix deletes Customer Data from backups within 90 days, subject to legal retention obligations.

System and access logs used to investigate security incidents are retained for at least 60 days.

9. Security

Phoenix maintains administrative, physical, and technical safeguards designed to protect information against unauthorized access, disclosure, alteration, loss, or destruction. These measures include access controls, encryption in transit and at rest, backups, system logging, patch management, and incident-response procedures.

No security method or system is completely secure. We therefore cannot guarantee absolute security.

Additional security information is available at https://phxconsultants.com/legal/security.

10. Privacy Rights

Depending on applicable law and your relationship with us, you may have the right to request access to, correction of, or deletion of certain personal information. You may also request information about how your personal information is used or disclosed.

Where Phoenix processes personal information on behalf of a FireFlight customer, that customer generally controls the information. In those cases, we may direct your request to the applicable customer.

To submit a request, contact us using the information in Section 15. We may need to verify your identity and authority before completing a request.

11. International Visitors

Phoenix currently sells the Services to customers located in the United States. Our public websites may nevertheless be accessible from other countries. If you access the websites from outside the United States, you understand that information may be processed in the United States, where privacy laws may differ from those in your location.

12. Children's Privacy

The Services are intended for businesses and adult users. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information to us, please contact us so we can review and delete it as appropriate.

13. Third-Party Links

Our websites may contain links to third-party websites or services. We are not responsible for the privacy, security, or content practices of those third parties. You should review their policies before providing information.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the effective date at the top of the page. Material changes may also be communicated through the Services, by email, or by another reasonable method.

15. Contact Us