Privacy Notice
What personal data CommandGridTools.com collects across its tools, why we collect it, and what your rights are. Written in plain English.
Who we are
Controller: Exmoor AI Labs Ltd, registered in England and Wales (Company No. 17177556), registered office: 71–75 Shelton Street, Covent Garden, London WC2H 9JQ. CommandGridTools is a trading name of Exmoor AI Labs Ltd.
Contact: [email protected] · +44 7356 254302
We are not required to appoint a Data Protection Officer but take our obligations under the UK GDPR and Data Protection Act 2018 seriously.
For the rules governing use of the tools themselves — including disclaimers and limitation of liability — see our Terms of Service.
What data each tool collects
| Tool | Data collected | Why |
|---|---|---|
| XVR Scenario Viewer (/xvr/) | None — all processing happens in your browser | — |
| Build-Aid | IP address only (for rate limiting). Scenario parameters you enter are sent to AI but not linked to your identity. | AI scenario generation, illustrative scene images, and API quota management |
| Scan-Aid | Uploaded photo, IP address (for rate limiting) | AI scene analysis for training purposes |
| HazardGrid | IP address only (for rate limiting). The training scene is AI-generated; no personal data is required. | AI hazard-identification training and API quota management |
| WatchBrief | IP address only (for rate limiting). Scenario settings you enter are sent to AI but not linked to your identity. | AI watch-room scenario generation and API quota management |
| Drive-Aid | Name of person being assessed, driving observations, GPS location during assessment, timestamps | Driving competency assessment records for FRS training |
| CommandGridQuiz | Name, email, hashed password, organisation, quiz activity, IP address (solo rate limiting) | Quiz platform account management |
| CommandGridPoliceQuiz | IP address only (for rate limiting). Quiz topics you enter are sent to AI but not linked to your identity. No account required. | AI policing-quiz generation and API quota management |
| Contact / enquiry form (homepage & /services/) | Your name, email address, organisation (optional) and message | So we can respond to your enquiry. Delivered to us by email (via Zoho Mail); a content-free "new enquiry" alert is also sent to us via Telegram (it contains no personal data). |
| Donation popup (most tools) | Browser localStorage only (stored on your device, not our servers): anonymous visit counter, last-donation timestamp, last-dismissed timestamp. If you choose to donate: the amount and which tool you were using are sent to Stripe. Card and billing details are collected directly by Stripe — we never see or store them. | To show the popup at appropriate intervals and process optional one-time donations via Stripe Checkout |
Legal basis for processing
We rely on legitimate interests (UK GDPR Article 6(1)(f)) for most processing — specifically, providing professional training tools to verified fire and rescue service staff. For each tool, the processing is limited to what is necessary for that purpose.
For Drive-Aid assessments of employees, the employing FRS is the data controller and CommandGridTools.com acts as a data processor under a data processing agreement.
Artificial intelligence
Several tools use third-party AI services to generate or analyse training content. In every case the data sent is either a training photo you upload or text parameters you enter — we do not send your name, email or account details to any AI provider.
Anthropic (Claude) — text analysis and, for image-based tools, scene analysis. Used by Scan-Aid (your uploaded photo, as base64 image data), HazardGrid (the AI-generated scene), and Build-Aid, WatchBrief, CommandGridQuiz & CommandGridPoliceQuiz (scenario/quiz parameters, text only). Anthropic does not use API inputs to train its models. See Anthropic's Privacy Policy.
OpenRouter (which routes to Google's Gemini image models) — generates the illustrative incident-scene images. Used by Build-Aid, HazardGrid, WatchBrief, CommandGridQuiz & CommandGridPoliceQuiz. Only a text scene-description prompt is sent — no personal identifiers. See OpenRouter's Privacy Policy.
ElevenLabs — converts AI-generated guidance text to speech for read-aloud narration. Used by Scan-Aid, HazardGrid, WatchBrief, CommandGridQuiz & CommandGridPoliceQuiz. The text sent is AI-generated guidance only — no personal identifiers. See ElevenLabs' Privacy Policy.
Brave Search — CommandGridQuiz sends a quiz topic string to Brave Search to gather current context for scenario generation. No personal identifiers are sent.
How we store your data
Data is stored on an AWS Lightsail server (Amazon Web Services), hosted in the EU/UK region. All traffic is encrypted in transit via HTTPS, enforced by Cloudflare. Passwords are hashed using bcrypt and are never stored in plain text. We never store payment card information — donations are processed entirely by Stripe under their own security standards (PCI-DSS Level 1). See Stripe's Privacy Policy for details of how they handle payment data.
Who we share your data with
| Third party | Purpose | Data shared |
|---|---|---|
| Amazon Web Services | Hosting and storage | All server-side data |
| Cloudflare | CDN and HTTPS | IP addresses, HTTP headers |
| Anthropic | AI text/scene analysis (Scan-Aid, HazardGrid, Build-Aid, WatchBrief, CommandGridQuiz, CommandGridPoliceQuiz) | Uploaded photos or text parameters as described above |
| OpenRouter (→ Google) | AI scene-image generation (Build-Aid, HazardGrid, WatchBrief, CommandGridQuiz, CommandGridPoliceQuiz) | Text scene-description prompts only — no personal identifiers |
| ElevenLabs | Text-to-speech narration (Scan-Aid, HazardGrid, WatchBrief, CommandGridQuiz, CommandGridPoliceQuiz) | AI-generated text only |
| Brave Search | Context lookup for quiz generation (CommandGridQuiz) | Quiz topic strings only — no personal identifiers |
| Zoho Mail | Delivering contact-form enquiries to us and sending you an auto-reply | Your name, email, organisation and message (from the contact form) |
| Telegram | A content-free "new enquiry received" alert to our team | No personal data — the alert says only that an enquiry arrived and its type |
| Stripe | Payment processing for voluntary donations | Donation amount, which tool you were using. Card and billing details are collected directly by Stripe under their own privacy policy — we never receive or store them. |
We do not sell your data. We do not share your data with any other third parties.
International data transfers
Some of our processors operate outside the UK/EU. In particular, our AI providers (Anthropic, OpenRouter and the Google models it routes to, and ElevenLabs), Brave Search, and Stripe may process data in the United States or other countries. Where this happens, the transfer is covered by the provider's own safeguards (such as Standard Contractual Clauses or an adequacy decision). The data involved is limited to training photos or text prompts and, for donations, the amount — never your account credentials.
How long we keep your data
- Accounts (CommandGridQuiz): Until you request deletion or the service closes. We aim to delete inactive accounts after 12 months.
- Scan-Aid photos and results: Until you delete them, or a maximum of 30 days (automated deletion in progress).
- Drive-Aid assessments: Up to 2 years, in line with typical FRS training record retention.
- Contact-form enquiries: Kept while we handle your enquiry and for a reasonable follow-up period, then deleted.
- IP rate-limit data: Resets daily.
Training use only
All CommandGridTools tools are for training and exercise use only. Do not upload photographs of real casualties, real incidents, or identifiable members of the public without their consent. Do not record real operational incident data in any CommandGridTools tool.
Your rights
Under the UK GDPR you have the right to:
- Access the personal data we hold about you
- Correct inaccurate data
- Delete your account and associated data
- Object to processing based on legitimate interests
- Portability of your data in a machine-readable format
To exercise any of these rights, email [email protected]. We will respond within one calendar month.
Complaints
If you believe we have mishandled your data, you have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk / 0303 123 1113.
Changes to this notice
We will update this notice when our processing changes. The version date at the top indicates when it was last revised.