Privacy Policy

1. Introduction

Friam Limited (“we”, “us”, “our”) is the company behind AgentGuard, Ready Vet Staff (VetGuard), HotelGuard, FirmGuard, CareGuard and the EveryGuard family of UK compliance products. We are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our marketing sites or use our services.

2. Our approach to privacy

Friam operates a ‘privacy by design’ model. Our marketing websites do not use non-essential tracking cookies or cross-site advertising pixels. Pageview tracking on our sites is first-party, session-scoped, and stays within our own database. We use only strictly-necessary cookies required for site security and the sign-in flow.

As such, we do not interrupt your experience with consent banners, as we do not perform invasive tracking.

3. Information we collect

3.1 Information you provide

We collect information you voluntarily provide when you:

• Run a free compliance scan of your agency website
• Sign up for a subscription or trial
• Complete your profile, compliance questionnaire, or signed documents
• Invite team members for AML training
• Contact us by email

This may include:

• Name, role, and contact details (email, telephone, postal address)
• Agency information (trading name, address, postcode, company number, VAT number, ICO reference, redress scheme)
• Money-laundering nominated officer (MLRO) name, role and contact details
• Director or partner names recorded on the firm’s public compliance documents
• Your team members’ names, emails, mobile numbers, and roles (so we can send them their training links)
• Payment information — processed securely via Stripe (we never see your card number)
• When you electronically sign a compliance document: the IP address and browser user-agent at the moment of signing, recorded as tamper-evident evidence of who signed and when

For customer due-diligence (CDD) checks performed on your customers, please see §3.4 below.

3.2 Information collected automatically

We collect minimal technical information necessary for service operation:

• IP address — used transiently for rate-limiting, abuse prevention and approximate location; for our website analytics we then store only an irreversible hash of it, not the raw address (the one exception is the document-signing audit trail above, where the IP is kept as signature evidence)
• Browser user-agent string
• Pages visited on our websites and time on page
• Referring URL and UTM parameters from cold-outreach campaigns

3.3 Email communication tracking

We use standard tracking technologies (such as tracking pixels and link-click analysis) in our system emails — for example, to confirm delivery of training invitations to your team, or to confirm our compliance reminders reached you. This allows us to detect bounced invites and resend them.

3.4 Customer due-diligence (CDD) data

When you use AgentGuard to run a CDD check on one of your customers (a buyer, tenant, landlord, or vendor), we process the customer’s personal data on your behalf. In that context you are the data controller and AgentGuard is your data processor. The terms of that processing are set out in our Data Processing Agreement (available on request).

What we process for a CDD check, on your instruction:

• The customer’s full name, date of birth, and nationality (typed by you, or entered by the customer in our verify flow)
• For passport checks via our App Clip / mobile flow: data read from the passport’s NFC chip — the machine-readable-zone fields, the cryptographic hashes of the chip data groups, and the document security object — validated against the issuing country’s certificate (“passive authentication”). Where a chip or passport image is captured we store it, together with an image of the passport photo page, as part of the CDD record
• For document checks: images of the identity document(s) provided — for example a passport photo page and/or a driving licence (front and back) — together with the data extracted from them. Where automated extraction fails, the document image may be sent to our AI sub-processor (Anthropic, US) solely to read it; it is not retained by them (see §7.1 and §12)
• Facial and biometric data: a self-portrait (“selfie”) captured during a liveness check, which we compare against the photo on the identity document and the passport chip to confirm the customer is the genuine document holder. This face-matching constitutes processing of biometric data
• Liveness / presentation-attack detection: a short guided check (or, where the agent enables it, AWS Rekognition Face Liveness) to confirm a live person is present. We retain a still reference frame from this check as the selfie above; we do not retain liveness video
• For sanctions / PEP screening: matches and corroborating attributes from public lists — treated as criminal-offence-related and special-category data (Articles 9–10), processed only to perform and evidence the check you instructed. The legally-binding lists we screen against are HMT/OFSI, the FCDO UK Sanctions List, US OFAC SDN, and the UN Security Council Consolidated List. We additionally screen against the NCA Most Wanted register and the Companies House Disqualified Directors register, and surface PEP candidates from Wikidata as a discovery aid only. Full method, scoring thresholds, and replay protocol are published in the methodology published for the relevant product.
• The decision you record (clear / proceed, review, decline / SAR), and your reasoning
• An audit pack (PDF) describing what was screened against and what was found, retained for five years per MLR 2017

Identity-document images, the passport chip photo, and the selfie / liveness reference frame are retained as part of the customer’s CDD record — held in encrypted, access-controlled, tamper-evident storage in the UK with write-once (object-lock) protection, for the period the Money Laundering Regulations 2017 require us (as your processor) to keep the record on your behalf: a minimum of five years. We do not retain liveness video, and we do not use this data for any purpose other than performing and evidencing the check you requested. We never use it for advertising, profiling, or tracking, and we never sell it.

