Privacy policy

121 Direct operates the website at 121.direct. The company/operator name currently presented on the website is ibizsp.com LTD. In this policy, “121”, “we”, “us” and “our” refer to that service and operator.

The data involved depends on how you use the website:

• Ordinary website and browser data: technical information needed to load, secure and operate the website, such as requests, device/browser information and essential local browser state.
• Toolkit data: answers, context, drafts, results and related records that you choose to enter or save.
• Organisation-governance data: authenticated users may choose to store an organisation profile, role-based governance ownership, policies and procedures, AI-system metadata, AI-agent metadata, permission boundaries, control implementation records, evidence-reference metadata, incidents, exceptions, monitoring observations, reviews, governance actions, audit engagement scope, workpapers and findings. Workpapers may include evidence descriptions, samples, observations, conclusions and preparer/reviewer metadata. Historical records may be retained in local and optional Drive archives. The Toolkit stores references and descriptions, not uploaded evidence files. Role titles should be used instead of people’s names where possible.
• Google account information: when Google Sign-In is enabled and used, basic account identity information needed for authentication, such as a Google account identifier, email address and available profile information.
• Google Drive app data: when optional sync is enabled, Toolkit records needed to provide synchronisation and restoration through the application’s private app-data area in your Google Drive.

When this feature is available, you may use Google Sign-In to authenticate with 121. Firebase Authentication is used to manage sign-in and session identity. Basic information supplied through your Google account may be processed to identify your account and maintain the session.

121 does not ask for, receive or store your Google password. You enter Google credentials only in Google’s authentication interface.

Google Drive sync is optional and is requested separately from sign-in. If you enable it, the application requests only this OAuth scope:

This permission allows 121 to access only its hidden application-data area in your Google Drive account. It does not provide general access to your normal Google Drive files.

Toolkit and organisation-governance data may be synchronised directly between your browser and that app-data area. Under this architecture, 121 does not need to centrally store the synced content on its own application servers. Google provides the Drive service and its standard storage protections; this policy does not claim end-to-end encryption or that app data is inaccessible to Google.

Toolkit data is currently stored locally in your browser using IndexedDB. Browser-local data may remain on the device and in that browser profile until you, the browser or the device clears it.

If you export Toolkit data as JSON, the downloaded file is an ordinary unencrypted file unless you protect it separately. Anyone with access to that file may be able to read its contents.

The Toolkit is designed for proportionate business and professional governance work. Do not enter unnecessary sensitive or confidential information, including:

• client-specific confidential data or privileged information;
• identity documents or identity-verification material;
• tax information;
• bank or client-account details;
• medical or safeguarding information; or
• sensitive client, case or matter information.
• passwords, API keys, tokens, private keys or other credentials.

Use aggregate, minimised or non-identifying information wherever possible.

Organisation profiles are intended for business-level context and role titles. They should not contain employee files, personal performance information or unnecessary names and contact details.

Relevant data is used only as needed to:

• provide Toolkit functionality;
• save and resume assessments and Toolkit records;
• save an authenticated organisation-governance profile, governance documents, AI system/agent registers, control assignments, evidence-reference metadata, incidents, exceptions, reviews, follow-up actions and audit workpapers/findings;
• authenticate users and maintain sessions;
• optionally synchronise user-owned Toolkit data; and
• maintain the security and operation of the service.

The service may rely on:

• Google and Firebase Authentication for Google account sign-in and session identity;
• Google Drive API for optional app-data synchronisation; and
• hosting and infrastructure providers used to deliver and secure 121.direct.

Those providers process data under their own applicable terms, controls and privacy information.

• Browser-local Toolkit data remains until it is cleared by you, your browser or your device.
• Google Drive app data remains until it is removed through the application where supported, by you through relevant Google account controls, or under Google’s applicable retention behaviour.
• Authentication and session data follows the applicable Firebase and Google retention behaviour.

We do not state a fixed retention period where the architecture does not impose one.

Depending on the features available, you can:

• sign out of your account;
• clear browser-local Toolkit data;
• export your Toolkit data;
• disconnect or revoke Google access; and
• remove application data from your Google account where supported.

Revoking Google access stops future authorised access but does not necessarily clear browser-local records. Clearing one copy does not automatically remove every other exported or separately retained copy.

We use reasonable technical and organisational measures appropriate to the service, including limited permissions and browser-local storage boundaries. No online, cloud or local storage system can guarantee absolute security. You are responsible for protecting access to your device, browser profile, Google account and exported files.

121 is intended for business and professional use. It is not directed at children.

We may update this policy to reflect changes to the service, its technology or applicable requirements. The current version will be published on this page with its effective date.

For privacy questions about 121.direct, contact: