Never leave a zone uncovered again

1. Who We Are

MarshalUp is operated by Build Forward (Ovidiu Dinu), Ireland. We are the data controller for personal data processed through the MarshalUp app. For privacy enquiries, contact us at support@buildforward.eu.

2. What We Collect

MarshalUp collects the minimum data necessary to provide the service:

Account Information

• Name, email address, and profile details
• Information shared via Apple Sign In (name and email only)
• Firebase authentication credentials (encrypted)

Building & Role Data

• Building assignments, floor assignments, and user role (admin, fire marshal, occupant)
• Daily check-in and check-out timestamps
• Availability records (dates marked as unavailable, with reason such as annual leave, sick, or working from home)

Fire Safety Records

• Fire marshal certification dates and expiry dates
• Training records (course name, completion date, expiry date)
• Fire register check records, including photos and signatures where required
• Drill participation records and emergency response data

Emergency Data

During emergencies and drills, we record evacuation status for each occupant (such as safe, missing, or needs help), response times, assembly point check-ins, and the names of marshals who performed floor sweeps. This data is essential for compliance reporting and improving safety outcomes.

Personal Emergency Evacuation Plans (PEEPs)

If a PEEP is created for a building occupant, we store: the person's name, contact details, impairment types (such as mobility, visual, hearing, cognitive, respiratory, or temporary), a description of assistance needed, assigned buddy, evacuation route, refuge point, equipment required, preferred alert method, and emergency contact details. This is special category data under UK GDPR (Article 9) — see Section 3 for the legal basis.

Visitor Data

• Visitor name, email, and phone number collected during check-in
• Check-in and check-out timestamps
• Safety induction completion status

Device & Technical Data

• Device tokens for push notifications (FCM and APNS)
• Device attestation data via Firebase App Check (used to verify genuine devices and prevent abuse)
• Network connectivity status (local only, not transmitted)

Subscription Data

• Subscription status and billing period (processed by Apple via StoreKit; we do not see your payment details)
• Organisation billing status synced to our database

3. Legal Basis for Processing

Under UK GDPR and EU GDPR, we process your data on the following bases:

• Contract performance (Article 6(1)(b)): Account data, building assignments, check-in records, and subscription management — necessary to provide the MarshalUp service.
• Legitimate interests (Article 6(1)(f)): Emergency response data, drill records, fire register checks, and compliance reporting — necessary for workplace fire safety, which is a legal obligation for building operators under the Regulatory Reform (Fire Safety) Order 2005.
• Explicit consent (Article 9(2)(a)): PEEP data containing health and disability information is special category data. It is processed only with the explicit consent of the data subject (or their representative) for the specific purpose of ensuring safe evacuation during emergencies.
• Legal obligation (Article 6(1)(c)): Retention of fire safety records as required by UK fire safety legislation.

4. How We Use Your Data

Your data is used exclusively to operate MarshalUp:

• Assigning fire marshals to floors and zones
• Sending emergency alerts and drill notifications
• Tracking drill participation and generating compliance reports
• Managing visitor check-ins and safety inductions
• Recording fire register checks for regulatory compliance
• Sending certification expiry reminders
• Ensuring people with PEEPs are accounted for during evacuations
• Generating PDF reports for fire safety audits

We do not sell, share, or monetise your personal data. We do not use any advertising or tracking SDKs.

5. Data Storage & International Transfers

All data is stored on Google Firebase (Google Cloud Platform) infrastructure with encryption at rest and in transit. Firebase stores data in data centres that may include locations outside the EEA, including the United States.

Where data is transferred outside the EEA/UK, it is protected by Google's Standard Contractual Clauses (SCCs) and their compliance with the EU-US Data Privacy Framework. For details, see Google's data processing terms at cloud.google.com/terms/data-processing-addendum.

MarshalUp also stores up to 100 MB of data in an on-device cache (using Firestore offline persistence) so the app functions during network outages. This cached data remains on your device and is cleared when you sign out or delete the app.

