Data processing terms for brands

1. Who this is for, and the roles

These terms apply to you if you hold a brand account on FirstGig and connect a store, an ad account, or otherwise give us data about your customers. They sit alongside our terms of service and privacy policy; where they say something different about that data, these terms apply.

For your shoppers' data from a connected store and from our pixel in it, and for the data of a connected ad account, you decide why it is collected and we process it on your instructions: in the words of privacy laws, you are the controller or business and First Gig LLC is the processor or service provider. For the accounts of your team members, and for creators, First Gig LLC is responsible in its own right, and the privacy policy says how.

2. What we process for you

Only what the integrations send, which is:

• from a connected store: the catalog, and for each order its identifiers and number, amounts and currency, line items, the page the order's visit started on, the creator code on it if any, the refund and cancellation status, and the shopper's email as a one-way hash;
• from our pixel in the store: a random visitor identifier the pixel creates, the pages opened through a creator's link and the code on them, and the checkout it completes, by order identifier and checkout token;
• from a connected ad account: the account's identifiers, currency and time zone, the names and identifiers of its campaigns, ad sets and ads, and each ad's daily spend and performance figures.

We do not receive shoppers' names, shipping or billing addresses, phone numbers, plain email addresses or payment details, and we do not ask for them. We process this data for one purpose: to credit sales and ad results to the creators' videos, compute and pay what the creators earn, show you the results, prevent fraud, and keep the records that payments and the law require.

3. Your instructions, and what we will never do

Connecting a store or an ad account, setting up a program and approving a video are your instructions to process this data for the purpose above; these terms and the terms of service are the rest of them. We follow them and the law, and nothing else. If an instruction seems to us to break a privacy law, we tell you before acting on it.

We do not sell your shoppers' data or share it for advertising, we do not use it to build profiles or for any purpose of our own, we do not combine it with another brand's data except in statistics that identify nobody, and we do not keep it beyond the periods in section 9. First Gig LLC certifies that it understands and will comply with these restrictions, which is what the California Consumer Privacy Act asks a service provider to confirm.

4. What you promise

You, in turn, promise that:

• you have the right to give us this data and to have it processed for the purpose above;
• your privacy notice tells your shoppers that service providers help you measure sales and pay creators, which is what FirstGig does;
• your store's cookie and consent settings cover our pixel. On Shopify, the store's customer privacy settings do this: where a shopper's region requires consent, Shopify holds our pixel back until the shopper gives it;
• you handle your shoppers' privacy requests and pass to us the ones we must act on, which Shopify does automatically for erasure requests;
• you connect only stores and accounts you are entitled to connect, and you tell us promptly if one changes hands or should be disconnected.

5. People and confidentiality

Only the people who operate the service can reach this data, each under a duty of confidentiality, each with the least access the work needs. No creator and no other brand sees your shoppers' data: creators see what a video earned, not who bought.

6. Security, and if something goes wrong

Every connection to and from the service is encrypted in transit; data is encrypted at rest by our hosting providers; the access tokens of connected stores and ad accounts are encrypted a second time by our own code, with a key kept outside the database; every table is protected by row-level access rules; every message a store or an ad platform sends us is verified by signature; and production systems are reached only by the people who operate the service.

If we confirm that your shoppers' data has been accessed or disclosed without authorisation, we tell you without undue delay and within 72 hours of confirming it: what we know, what we are doing about it, and what we suggest you do. We help you meet any duty to tell your shoppers or a regulator.

7. Our sub-processors

Parts of the service run on other companies' systems. Each processes data only to provide its service to us, under a written agreement at least as protective as these terms, in the United States:

• Supabase: the database and sign-in;
• Vercel: hosting the application and keeping its logs;
• Mux: storing and streaming the creators' videos;
• Stripe: charging you and paying creators (it holds payment details as an independent controller under its own terms);
• Resend, for the emails we send, and Google Workspace, for our mailboxes;
• Cloudflare: our domains and public site.

Shopify and Meta are the sources you connect, acting under your agreements with them; they are not our sub-processors. Before a new sub-processor touches your shoppers' data we update this page and email brand owners at least 14 days ahead. If you object, you may disconnect your store or ad account, and these terms end for that data as section 9 says.

8. Your shoppers' requests

When a shopper asks your store for their data or its erasure, Shopify passes the request to us and we act on it within 30 days: we hand you what we hold, or we remove the hashed email and every reference to the shopper from our order records. A shopper who writes to support@firstgighq.com directly is pointed to your store, unless the request is one we can and must complete ourselves. We help you answer any question a shopper or a regulator asks about what we did with the data, within a reasonable time and at no charge.

9. How long we keep it, and deletion

We keep this data for as long as it does its job, then delete or anonymise it:

• a connected store's orders while the store is connected and for 24 months after, so that questions about commissions can still be settled;
• pixel events and tracked-link visits for 13 months;
• ad account data while the account is connected, deleted within 30 days of disconnection;
• the records behind a payment charged, owed or paid for seven years, as tax and accounting rules require; they name the order and the amount, not the shopper;
• backups for up to 35 days, used only to restore the service after a failure.

On your written request to support@firstgighq.com we delete your shoppers' data sooner, within 30 days, except what the payment records above must keep. When these terms end, the same applies.

10. Audits and questions

Once a year, and after a security incident, you may put reasonable written questions to us about how we handle your shoppers' data; we answer within 30 days and provide our current security summary. Where a law gives you a right to audit, you may exercise it once a year, with 30 days' notice, during business hours, through an independent auditor bound by confidentiality, at your cost and without disturbing other brands' data.

11. Where the data is processed

In the United States, where we and our sub-processors operate. The service is for United States brands and creators at launch. If your store sells to shoppers elsewhere, you are responsible for any transfer mechanism their law requires, and on request we sign the standard terms that law prescribes.

12. Term, changes, liability and contact

These terms apply from the moment you connect a store or an ad account, and last while a connection exists and while we hold any data from it. The limits of liability in the terms of service apply to these terms too. When we change these terms we update the date at the top and, for a change that affects your shoppers' data, email brand owners at least 14 days before it takes effect.

First Gig LLC, 41 Fireplace Lane, Hicksville, New York 11801, United States. Email support@firstgighq.com.