Privacy Policy

1. Introduction

Welcome to First-5. We respect your privacy and are committed to protecting your personal data. This privacy policy will inform you about how we handle your personal data when you use our service, and tell you about your privacy rights and how the law protects you.

First-5 is operated as a sole trader/individual business based in the United Kingdom. We are subject to UK GDPR and the Data Protection Act 2018.

2. Data We Collect

We collect and process the following personal data:

• Account Information: Name, email address, password (encrypted)
• Contact Information: Phone number (for delivering morning briefings)
• Location Data: City/location (for weather information in your briefing)
• Gmail Access: Read-only access to your Gmail inbox (if you choose to connect Gmail)
• Preferences: Portfolio preferences (stocks/crypto), fitness goals and profile, news topics, task lists
• Usage Data: Authentication logs, subscription status, feature usage

3. How We Use Your Data

We use your personal data to:

• Deliver personalized morning briefings via automated phone calls
• Generate AI-powered summaries of your emails, news, and tasks
• Provide weather updates for your location
• Track your portfolio and fitness progress
• Process payments and manage subscriptions
• Improve our service and develop new features
• Communicate with you about service updates

Legal basis: We process your data based on (a) your consent, (b) performance of our contract with you, and (c) our legitimate interests in providing and improving our service.

4. Third-Party Services

We use the following third-party services to deliver First-5. Each has their own privacy policies:

5. Data Storage and Security

Your data is stored securely by Clerk (our authentication provider) using industry-standard encryption. We do not operate a separate database. All data is encrypted in transit and at rest.

While we implement security measures to protect your data, please be aware that no method of transmission over the internet is 100% secure.

6. Data Retention

We retain your personal data for as long as you have an active First-5 account. When you delete your account, your data is permanently deleted from our systems within 30 days. Some data may be retained longer if required by law (e.g., payment records for tax purposes).

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of your personal data
• Right to Rectification: Correct inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive your data in a machine-readable format
• Right to Object: Object to processing of your data
• Right to Withdraw Consent: Withdraw consent at any time (where processing is based on consent)

To exercise any of these rights, please contact us using the details below.

8. Cookies

We only use essential cookies required for authentication and service functionality. We do not use marketing or tracking cookies. See our Cookie Policy for more details.

9. International Data Transfers

Some of our third-party providers (such as OpenAI) may process data outside the UK/EEA. Where this occurs, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions.

10. Children's Privacy

First-5 is not intended for use by anyone under the age of 18. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us immediately.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by email or through the service. Your continued use of First-5 after changes are made constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions about this privacy policy or wish to exercise your rights, please contact us:

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) if you believe we have not handled your data properly.