6. Visitor Data

Visitor records are temporary. Check-in data automatically expires 12 hours after the visit. A daily cleanup process permanently deletes expired visitor records. Visitors do not need to create an account — check-in data is collected via QR code and retained only for the duration of the visit plus the expiry window.

7. Push Notifications

MarshalUp sends push notifications for:

• Emergency alerts and all-clear notifications
• Fire drill activations and reminders
• Certification and training expiry warnings
• Team join requests and approvals
• Floor coverage gap warnings

Emergency alerts use iOS time-sensitive interruption level and may bypass Do Not Disturb and Focus modes for safety reasons. You can manage notification preferences in iOS Settings.

8. Third-Party Services

Service	Purpose	Data Shared
Firebase Authentication (Google)	Sign-in and account management	Email, name, encrypted credentials
Cloud Firestore (Google)	Database storage	All app data (encrypted)
Firebase Cloud Messaging (Google)	Push notifications	Device tokens, notification content
Firebase App Check (Google)	Device attestation / abuse prevention	Device attestation tokens
Apple Sign In	Authentication	Name and email (user-controlled)
Apple StoreKit	Subscription management	Subscription status (Apple handles payment)

We do not share your data with any parties beyond these essential service providers. We do not use analytics, advertising, or tracking SDKs.

9. Your Rights

Under UK GDPR and EU GDPR, you have the right to:

• Access your personal data (request a copy)
• Rectification — correct inaccurate data
• Erasure — request deletion of your data
• Restrict processing in certain circumstances
• Data portability — receive your data in a structured format
• Withdraw consent for PEEP data processing at any time
• Object to processing based on legitimate interests
• Lodge a complaint with the UK Information Commissioner's Office (ICO) or your local supervisory authority

You can delete your account directly from Settings in the app. When you delete your account:

• Your Firebase authentication account is deleted immediately
• Your profile, assignments, and personal data are removed from Firestore
• If you are the organisation owner, all organisation data (buildings, members, records) is deleted
• If you are a member, you are removed from the organisation and your data is deleted

For any data rights request, contact us at support@buildforward.eu. We will respond within 30 days.

10. Data Retention

• Active accounts: Data is retained while your account is active.
• Cancelled subscriptions: Organisation data is retained for 6 months before permanent deletion, giving time to reactivate.
• Fire safety records: Drill records, emergency event logs, and fire register checks are retained for the lifetime of the organisation for compliance with fire safety regulations.
• Deleted accounts: Personal data is removed immediately upon account deletion. Anonymised records in event logs (e.g., "a marshal swept Floor 3") may be retained for compliance.
• Visitor data: Automatically deleted 12 hours after check-in expiry.
• PEEP data: Deleted when the PEEP is removed by an administrator, or when the organisation account is deleted.

11. Data Security

We implement the following security measures:

• All data encrypted at rest and in transit (TLS 1.2+)
• Firebase App Check to verify genuine devices
• Role-based access controls enforced at the database level (Firestore Security Rules)
• Users cannot escalate their own roles or access other organisations' data
• Visitor check-in data is validated and size-limited to prevent abuse
• No sensitive data (passwords, payment details) is stored by MarshalUp directly

12. Children's Privacy

MarshalUp is designed for workplace use and is not intended for children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided data to us, contact support@buildforward.eu and we will delete it promptly.

13. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes through the app or by email. Continued use of MarshalUp after changes constitutes acceptance of the updated policy.

14. Contact

For privacy-related queries, contact us at:

Email: support@buildforward.eu
Data Controller: Build Forward (Ovidiu Dinu), Ireland

1. About MarshalUp

MarshalUp is operated by Build Forward (Ovidiu Dinu), Ireland ("we", "us", "our"). By creating an account or using MarshalUp, you agree to these Terms of Service.

2. Eligibility

MarshalUp is designed for workplace fire safety management. You must be at least 16 years old to create an account. By using MarshalUp, you represent that you have the authority to agree to these terms on behalf of yourself or your organisation.

