Privacy policy

Fire Pixel is a trading name of CopperChunk Limited, a private limited company registered in the Republic of Ireland (company number 576053), Unit 72 Eastlink Business Park, Ballysimon Road, Limerick, V94 0E38. CopperChunk Limited is the data controller for personal data collected through firepixel.co.uk.

Questions about this policy or your data: [email protected].

What we collect

Information you give us. When you use the contact form or book a call we collect what you provide: your website, the type of work you are asking about, your email address, monthly ad spend, call-tracking position, CRM or ecommerce platform, and any description of the current problem. If you become a client we also hold the contact, project and billing information needed to do the work.

Attribution data. Because measurement is the business, we practise what we sell. With your consent, when you arrive from an ad or a campaign link we record the traffic source, medium, campaign, term and content, and any ad click identifiers in the URL (such as Google's gclid, Meta's fbclid or Microsoft's msclkid). These are stored in first-party cookies for up to 90 days and attached to your enquiry if you submit the form, so we know which campaign produced it.

Product journey identifiers. If you grant analytics consent, we create a random pseudonymous fp_journey_id and allow PostHog to use first-party browser persistence. The identifier is valid for no more than 90 days and lets us understand a journey from a page or tool to pricing, contact and a later commercial stage without using your name or email address as the analytics identity.

Technical data. Our infrastructure providers log IP address, browser type, device type, pages viewed and referrer URL for security and performance.

Website signal scanner. If you use the Google Ads Signal Plan, the public URL you enter and a Cloudflare Turnstile anti-abuse token are sent to a dedicated scanner. It fetches no more than two public source pages, may fetch up to two published Google Tag Manager containers from Google's public endpoint, and asks an isolated browser on Fire Pixel's VPS to render the same public pages in fresh pre-consent contexts. It does not click a consent choice, submit forms, log in or reuse cookies from an earlier scan. The browser records bounded tag, host, form, telephone and visible consent evidence, then returns sanitised observations only. Public tag and container identifiers may be returned in full because the scanned site already publishes them. Raw page source, DOM, request query strings, request or response bodies, cookie values and the temporary browser profile are not returned to your browser or retained by the scanner. The website owner and public third-party services may see ordinary requests from Cloudflare or Fire Pixel infrastructure in their logs. Do not enter private preview URLs, login links, query strings or personal data.

For service reliability, the scanner also creates a fresh random scan_id for that run and sends PostHog EU Cloud a small anonymous operational event. It contains only allowlisted counts, true-or-false indicators, duration, completion status and a finite failure code. This server event has no reusable visitor identifier, disables geographic enrichment and does not create a person profile. We never send the scanned URL or domain, raw findings or results, public tag IDs, page source, request details, form contents, or your email address to PostHog. If analytics consent exists, the browser may also supply the pseudonymous fp_journey_id so the scan can be included in that consented product journey. Without analytics consent, the anonymous scan_id is not linked to a browser journey.

Analytics, product journeys and behaviour. With your consent, Google Analytics 4 measures how the site is used, Microsoft Clarity creates session recordings and heatmaps with configured masking controls, and PostHog EU Cloud records explicit product-journey events. PostHog helps us understand whether a consented visitor uses the Signal Plan, views pricing, starts contact and later becomes a qualified lead or client. PostHog autocapture and session replay are disabled. Its browser event and property allowlists exclude form values, email addresses, the Signal Plan URL field and result area, full URLs with query strings, and other user-entered text. Optional analytics storage, PostHog browser capture and journey linkage, and Clarity recording are denied before the relevant consent. PostHog also honours an enabled Global Privacy Control or Do Not Track signal, in which case it creates no journey identifier and the scanner run is not linked to a browser journey. If Google Consent Mode is configured in advanced mode, supported Google tags may send limited cookieless signals without setting analytics or advertising cookies; PostHog does not use that route.

