Privacy Policy

1. Who this policy covers
2. What we collect
3. How we use it
4. Who we share it with
5. Public pages and private links
6. How long we keep it
7. Security
8. Your rights and choices
9. If a scan named your business
10. Children
11. Where the data lives
12. If you are a partner
13. Changes to this policy
14. Contact

1. Who this policy covers

This policy explains how Will Mulliken, trading as Firstpick (“Firstpick”, “we”, “us”) handles information about people when they use the website at https://firstpickscan.com (the “Site”), request a free scan, open a page we sent them a link to, write to us, or work with us. We are the business responsible for that information.

Most of the information we handle is about businesses rather than people. Where it identifies a person, such as an owner’s name in an email address or a sole trader whose business name is their own, this policy applies to it.

2. What we collect

What you give us

• The scan form: your business name, its website if you give one, what the business does, its town, and an email address. We also keep the time of the request and which version of our Terms the form carried.
• Messages: what you write to us by email, and, if you book a call through a booking link, what that calendar service sends us.
• Working with us: what you tell us about the business during an engagement, the access you give us to accounts and websites, and the invoices and payments between us.
• Partner sign-up: see section 12.

What we collect automatically

• When you request a scan: your IP address and the name and version of your browser, kept with the request. We use them to limit how many scans one visitor can start in a day, to tell people from automated submissions, and as part of the record that you accepted our Terms.
• Server logs: the address requested, the time, the response, and the requesting IP address, kept for security and troubleshooting.
• Cookies: the public pages of the Site set no cookies. The only cookie the Site uses is a login cookie for our own console, which is set only when somebody signs in to it. We use no analytics service and no advertising or tracking technology.
• Fonts: the Site’s typeface is loaded from Google Fonts, which means your browser sends its request, including your IP address, to Google’s servers. Google’s privacy policy describes how Google handles that.

What we collect from other sources

• What AI assistants say. A scan asks AI assistants questions a customer might ask about businesses in a town and records every answer word for word. Those answers name businesses, describe them, and cite web pages. We keep the answers and count who was named.
• Facts from public web pages. To understand a business and compare it with others, we read pages that anyone can open without logging in: the business’s own site, the pages the assistants cited, directories, and competitors’ sites. We keep facts about those pages, such as titles, headings, word counts, prices, structured data, and contact details the page publishes; we do not keep copies of the pages.

This means we hold information about businesses that never asked us for anything: those an assistant named, and those a scan of a town found. That information is the kind a business publishes in order to be found. Section 9 says what those businesses can ask of us.

3. How we use it

• To run the scan you asked for: choosing the questions, asking the assistants, recording the answers, and reading your site and others to compare them.
• To show you the result, to email it to you, and to follow up about it, which may include an offer of our services.
• To prepare a proposal for you, and, if you accept it, to do the work.
• To write to businesses that a scan of a town found, introducing what we found about them. We write a small number of times, every message says who it is from and how to stop, and we stop when asked.
• To run, secure and improve the Site: limiting scans per visitor, telling people from bots, fixing problems, and keeping records of what was asked and answered.
• To keep the records the law requires, including records of who accepted our Terms and when, and to handle disputes.

Where the law asks us to name a legal basis, ours is: performing the contract you entered by requesting a scan or hiring us; our legitimate interests in running and protecting the Site, measuring what assistants say about local businesses, and offering our services to businesses we have measured; your consent, where we ask for it; and our legal obligations.

We do not sell personal information. We do not share it for cross-context behavioural advertising, use it for targeted advertising, or make automated decisions about you that have legal or similarly significant effects.

4. Who we share it with

We share information only with the companies that help us run the Site and do the work, and only what each one needs:

• AI assistant providers. OpenAI, and where switched on Perplexity, Google and Anthropic, receive the questions we ask, which name the trade and the town, and, when we are working out what a business is, its name, website address and the content of its public pages. Their own policies govern what they do with requests; we send them nothing about you beyond what the scan needs.
• Our hosting provider, which runs the servers and stores the database.
• Our email provider, through which result emails and our own notifications are sent.
• Stripe, which handles payments for our partner programme. Card details go straight to Stripe; we keep only Stripe’s identifiers for the account.
• Partners. Some businesses run their own version of this service on our platform, at their own address on this Site. If you request a scan on a partner’s page, that partner is the business you are dealing with and their privacy policy applies; we store and process that information for them and do not use it for ourselves.
• Professional advisers such as accountants and lawyers, under confidentiality.
• Authorities, where the law requires it or to protect anyone’s safety or rights.
• A successor, if our business is sold or merged, in which case this policy continues to apply to the information transferred.