3. Account Responsibilities

• You are responsible for maintaining the security of your account credentials.
• You must provide accurate information when creating your account and keep it up to date.
• You are responsible for all activity under your account.
• Organisation administrators are responsible for managing their team members' roles and access.

4. Acceptable Use

You agree not to:

• Use MarshalUp for any purpose other than legitimate fire safety coordination
• Submit false or misleading information
• Attempt to access data belonging to other organisations
• Interfere with or disrupt the service
• Use the app in any way that violates applicable laws or regulations

5. Subscriptions and Payment

• MarshalUp offers monthly and yearly auto-renewing subscriptions via the Apple App Store.
• Payment is charged to your Apple ID account at confirmation of purchase.
• Subscriptions automatically renew unless cancelled at least 24 hours before the end of the current billing period.
• You can manage or cancel your subscription in your Apple ID account settings.
• New organisations receive a 7-day free trial. No payment is required during the trial.
• If your subscription expires, your data is retained for 6 months before permanent deletion, giving you time to reactivate if needed.
• Refunds are handled by Apple in accordance with their refund policies.

6. Fire Safety Disclaimer

MarshalUp is a coordination and record-keeping tool. It does not replace:

• Professional fire risk assessments
• Certified fire safety training
• Compliance advice from qualified fire safety consultants
• Your legal obligations under the Regulatory Reform (Fire Safety) Order 2005 (UK) or equivalent legislation in your jurisdiction

You remain solely responsible for ensuring your building meets all applicable fire safety regulations. MarshalUp does not guarantee compliance with any specific standard or regulation.

7. Personal Emergency Evacuation Plans (PEEPs)

PEEPs created in MarshalUp are intended as operational reference documents during evacuations. They do not constitute a formal disability assessment or replace professional occupational health guidance. Organisation administrators are responsible for:

• Obtaining appropriate consent before creating a PEEP
• Ensuring PEEP information is accurate and reviewed regularly
• Keeping PEEP data confidential and sharing it only with those who need it for evacuation purposes

8. Service Availability

We aim to keep MarshalUp available at all times, but we do not guarantee uninterrupted service. The app includes offline functionality for critical emergency features. We are not liable for any loss or damage resulting from service interruptions, data delays, or technical failures.

9. Data and Privacy

Your use of MarshalUp is also governed by our Privacy Policy. By using MarshalUp, you consent to the collection and use of data as described in the Privacy Policy.

10. Intellectual Property

MarshalUp, including its design, code, content, and branding, is owned by Build Forward. You may not copy, modify, distribute, or reverse-engineer any part of the app.

11. Termination

• You may delete your account at any time from the app settings.
• We may suspend or terminate your account if you breach these terms.
• Organisation owners may remove members from their organisation at any time.
• Upon termination, your data will be handled as described in our Privacy Policy.

12. Limitation of Liability

To the maximum extent permitted by law, Build Forward shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of MarshalUp. Our total liability for any claim shall not exceed the amount you have paid for the service in the 12 months preceding the claim.

MarshalUp is provided "as is" without warranties of any kind, express or implied, including but not limited to merchantability, fitness for a particular purpose, or non-infringement.

13. Indemnification

You agree to indemnify, defend, and hold harmless Build Forward (Ovidiu Dinu), its affiliates, and its officers from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in any way connected with:

• Your use of or access to MarshalUp
• Your violation of these Terms of Service
• Your violation of any third-party rights, including privacy or intellectual property rights
• Any content or data you submit through the app

This indemnification obligation will survive the termination of your account and these Terms of Service.

14. Changes to These Terms

We may update these terms from time to time. We will notify you of material changes through the app or by email. Continued use of MarshalUp after changes constitutes acceptance of the updated terms.

15. Governing Law

These terms are governed by and construed in accordance with the laws of Ireland. Any disputes shall be subject to the exclusive jurisdiction of the courts of Ireland.

16. Contact

For questions about these terms, contact us at support@buildforward.eu.

Build Forward (Ovidiu Dinu), Ireland