Privacy policy

1. Who we are

First Gig LLC, a New York limited liability company at 41 Fireplace Lane, Hicksville, New York 11801, United States, operates FirstGig at www.firstgighq.com and joinfirstgig.com. For anything in this policy, write to support@firstgighq.com.

This policy covers people with a brand or creator account, visitors to our sites, and, in the limited way section 7 describes, shoppers of the stores that brands connect to FirstGig.

2. What we collect

We collect what the service needs and nothing else. By kind:

• Account: your name, email address, password (held by our sign-in provider as a hash we never see), profile photo, time zone, and the account type you chose.
• Brand accounts: the company's name, website, logo, business type, addresses and currency; the names and emails of team members you invite; the programs, products, rules and briefs you set up; your approvals, notes and messages.
• Payment method: brands save a bank account or card through Stripe's own form. Card and bank numbers never reach our servers. We keep Stripe's reference for the method and a short description, such as the card brand and last four digits.
• Creator accounts: your username, bio, the optional details you choose to give (location, birth year, gender, social handles, niches, experience), the videos you upload and their automatic transcripts, your submissions, earnings and messages.
• Payout account: creators set up payouts with Stripe. Stripe collects identity, tax and bank details under its own privacy policy; we receive only Stripe's account identifier and whether payouts are enabled.
• Connected stores: when a brand connects its Shopify store we receive its products and, for each order, the order's id and number, its amounts and line items, the page the order's visit started on, the creator code on it if any, and the shopper's email as a one-way hash. We do not receive names, shipping or billing addresses, or payment details. The store's access tokens are stored encrypted.
• The storefront pixel: on a connected store, our pixel records a random visitor identifier it creates, the pages opened through a creator's link and the code on them, and the checkout it completes, by order id and checkout token. It reads no name, email, address or payment information.
• Connected ad accounts: when a brand connects a Meta ad account we receive the account's identifiers and the spend and performance figures of its ads, to compute the pay those ads earn.
• Technical data: server logs with the address and browser of each request, kept for security and rate limiting. When someone opens a creator's tracked link we record the time, the browser, the referring page and a salted daily hash of the address, not the address itself.
• Communications: what you send us by email or through the in-app support form.

3. How we use it

We use this information to:

• run the service: programs, submissions, reviews, messages, dashboards and reports;
• credit sales and ad results to the right video and compute what creators earn;
• charge brands and pay creators through Stripe, and keep the records that payments require;
• prevent fraud and misuse, such as self-purchases through a tracked link or forged webhooks;
• answer your messages and tell you about things that affect your account, such as a payout, a failed charge or a change to these documents;
• meet legal obligations, including the tax forms Stripe files for creators;
• understand how the product is used, in aggregate, to improve it.

We do not sell personal information, we do not use it for advertising networks, and we do not share it with data brokers.

4. Cookies and browser storage

On our own sites we use the cookies needed to keep you signed in and secure. We do not run third-party advertising cookies.

On a brand's connected store, our pixel keeps a random visitor identifier and, for seven days, the creator code the shopper arrived with, in the store's own browser storage. Where the store's region requires consent, Shopify withholds the pixel until the shopper gives it.

5. Who we share it with

We share personal information only with the companies that run parts of the service for us, each bound to use it only for that purpose:

• Stripe, for payments, payouts and creators' identity and tax details (Stripe is an independent controller of what it collects directly from you);
• Supabase, which hosts our database and sign-in, in the United States;
• Mux, which stores and streams the videos;
• Vercel, which hosts the application and keeps its logs;
• Resend, which sends our emails, and Google Workspace, which holds our mailboxes;
• Cloudflare, for our domains;
• Shopify and Meta, when a brand connects a store or an ad account, in both directions as the brand instructs.

Inside the service, brands see the profiles, submissions and earnings of the creators in their programs, and creators see the brands and programs they joined. We may also disclose information when the law requires it, to protect the rights and safety of anyone, or as part of a merger or sale of the company, in which case this policy continues to apply and we tell you.

6. Security

Every connection to and from the service is encrypted in transit. Data is encrypted at rest by our hosting providers. The access tokens of connected stores are encrypted a second time by our own code, with a key kept outside the database. Card and bank numbers are entered on Stripe's forms and never pass through our servers. Every table is protected by row-level access rules, every webhook we receive is verified by signature, and access to production systems is limited to the people who operate the service.

7. Shoppers of connected stores

If you bought from a brand's store, the brand is responsible for your data and we process it on the brand's behalf to credit the sale to a creator. We hold about you only what section 2 lists under connected stores and the pixel: no name, no address, and your email only as a one-way hash, which is removed when the store or Shopify asks us to. Requests about your purchase go to the store. When the store receives a request to erase your data, Shopify passes it to us and we act on it within 30 days. You can also write to support@firstgighq.com.

8. How long we keep it

We keep information for as long as it does its job, then delete or anonymise it:

• account and profile data while your account exists, and for 30 days after you ask us to delete it, so a mistaken request can be undone;
• records of payments charged, owed or paid for seven years, as tax and accounting rules require;
• a connected store's orders while the store is connected and for 24 months after, except the records behind a payment, which follow the rule above;
• pixel events and tracked-link visits for 13 months;
• server logs for up to 90 days, and backups for up to 35 days.

9. Your rights and choices

You can ask to see, correct, export or delete the personal information we hold about you, and object to a use of it, by writing to support@firstgighq.com from the email address on your account. We answer within 30 days. Our data deletion page explains what deletion covers and what we must keep.

If you live in California, you have the rights to know, delete and correct described above. We do not sell or share personal information for cross-context behavioral advertising, and we never treat you differently for exercising a right. Residents of other states with privacy laws have the same rights under this policy.

We operate in the United States and the service is for United States creators at launch. If you use it from elsewhere, your information is processed in the United States. Where a law requires a legal basis, we rely on the contract with you, our legitimate interest in running and securing the service, and consent where the pixel requires it.

10. Children

The service is for adults. You must be 18 or older to hold an account, and we do not knowingly collect information from anyone younger. If you believe a minor has an account, tell us and we will remove it.

11. Changes to this policy

When we change this policy we update the date at the top. For a change that affects your rights or what we collect, we also tell account holders by email or in the product before it takes effect.

12. Contact

First Gig LLC, 41 Fireplace Lane, Hicksville, New York 11801, United States. Email support@firstgighq.com.