Privacy policy

Fire Pixel is a trading name of CopperChunk Limited, a private limited company registered in the Republic of Ireland (company number 576053), Unit 72 Eastlink Business Park, Ballysimon Road, Limerick, V94 0E38. CopperChunk Limited is the data controller for personal data collected through firepixel.co.uk.

Questions about this policy or your data: ben@copperchunk.com.

What we collect

Information you give us. When you use the contact form or book a call we collect what you provide: your website, the type of work you are asking about, your email address, monthly ad spend, call-tracking position, CRM or ecommerce platform, and any description of the current problem. If you become a client we also hold the contact, project and billing information needed to do the work.

Attribution data. Because measurement is the business, we practise what we sell. With your consent, when you arrive from an ad or a campaign link we record the traffic source, medium, campaign, term and content, and any ad click identifiers in the URL (such as Google's gclid, Meta's fbclid or Microsoft's msclkid). These are stored in first-party cookies for up to 90 days and attached to your enquiry if you submit the form, so we know which campaign produced it.

Technical data. Our infrastructure providers log IP address, browser type, device type, pages viewed and referrer URL for security and performance.

Website signal scanner. If you use the Google Ads Signal Plan, the public URL you enter and a Cloudflare Turnstile anti-abuse token are sent to a dedicated scanner. It fetches no more than two public source pages, may fetch up to two published Google Tag Manager containers from Google's public endpoint, and asks an isolated browser on Fire Pixel's VPS to render the same public pages in fresh pre-consent contexts. It does not click a consent choice, submit forms, log in or reuse cookies from an earlier scan. The browser records bounded tag, host, form, telephone and visible consent evidence, then returns sanitised observations only. Public tag and container identifiers may be returned in full because the scanned site already publishes them. Raw page source, DOM, request query strings, request or response bodies, cookie values and the temporary browser profile are not returned to your browser or retained by the scanner. The website owner and public third-party services may see ordinary requests from Cloudflare or Fire Pixel infrastructure in their logs. Do not enter private preview URLs, login links, query strings or personal data.

Analytics and behaviour. With your consent, Google Analytics 4 measures how the site is used and Microsoft Clarity creates session recordings and heatmaps with configured masking controls so we can see where pages fail. Optional analytics storage and Clarity recording are denied before the relevant consent. If Google Consent Mode is configured in advanced mode, supported Google tags may send limited cookieless signals without setting analytics or advertising cookies.

Client-service data. Where a client instructs us to work with advertising, analytics, CRM or call data, the client remains the controller unless the project documents say otherwise and CopperChunk Limited acts on its documented instructions. The data, purpose, systems, access and retention are recorded for the engagement.

How we use it

• To answer your enquiry and, where you instruct us, to deliver the services. Lawful basis: taking steps to enter into a contract, and the contract itself.
• To understand which marketing produced an enquiry. Lawful basis: your consent for placing the attribution cookies, given through the cookie banner; legitimate interest in analysing the enquiry and its source once submitted.
• To run analytics and session recording. Lawful basis: your consent, given through the cookie banner and revocable at any time.
• To operate and protect the public website signal scanner, including Turnstile and short-lived rate limits. Lawful basis: legitimate interest in providing the requested tool and preventing abuse.
• To perform agreed analysis, automation or AI-assisted classification for a client. Lawful basis and roles: the client's documented instructions and the applicable contract or data processing agreement.
• To meet legal obligations such as tax and accounting records. Lawful basis: legal obligation.

We do not sell personal data, and we do not use it for automated decisions that produce legal effects.

Who processes it for us

We use a small set of processors, each under their own data processing terms:

• Cloudflare for DNS, security and content delivery
• Google (Analytics, Tag Manager, Ads, Workspace) for measurement, advertising and email
• Microsoft Clarity for session recordings and heatmaps
• CookiePal for consent management
• Cal.com for call bookings
• Hetzner, for our Germany-based server, on which we self-host n8n to process form submissions

For a client implementation we may also use the client's CRM, call-tracking provider, cloud account or an external AI model provider. We agree the relevant systems before use, minimise the data sent and document any provider processing personal data on our behalf.

Form submissions go to our own self-hosted automation, not to a third-party form service. Some providers (Google, Microsoft, Cloudflare) may transfer data outside the EEA under approved safeguards such as Standard Contractual Clauses and the EU-US Data Privacy Framework.

How long we keep it

Enquiry data is kept for as long as reasonably needed to handle the enquiry and any engagement that follows. Client records are kept for the duration of the engagement plus the periods Irish tax and company law require. Attribution cookies expire after 90 days. Analytics and session-recording data follows the retention period configured in the relevant account. Project records follow the retention schedule agreed for the engagement, subject to legal and backup requirements.

Your rights

Under the GDPR (and the UK GDPR where it applies) you can ask us for access to your data, correction, erasure, restriction of processing, portability, and you can object to processing based on legitimate interest. You can withdraw cookie consent at any time from the cookie policy page.

To exercise any of these, email ben@copperchunk.com. You can also complain to the Irish Data Protection Commission (dataprotection.ie) or, for UK matters, the Information Commissioner's Office (ico.org.uk).

Changes

We update this policy when the stack or the law changes. The version on this page is always current.

Our public confidentiality, NDA and AI disclosure explains how AI-assisted work and client information are handled.

Last updated: 30 August 2026.