Privacy Notice
Last updated: 29 May 2026
1. Who we are
This service ("First Aid Angel", the "Service") is operated by Streamline Direct ("we", "us", "our"). Streamline Direct is the data controller for personal data processed through the Service. You can reach us at [email protected].
2. Categories of personal data we collect
- Account data: email address, password (hashed), display name.
- Profile & usage data: course progress, quiz results, certificates issued, language preference, country.
- Content you submit: chat messages to the first-aid assistant, educator listing submissions, claim requests.
- Technical data: IP address, device and browser identifiers, page paths, referrer, approximate location derived from IP.
- Analytics & referral data: outbound click events (Give / Shop / Learn), session identifiers, Google Analytics measurements.
- Support data: messages you send to us by email or contact forms.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and operating your account; delivering courses, certificates, and AI guidance | Performance of a contract |
| Security, fraud prevention, abuse detection, rate limiting | Legitimate interests |
| Service improvement, debugging, aggregated analytics | Legitimate interests |
| Customer support and communications about the Service | Performance of a contract / Legitimate interests |
| Marketing emails (where applicable) | Consent (withdrawable at any time) |
| Compliance with legal obligations (tax, accounting, lawful requests) | Legal obligation |
4. Who we share data with
We share personal data only with the following categories of recipients:
- Service providers / sub-processors: cloud hosting and database (Supabase / AWS), AI inference providers, voice synthesis (ElevenLabs), email delivery, mapping providers (Google Maps, OpenAEDMap), and analytics (Google Analytics).
- Merchant of Record — Paddle: Paddle.com Market Ltd acts as our reseller and Merchant of Record for all paid orders. Paddle handles checkout, billing, payment processing, tax compliance, invoicing, subscription management, and refunds. Their privacy notice is available at paddle.com/legal/privacy.
- Love Engine (LoveKey HELP Network): if you arrived from one of our workplace emails and then send an employer enquiry, create an account or invite staff, we share your work email address, name and role with Love Engine so it can recognise that the email was passed on to you. We never share personal email addresses (such as Gmail or Hotmail), messages, phone numbers or payment details, and we never share anything about first aid topics or courses you view. Love Engine does not email you automatically as a result.
- Professional advisers: legal, accounting, and insurance advisers, under duties of confidentiality.
- Authorities: where required by law, court order, or to protect the rights, safety, and property of Streamline Direct, our users, or the public.
We do not sell personal data.
5. International transfers
Some of our service providers are located outside your country of residence, including in the United States and the European Economic Area. Where personal data is transferred outside the UK or EEA, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, UK International Data Transfer Addenda, or adequacy decisions where available.
6. Data retention
We retain personal data only for as long as necessary for the purposes described in this notice. Account and learning records are retained while your account is active and for a reasonable period afterwards. Billing and tax records retained by Paddle are kept for the period required by applicable tax law (typically 7–10 years). Analytics events are retained in aggregated form. When data is no longer needed, it is deleted or anonymised.
7. Your rights
Depending on where you live, you may have rights to access, rectify, erase, restrict, or port your personal data, to object to processing, and to withdraw consent. UK and EEA users also have the right to lodge a complaint with their local supervisory authority. We aim to respond to verified requests within one month. To exercise any right, email [email protected].
8. Security
We use appropriate technical and organisational measures designed to protect personal data, including TLS encryption in transit, encryption at rest for our database, role-based access controls, row-level security on user data, and secrets managed outside the codebase. No method of transmission or storage is 100% secure; we work to continuously improve our safeguards.
9. Cookies and similar technologies
We use a small number of cookies and local storage entries to operate the Service:
- Essential: authentication tokens, language preference, session identifiers.
- Analytics: Google Analytics (G-FTSXCZTK1V) to measure traffic and usage anonymously.
You can manage cookies through your browser settings.
10. Children
The Service is not directed to children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.
11. Changes to this notice
We may update this notice from time to time. Material changes will be communicated by updating the "Last updated" date and, where appropriate, by notice in the Service.
12. Contact
Streamline Direct — [email protected]