Privacy policy

1. Who we are

FIIBAC is run by FIIBAC LTD, a company registered in England and Wales (number 14820079) at The American Barns, Banbury Road, Lighthorne, Warwick, Warwickshire, England, CV35 0AE. In this policy “we” and “us” mean FIIBAC LTD.

This policy covers the FIIBAC website and portal at fiibac.app, the FIIBAC mobile apps, and the feedback, invite and guest links that FIIBAC sends.

For anything about your data, email [email protected].

2. Your organisation is in charge of your feedback

FIIBAC is set up by organisations (schools, clubs and employers) to give feedback to their own people. That splits responsibility in two.

Your organisation is the data controller for feedback

The school, club or employer that added you decides who is in FIIBAC, what feedback is recorded and who can see it. We hold that information for them, on their instructions, as their data processor. Their own privacy notice explains why they use FIIBAC.

We are the data controller for accounts and this website

We decide how sign-in details, security records and enquiries sent to us are used.

3. What we hold

People who receive feedback

• Your name, and any other names you are known by in the organisation.
• The groups or teams you are in, and where the organisation records them, your position and shirt number.
• Your email address, mobile number, date of birth or age band, where the organisation chooses to add them.
• Feedback about you: what the person giving it said or typed, the skills it relates to, whether each was Strong, OK or Needs work, any score they gave, and when and at which event it was observed.
• What FIIBAC works out from that feedback: summaries, your Development Score and its trend, goals, and suggestions on how to improve.
• Who has been linked to your profile (you, or a parent or guardian), and when a feedback link was opened.

People with an account

• Your name and email address.
• Your password, stored as a one-way hash that we cannot read, and any passkeys or two-factor codes you set up.
• Your role in each organisation (admin, coach or manager, assessor, recipient, or parent or guardian).
• If you use the app: a notification token for your device, the device type and the app version.
• The feedback you give and the changes you make.

Guests

If you give feedback from a guest link or QR code, we hold the feedback you write, the name you give, your email address if you choose to add it, and the description the person who invited you gave (for example “Sam’s dad”). You don’t need an account.

Voice recordings

When someone speaks their feedback in the app, the recording is sent to us to be turned into text. It is deleted as soon as they confirm the text, and after 24 hours at the latest if they never do. On the guest web page, “Speak instead” uses your browser’s own speech recognition: depending on your browser, the audio may be handled by the browser’s maker. We receive only the text.

Technical and security records

• Your IP address and browser type while you are signed in.
• A log of important actions (such as exporting or erasing a person, or changing settings), with who did it, when and from which IP address.
• Cookies that keep you signed in. See the cookie policy.

Enquiries

If you email us, for example to book a demo, we keep your message and contact details so we can reply.

What we don’t collect

We don’t collect your location, contacts, photos or advertising identifiers. We don’t take card payments in FIIBAC. We don’t run advertising or analytics trackers, and we never sell personal data.

FIIBAC is for development feedback. It is not designed for health, medical or safeguarding information, and organisations agree not to record it.

4. Why we use it

Feedback, held for your organisation

We use it only to provide FIIBAC to that organisation: to record feedback, match it to the right person and skill, show it to the people the organisation allows, and produce scores, trends and reports. Your organisation decides the lawful basis for this and sets it out in its own privacy notice.

Accounts and this website, where we are the controller

We don’t send marketing to people who are in FIIBAC because their organisation added them.

5. How FIIBAC uses AI

FIIBAC uses AI models from Anthropic and OpenAI to do specific jobs. They are sent only what each job needs.

• Turning speech into text. The recording goes to OpenAI. People’s names are sent as spelling hints only if the organisation allows it; this is off by default for organisations with under-18s.
• Reading feedback. The words of the feedback go to Anthropic’s Claude, which picks out what was said about each skill. It does not decide who the feedback is about.
• Summaries and “How to improve”. For improvement suggestions, names are replaced with “[name]” before the quotes are sent.
• Ask FIIBAC. When a coach or manager asks a question about their organisation’s feedback, the question and the relevant figures and quotes for that organisation go to Claude.

Under their business terms, neither provider uses what we send to train its models.

AI suggests; people decide. Nothing is sent to a recipient until the person giving feedback has checked it, and they can change anything the AI proposed. FIIBAC makes no decision about you by automated means alone that has a legal or similarly significant effect.

6. Children and young people

FIIBAC can be used by people aged 13 and over. Each organisation sets its own minimum age, which can’t be lower than 13. Where an organisation has under-18s:

• young people are never publicly listed or searchable;
• a parent or guardian can only see their own child’s feedback, and only after the organisation has invited them;
• feedback from guests is held for a coach or teacher to review before the young person sees it;
• notifications don’t show names on a locked phone screen;
• the organisation names a safeguarding lead and a data protection contact when it sets FIIBAC up.

If you are under 18 and something in this policy isn’t clear, ask a parent, guardian or your coach or teacher, or email us.

7. Who we share it with

Within FIIBAC, your feedback is visible to the staff of your organisation who are allowed to see it, to you, and to a parent or guardian the organisation has linked to you. One organisation can never see another’s data.

We use these companies to run FIIBAC. Each only receives what it needs and acts on our instructions.

We may also share information when the law requires it, to protect someone from harm, or with a buyer if the business is sold, in which case this policy would continue to apply.

8. Data sent outside the UK

FIIBAC’s database is in the UK. Some of the companies above handle data in the United States or elsewhere. When that happens we rely on a safeguard recognised by UK data protection law: either the UK extension to the EU–US Data Privacy Framework, or the UK’s International Data Transfer Addendum to the EU standard contractual clauses. Email us if you would like to know more about them.

9. How long we keep it

When an organisation stops using FIIBAC, we delete its data or return it, as agreed with that organisation. When a person is erased, feedback that is only about them is deleted, and their name and quotes are removed from feedback that also covers other people.

10. Your rights

Under UK data protection law you can ask to:

• see a copy of the data held about you;
• have anything wrong or out of date corrected;
• have your data deleted;
• have its use limited, or object to how it is being used;
• receive the data you provided in a form you can take elsewhere;
• withdraw consent, where consent is what the use relies on.

For feedback and your profile, ask your organisation: it is the controller and its admins can export or erase your data directly. For your account or anything else, email [email protected]. We reply within one month and there is no charge.

If you are unhappy with how your data has been handled, tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

11. How we protect it

• Everything travels over an encrypted connection (HTTPS).
• Passwords are stored as one-way hashes. Accounts can add two-factor sign-in or passkeys.
• Feedback, invite and guest links use long random codes, of which we store only a hash, and they expire.
• Access is limited by organisation and by role, and important actions are logged.

No system is perfectly secure. If a breach puts you at risk we will tell the organisation involved, and the ICO and you where the law requires it.

12. Changes to this policy

We will update this page when FIIBAC changes how it handles personal data, and change the date at the top. If a change is significant we will tell organisation admins before it takes effect.

See also our terms of use and cookie policy.