Optional surveys. With analytics consent, PostHog may show one of three short, dismissible surveys: after a completed scan with no later action, on the pricing page, or after an enquiry. Answering is optional. Survey prompts ask you not to include contact details, website addresses or other personal data. Responses are bounded and checked so email addresses, URLs and domain-like text are not sent to PostHog.

Client-service data. Where a client instructs us to work with advertising, analytics, CRM, call or hosted-website data, the client remains the controller unless the project documents say otherwise and CopperChunk Limited acts on its documented instructions. Hosting infrastructure can process ordinary website visitor logs, form traffic, account information, website files and databases. The data, purpose, systems, access, providers and retention are recorded for the engagement.

How we use it

• To answer your enquiry and, where you instruct us, to deliver the services. Lawful basis: taking steps to enter into a contract, and the contract itself.
• To understand which marketing produced an enquiry. Lawful basis: your consent for placing the attribution cookies, given through the cookie banner; legitimate interest in analysing the enquiry and its source once submitted.
• To run analytics, explicit PostHog product-journey measurement, optional surveys and session recording. Lawful basis: your consent, given through the cookie banner and revocable at any time.
• To operate, protect and monitor the reliability of the public website signal scanner, including anonymous PostHog operational events, Turnstile and short-lived rate limits. Lawful basis: legitimate interest in providing the requested tool, identifying failures and preventing abuse.
• To perform agreed analysis, automation or AI-assisted classification for a client. Lawful basis and roles: the client's documented instructions and the applicable contract or data processing agreement.
• To meet legal obligations such as tax and accounting records. Lawful basis: legal obligation.

We do not sell personal data, and we do not use it for automated decisions that produce legal effects.

Who processes it for us

We use a small set of processors, each under their own data processing terms:

• Cloudflare for DNS, security and content delivery
• Google (Analytics, Tag Manager, Ads, Workspace) for measurement, advertising and email
• Microsoft Clarity for session recordings and heatmaps
• PostHog EU Cloud for anonymous scanner reliability events, consented product-journey analytics and optional surveys
• CookiePal for consent management
• Cal.com for call bookings
• Hetzner, for our Germany-based server, on which we self-host n8n to process form submissions
• MechanicWeb, for managed website hosting where it is the platform named in the client proposal

For a client implementation we may also use the client's CRM, call-tracking provider, cloud account or an external AI model provider. We agree the relevant systems before use, minimise the data sent and document any provider processing personal data on our behalf.

Form submissions go to our own self-hosted automation, not to a third-party form service. The PostHog project uses its EU Cloud data region. Where a provider or its approved subprocessors transfers data outside the EEA, the transfer must use an approved safeguard such as Standard Contractual Clauses or the EU-US Data Privacy Framework where applicable.

How long we keep it

Enquiry data is kept for as long as reasonably needed to handle the enquiry and any engagement that follows. Client records are kept for the duration of the engagement plus the periods Irish tax and company law require. Attribution cookies expire after 90 days. The fp_journey_id and PostHog cookies expire within 90 days. PostHog's local-storage copy carries the same fixed deadline and is deleted when Fire Pixel is next opened at or after it; expired state is never reused. Raw PostHog product events and optional survey responses are retained for no more than 12 months, then deleted or reduced to aggregate reporting. Google Analytics and Clarity data follow the retention periods configured in those accounts. Project records follow the retention schedule agreed for the engagement, subject to legal and backup requirements.

Your rights

Under the GDPR (and the UK GDPR where it applies) you can ask us for access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. You can withdraw cookie consent at any time from the cookie policy page. Withdrawing analytics consent opts the browser out of PostHog and deletes its first-party PostHog persistence and fp_journey_id from that browser. Events already collected follow the retention period above unless you ask us to handle them sooner under an applicable right.

To exercise any of these, email [email protected]. You can also complain to the Irish Data Protection Commission (dataprotection.ie) or, for UK matters, the Information Commissioner's Office (ico.org.uk).

Changes

We update this policy when the stack or the law changes. The version on this page is always current.

Our public confidentiality, NDA and AI disclosure explains how AI-assisted work and client information are handled.

Last updated: 4 September 2026.