Who is responsible
Firmpoint is run by Rumman Khan, who decides how the information on this page is used. For the documents your firm puts into the app, your firm decides what goes in, and we handle them on its behalf. Contact: rumman@firmpoint.app.
On the website
The waitlist. If you join the waitlist we keep your work email. If you answer the optional questions after it, we also keep which team you're in, where your firm is, how many people work there, and your company name.
Talk to us. If you send a message we keep your name, your work email, your company if you give it, what the message is about, and the message itself.
With either form we also note the time, which page you sent it from, and the country your connection came from. To stop one address flooding the forms, we keep a scrambled code made from your IP address that changes every day. The address itself is never stored.
A bot check. To keep automated spam out of the forms, Cloudflare Turnstile checks that a person is sending them. It starts only when you use a form. Cloudflare reads signals from your browser and connection, such as your IP address, and uses them only to tell people from bots.
What you send is kept in a Cloudflare database held in the EU, and each entry is emailed to Rumman so he can reply. We use it to reply to you, to send you updates about Firmpoint, and to tell you when it's ready for you. Nothing else. We keep it until you ask us to remove it, or until we no longer need it for those.
Usage analytics. We use Microsoft Clarity to see how the site is used, such as which sections people read and where they stop. It records how visitors move through the pages, such as clicks and scrolls. It is set never to store a cookie, so it cannot recognise you on a later visit. Cloudflare, which hosts the site, also counts visits, without cookies.
In the app: your firm's paperwork
The app exists to read the documents your firm chooses to connect. All of it is read-only, and all of it is your firm's data, not ours.
Email intake. If your firm connects a mailbox, we read new incoming mail to find quotes, invoices and delivery notes, and we file what we find. We can never send, reply, delete or change anything in the mailbox, and mail from before you connected stays where it is.
WhatsApp intake. Your suppliers can send paperwork on WhatsApp to Firmpoint's number. We read messages only from the chats your firm has named on its list, and file them in your firm's workspace. A chat that is not on any firm's list is left alone: we do not keep its messages or its files. Documents and photos from named chats are downloaded so the paperwork inside them can be filed. When a firm can connect its own WhatsApp Business number, the same list rule will apply to it.
Uploads. Documents your team uploads directly.
We use AI models to read these documents and pull out the fields your team needs, such as amounts and supplier names. Every extracted value keeps a link to the document it came from, and your team confirms values before they are trusted. Our AI providers do not use your data to train their models.
What we never do
- We never sell your information, and we never share it for advertising.
- We never send messages from your mailbox or your WhatsApp number.
- We never read chats or mailboxes you did not connect.
Why we may use it
We use what you send us to reply to you and to give your firm the service it asked for. We run analytics and the flood check because we have a genuine interest in a website that works and stays up, and neither identifies you. The optional questions are your choice: ask, and we delete your answers.
Who helps us run the product
Firmpoint runs on service providers who process data on our instructions: hosting and storage (Vercel, Render, Neon, Cloudflare), AI document reading (Anthropic), email delivery (Resend), payments (Dodo Payments, when your firm buys credit), product analytics (PostHog in the app, Microsoft Clarity on the website), and the platforms your firm connects (Google's Gmail API, Meta's WhatsApp Business Platform). Some of them work in the United States or other countries outside the UK and the UAE. When data goes to them, it goes under their data-protection terms.
Google user data
Firmpoint's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We request read-only Gmail access, we use it only to file your firm's procurement paperwork into your workspace, and we do not transfer Gmail data to anyone else except as needed to provide that feature, as required by law, or with your explicit consent.
WhatsApp data
Messages received through the WhatsApp Business Platform are used only to provide document intake for the firm whose list names that chat. Take a chat off your list in Settings and nothing further from it is read. If your firm has connected its own number, disconnecting it in Settings deletes the connection and its stored credential immediately, along with its list. Documents already filed stay in your firm's workspace, because they were read with permission at the time.
Keeping and deleting data
Your firm's data stays as long as your firm uses Firmpoint. Disconnect a mailbox or a WhatsApp number at any time in Settings, and the stored credential goes with it. Email us to delete your firm's data, your waitlist entry or a message you sent, and we will do it and confirm.
Security
Connection credentials are stored encrypted, data moves over encrypted connections, and your firm's records are closed to every other firm. No system is perfectly secure. If a breach affects your information, we will tell you as the law requires.
Cookies
The app uses a cookie to keep you signed in. The website sets no cookies of its own, and Clarity is told not to set any.
Your rights
You can ask what we hold about you, and have it corrected, sent to you, or deleted. Write to rumman@firmpoint.app and we will answer within a month. We may ask you to confirm who you are first. If you are in the UK and unhappy with how we handled it, you can complain to the Information Commissioner's Office at ico.org.uk.
Firmpoint is for businesses and is not meant for anyone under 18.
Changes
If this page changes in a way that matters, we will say so here with a new date at the top.