Privacy Policy

1. Information we collect

You give us:

• Account: your name, email address, and a password (stored only as a salted hash).
• Business profile: the answers you give in the startup assessment and throughout the app — business idea, location, industry, whether you'll hire, target customers, pricing, goals, and similar details used to build your roadmap and documents.
• Support and communications: messages you send us and emails you exchange with us.
• Reviews: if you submit one, the rating, text, and the display name and location you choose to show.

Collected automatically:

• Usage and device data: pages viewed, actions taken, approximate timestamps, browser type, and IP address, used to run the app, keep it secure, and understand what's working.
• Attribution data: the page you landed on, the referring site, UTM parameters, and — if you arrive from an ad — a click identifier (such as Google's gclid). We use this to measure which channels bring people to FirstBearing.
• Cookies: see the Cookies section below.

From payment processing:

• When you subscribe, our processor Stripe collects and handles your card details directly. We do not receive or store your full card number. We receive limited billing metadata from Stripe — for example the last four digits, card brand, billing country, subscription status, and payment history.

We do not knowingly collect information from anyone under 18, and the Service is not directed to children.

2. How we use information

• provide, personalize, and improve the Service and generate your roadmap, documents, and guidance;
• process payments, manage your subscription, and send billing and service notices;
• respond to support requests and communicate with you about your account;
• secure the Service, prevent fraud and abuse, and enforce our Terms;
• measure marketing performance and, in aggregate, understand how the Service is used;
• comply with law and respond to lawful requests;
• with your consent, publish a review you submit.

We rely on these legal bases: performing our contract with you, our legitimate interests in running and improving a secure service, your consent (for example for published reviews and non-essential cookies), and legal obligations.

3. AI features

Some features send the business details you provide to a third-party AI provider (currently OpenAI) to generate research and draft content. We send only what's needed for the feature. Our AI provider processes this data to return a result and, under our agreement, does not use it to train its general models. AI-generated content can be wrong or out of date and is educational only — see our Trust Center.

4. How we share information

We do not sell your personal information. We share it only with:

• Service providers that run the Service on our behalf, under contracts that limit their use of the data:
  • Stripe — payment processing and subscription billing;
  • OpenAI — AI-generated research and content;
  • Resend and our email host — sending and receiving email;
  • Microsoft Azure — cloud hosting and database.
• Advertising and analytics partners for conversion measurement when we run ads — see “Advertising” below.
• Authorities or others when required by law, to respond to legal process, or to protect the rights, safety, or property of FirstBearing, our users, or the public.
• A successor in connection with a merger, acquisition, or sale of assets, with notice to you.

An up-to-date list of our service providers is available on request at support@firstbearing.org.

5. Advertising and conversion measurement

When FirstBearing runs ads (for example on Google), we use conversion tracking to see which ads lead to sign-ups and subscriptions. This may set a cookie and send a signal to the ad platform when you complete an action such as subscribing. We use this for measurement, not to build advertising profiles about you on our site, and we do not run third-party ad-retargeting pixels. If we haven't enabled ad tracking, no such cookie or signal is used. You can limit ad personalization in your Google Account settings and block cookies in your browser.

6. Cookies

• Essential: a session cookie to keep you signed in, and a first-party attribution cookie that remembers how you first found us. These are required for the Service to work.
• Measurement: if ad conversion tracking is enabled (see above), a related cookie may be set.

You can control cookies in your browser. Blocking essential cookies will break sign-in.

7. How long we keep information

We keep your account and business information while your account is active and for as long as needed to provide the Service. After you close your account, we delete or de-identify your personal information within 90 days, except where we must keep it longer for legal, tax, accounting, fraud-prevention, or dispute-resolution purposes (for example, billing records Stripe and we are required to retain). Backups are purged on a rolling schedule.

8. Your choices and rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. To exercise any of these, email support@firstbearing.org from your account address. We'll verify your request and respond within the time the law requires. You can also:

• update most account and business details directly in the app;
• cancel your subscription anytime from billing settings;
• ask us to remove a published review;
• opt out of non-essential email; service and billing emails will still be sent.

California: we do not sell or “share” personal information as those terms are defined under the CCPA/CPRA, and we will not discriminate against you for exercising your rights.

We don't currently respond to browser “Do Not Track” signals because there is no common standard.

9. Security

We use encryption in transit, hashed passwords, access controls, and hardened cloud infrastructure. No system is perfectly secure; we can't guarantee absolute security. If we learn of a breach affecting your information, we'll notify you and regulators as required by law.

10. Where data is processed

FirstBearing is operated from the United States and your information is processed there. If you access the Service from outside the U.S., you understand your information will be transferred to and processed in the U.S.

11. Changes to this policy

We may update this policy. We'll post the new version with a new date and, for material changes, notify you by email or in the app. Continuing to use the Service after a change means you accept the updated policy.

12. Service requests (the FirstBearing marketplace)

Added 2026-09-28. When you request a quote for a service such as hood cleaning, grease trap service, fire suppression or pest control, you give us your business name, your name, phone, email, location and details about the job.

• We share your request, including your contact details, with independent local service companies that cover your area so they can contact you about it. By default one company receives it; we never share it with more than three. You agree to this on the request form.
• Companies see the job details and your city before they decide to take a request; your name, phone and email are released only to a company that takes it.
• If no company covers your area yet, we keep your request and share it only when one joins (and at most 30 days later), unless you ask us to delete it.
• We may email you about your request — confirmations, matches, a follow-up asking whether you were contacted, and, if you had service done, a reminder when it may be due again. You can opt out of reminders at any time.
• For fraud and spam prevention we store a one-way hash of your IP address, not the address itself.
• Service companies are independent businesses with their own privacy practices once they have your details.

For service companies that join FirstBearing, we store company and contact details, service areas, and billing records. Card details are held by Stripe, not by us. See the provider terms.

13. Contact

FirstBearing LLC
support@firstbearing.org