4. How we use your information

• Service delivery — to run the website scans, generate your compliance documents, host your Trust page, deliver AML training to your team, and run customer-due-diligence checks on your instruction
• Communication — to respond to enquiries, confirm sign-up, send compliance reminders, deliver training links
• Cold outreach — to introduce ourselves to UK estate / letting agents whose firm details are public on the HMRC AML supervised business register, and to follow up if you reply or click through
• Legal compliance — to comply with our obligations under MLR 2017 (sub-processor scrutiny, retention rules) and UK GDPR
• Service improvement — to analyse aggregated, de-identified usage patterns to improve our scanner and our AI prompts

5. Legal basis for processing

• Contract — processing necessary to perform our contract with you (running scans, hosting your Trust page, generating signed compliance documents)
• Legitimate interests — processing necessary for our legitimate business interests, where not overridden by your rights (cold outreach to public business register entries, security logging, abuse prevention)
• Legal obligation — processing necessary to comply with our own AML obligations and tax law
• Consent — where you have given explicit consent for specific processing (for example, marketing communications beyond our initial outreach window)

6. Data storage and security

6.1 Data residency

Almost all personal data is stored and processed within the United Kingdom. There are two narrow exceptions, set out in §7.1 and §12: optional facial-liveness / face-match processing runs in AWS Ireland (eu-west-1, EU), and our AI sub-processor (Anthropic) operates in the United States — both under the safeguards in §12.

6.2 Security measures

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Role-based, least-privilege access controls (multi-factor authentication for administrative access is on our roadmap)
• Magic-link authentication for end-user logins (no passwords stored for trainees); account passwords hashed with bcrypt
• Cryptographic hashing of signed compliance documents so any tamper is detectable
• Regular security review
• Incident response procedures aligned with the UK GDPR 72-hour notification rule

7. Data sharing

We may share your personal data with:

• Sub-processors — the third parties listed in §7.1 who help us deliver the service
• Professional advisers — lawyers, accountants, and auditors where necessary
• Regulatory bodies — HMRC, the ICO, the National Crime Agency — only where legally required

Your customer’s CDD data is not shared with anyone outside our sub-processor chain unless you instruct us to (for example, when your MLRO files a Suspicious Activity Report with the National Crime Agency — the MLRO files the SAR, not us).

7.1 Sub-processors

8. Data retention

9. Your rights

Under UK GDPR, you have the following rights:

• Access — request a copy of your personal data
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data (‘right to be forgotten’), subject to MLR retention obligations
• Restriction — request restriction of processing
• Portability — request transfer of your data in a structured format
• Objection — object to processing based on legitimate interests, including cold outreach
• Withdraw consent — where processing is based on consent

To exercise any of these rights, please contact us at legal@everyguard.uk. We will respond within one month.

Where MLR 2017 requires us to retain a record (for example, a CDD audit pack or a signed AML policy snapshot), we cannot delete that record until the retention period expires — this is a legal obligation on the firm, not on us. We will tell you if that’s the case. CDD identity evidence is held in tamper-evident, write-once (object-lock) UK storage, so it cannot be altered or deleted before the Money Laundering Regulations retention period has elapsed.

10. Cookies

Our website uses only strictly-necessary cookies required for security and core functionality (sign-in session, anti-CSRF, rate limiting).

We do not use:

• Analytics cookies
• Advertising or tracking cookies
• Third-party marketing pixels
• Social media tracking widgets

11. Children’s privacy

Our services are not directed at individuals under 18 years of age. Customer due-diligence checks performed by our customers may legitimately involve subjects of any age — in those cases the customer is the controller and the legal basis is the customer’s own MLR 2017 obligation, not consent from the data subject.

12. International transfers

We primarily store and process data within the UK. Two flows occur outside it: optional facial-liveness / face-match processing uses AWS in Ireland (eu-west-1, EU), and our AI sub-processor (Anthropic) operates in the United States — including, as a fallback, reading a CDD identity-document image when automated extraction fails. For the EU we rely on the UK’s adequacy finding; for the US we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. No other personal data leaves the UK.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on our website with an updated effective date and, for active customers, by email.

14. Contact us

15. Complaints

If you are not satisfied with our response to any data protection concern, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):