The people we work for see the results of their own scans, which name other businesses and quote what assistants said about them, as described in section 5.

5. Public pages and private links

A scan result lives at an unlisted address that is not listed or indexed; anyone with the link can open it. It shows the business scanned, the other businesses the assistants named, and what the assistants said. It never shows the email address or IP address of the person who requested it. Presentation and proposal pages are reached only through private links we send to one business, and are meant for that business. If you receive such a link and believe it was not meant for you, please tell us and delete it.

6. How long we keep it

• Scan requests and results are kept while we may need them to show you your result, follow up, prepare a proposal, do the work, or compare a later scan with an earlier one, and then as part of our business records. Ask us and we will delete your request and the contact details on it; the recorded answers, which are about businesses rather than people, may be kept in anonymised form.
• Client records are kept for the engagement and afterwards for as long as tax and contract law require, usually seven years for invoices.
• Records of accepting our Terms are kept for as long as the agreement they evidence could matter, and at least three years.
• Outreach records about businesses we have written to are kept so that we honour a request to stop; the request itself is kept for that reason.
• Server logs are kept only as long as security and troubleshooting need them.

7. Security

The Site is served over an encrypted connection when deployed. Passwords for our console are stored only as salted hashes. Access to the database is limited to the people who run the Site. No method of storage or transmission is perfectly secure, so we cannot promise that information will never be accessed without authorisation; if a breach affects you, we will tell you and the authorities as the law requires.

8. Your rights and choices

Whatever state or country you are in, you may ask us to:

• tell you what personal information we hold about you and give you a copy of it in a usable form;
• correct anything that is wrong;
• delete it;
• stop using it for marketing, or limit what we use it for;
• explain any of the above.

Write to firstpick.scans@gmail.com. To protect the information, we confirm a request by writing back to the email address we hold for you, or asking for enough detail to match it to our records; we never ask for more than that. Someone authorised to act for you may make a request on your behalf if they show us that authority. We answer within forty-five days, or sooner where the law requires; if we need longer we will say so and why. We will not treat you differently for making a request. If we decline a request, we will say why, and you may appeal by replying; we answer an appeal within forty-five days, and if you are still unsatisfied you may contact your state’s attorney general or privacy regulator.

Browser signals. We do not sell or share personal information, so an opt-out signal such as Global Privacy Control has nothing to switch off; we treat one as a request not to sell or share anyway. We do not track people across other websites, so we do not respond to Do Not Track signals, because there is nothing for them to change.

Marketing. Every marketing email we send says how to stop; you may also simply reply, or write to us. We act on it within ten business days. Emails you asked for, such as your scan result, and messages about an engagement you have with us are not marketing.

9. If a scan named your business

If an AI assistant named your business in a scan someone else requested, or a scan of your town found your business, we may hold your business name, website, publicly listed address, phone number and email, what the assistants said about you, and facts about your public web pages. We use this to compare businesses and, sometimes, to write to you once about what we found. You may ask us to stop writing to you, to correct what we hold, or to remove your contact details from our outreach records, and we will. What an assistant said is a record of what a third-party system said on a given day; we can annotate it but we cannot change what was said.

10. Children

The Site is for businesses and the adults who run them. We do not knowingly collect information from anyone under 18, and if we learn we have, we delete it.

11. Where the data lives

The Site is hosted in the United States, and the companies in section 4 may process information there or elsewhere. If you use the Site from outside the United States, your information is transferred to and handled in the United States, where privacy law may differ from your own. If you are in the European Economic Area, the United Kingdom or Switzerland, the rights in section 8 include the rights those laws give you, and you may also complain to your local data protection authority.

12. If you are a partner

If you have signed up for a Firstpick partner workspace, we hold the details you gave at sign-up and afterwards: your business name, email address, a salted hash of your password, your workspace name, your chosen plan, and later the name you sign messages with, your reply-to address, postal address, booking link, legal entity and state. We keep the version of the Partner Agreement you accepted, when, and the IP address it was accepted from. If you subscribe, Stripe holds your card and we hold Stripe’s identifiers for your account. We record how many engine calls your workspace has used, because that is what your plan allows.

Your workspace is yours. The scans, leads, prospects and clients in it belong to you, and we are your service provider for them: we store and process them to run the platform on your instructions, to support you when you ask, to fix problems, and as the law requires, and for nothing else. We do not use your clients’ information for our own purposes, do not combine it with anyone else’s, and do not sell or share it. The Partner Agreement sets this out in full, including what happens to the workspace when an account closes.

13. Changes to this policy

We may change this policy. The version and effective date are at the top, and the current version is always at this address. If a change materially affects how we use information we already hold, we will tell the people affected before it takes effect, by email where we have an address.

14. Contact