Privacy and data protection
One global protection baseline, with regional rights for people in the US, UK, EU/EEA, and APAC.
Effective 23 August 2026. This notice applies to the hosted FirstContact service. FirstContact, as operator of this deployment, determines why and how account and participation data is processed. Independent deployments are separate controllers.
What we collect
- Account: name, email, role, optional organization and location, authentication and security records.
- Participation: application answers, goals, target regions, startup or investor context, and consent timestamps.
- Platform activity: organization membership, profiles you manage, investor-interest records, approvals, corrections, objections, and audit events.
- Operational security: rate-limit identifiers, delivery events, redacted errors, and limited request metadata. Passwords are stored only as provider-managed hashes; MFA secrets are never shown in data exports.
Please do not enter government identifiers, health data, precise financial-account data, or other sensitive personal information into free-text fields.
Why we use it
We process account and service data to provide the service and fulfil our agreement with you; participation data with your consent and to take steps you request; security, fraud prevention, audit, and service improvement for legitimate interests and legal obligations; and optional product updates only where you chose them. You may withdraw consent without affecting earlier lawful processing.
Boundaries and automated tools
- A signup does not publish a profile, begin outreach, or share private contact details.
- Catalogue publication and outreach require separate, recorded human approval and policy gates.
- Matching and research tools provide suggestions; they do not make final funding, access, or legal decisions.
- We do not sell personal data, share it for cross-context behavioural advertising, or use targeted advertising.
Providers and international processing
Convex provides the production database, authentication, and server functions; Vercel serves the web application; and Resend sends transactional account email. Optional research or drafting adapters are used only when an operator deliberately activates them. Providers receive only data needed for their task. Data may be processed outside your country, so the operator must maintain appropriate provider terms and transfer safeguards where the law requires them. This notice does not claim that a particular transfer agreement or adequacy mechanism exists unless the operator has actually completed it.
Retention and security
Unsuccessful, unlinked intake records in new, reviewing, or declined status are automatically removed after 24 months by default. Resolved operational errors are removed after 90 days. Active accounts, accepted participation records, security evidence, suppression records, and audit trails are retained while needed for the service, safety, legal claims, and accountability, then reviewed for deletion or de-identification. Legal holds can override routine deletion.
Controls include role- and organization-scoped access, server-side authorization, admin MFA step-up, encrypted provider transport and storage, hashed credentials and suppression identifiers, bounded reads, audit trails, retention jobs, redacted errors, and secrets kept outside public browser configuration. No system can promise absolute security.
Your controls
Signed-in users can immediately download a machine-readable account-data copy and submit tracked requests for access, correction, deletion, restriction, objection, or appeal in the privacy center. We verify requests through the account and may ask for additional proof. Deletion is not instantaneous: shared organization data, fraud prevention, legal duties, disputes, and audit integrity may require restriction or partial retention instead. We explain a denial and preserve the ability to appeal.
Regional supplements
EU/EEA
Where the GDPR applies, rights may include information, access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and a complaint to your supervisory authority. We aim to respond without undue delay and ordinarily within one month. Contract, consent, legal obligation, and legitimate interests are used only where appropriate to the stated purpose. See the European Commission's individual-rights guidance.
United Kingdom
Where UK data protection law applies, equivalent rights include access, correction, erasure, restriction, portability, objection, and protections concerning automated decisions. You may complain to the ICO. See the ICO's rights guidance.
United States
State rights vary and applicability can depend on residency and statutory thresholds. Where applicable, we support requests to know or access, correct, delete, obtain a portable copy, opt out, limit certain sensitive-data uses, and appeal, without discrimination. Because FirstContact does not sell personal data or use it for targeted advertising, an opt-out signal does not switch off a practice that is occurring. California residents can review the California Attorney General's CCPA guidance.
Asia-Pacific
APAC is not one jurisdiction. Subject to local applicability and exceptions, the same privacy center supports access, correction, deletion or erasure, objection or withdrawal, restriction, portability, and complaints. Relevant frameworks include Australia's Privacy Act and APPs, Singapore's PDPA, India's DPDP Act and phased 2025 Rules, Japan's APPI, and the Philippines' Data Privacy Act. See official guidance from the Australian OAIC, Singapore PDPC, India MeitY, Japan PPC, and the Philippines NPC.
Children, incidents, and complaints
FirstContact is intended for adults acting in a professional or business capacity and does not knowingly collect children's data. If you believe a child's data or another privacy or security issue is present, submit a deletion or objection request through the signed-in privacy center or reply to a transactional FirstContact email. Do not disclose personal data in a public GitHub issue. We assess incidents and notify people and regulators when applicable law requires it.
Changes and independent deployments
Material changes will be dated here and, where required, notified in-product or by email. A repository fork or independent deployment must publish its own controller identity, contact channel, lawful bases, retention schedule, processor list, transfer mechanism, and incident process.
This operational notice describes the hosted product and is not legal advice or a certification that every regional law applies to the operator.