Privacy Policy
Last updated: 28 April 2026 (version 2026-04-28)
Who We Are
FirstMate AI Ltd ("we", "us", or "our") operates the FirstMate application and website. We are the data controller for personal data collected through our service. For privacy matters, contact us at privacy@firstmate.ai.
What Data We Collect
- Account Information: Your email address when you register for an account.
- Payment Information: We use Stripe for payment processing and do not store your card details. We receive confirmation of payment status and subscription details from Stripe.
- Uploaded Documents: Files, manuals, or documents you upload to the service for processing and reference.
- Chat History: Questions you ask FirstMate and responses provided, stored to allow you to revisit past conversations.
- Maintenance & Service Records: Maintenance tasks and service log entries you create within the app.
- Usage Data: Information about how you use the service, including feature usage and error logs, used for service improvement and diagnostics.
How We Use Your Data
- To provide, operate, and improve our service.
- To process payments and manage your subscription.
- To respond to support requests.
- For security monitoring, diagnostics, and fraud prevention.
- To sync your data across devices if you enable cloud sync.
Legal Basis for Processing (GDPR)
- Performance of a Contract: To fulfil our service obligations to you as a subscriber.
- Legitimate Interest: For security, service improvement, and fraud prevention.
- Consent: For non-essential cookies or marketing communications where required.
- Legal Obligation: To comply with applicable laws and regulations.
Data Sharing and Sub-processors
We share data only with the following trusted third parties, each of whom is bound by appropriate contractual, technical, or statutory data protection obligations as applicable:
Amazon Web Services (AWS)
Purpose: Application hosting, databases, object storage, authentication infrastructure, and operational logging.
Data processed: account identifiers, uploaded documents, maintenance records, chat history, usage logs, and authentication metadata.
Stripe
Purpose: subscription billing, payment processing, fraud prevention, and invoicing.
Data processed: name, email address, billing identifiers, payment status, and transaction metadata. Payment card details are handled directly by Stripe.
OpenAI
Purpose: AI-assisted responses, retrieval-augmented answers, and document-based guidance features.
Data processed: user prompts, relevant excerpts from uploaded documents, conversation context, and derived structured prompts needed to generate responses.
Google Analytics
Purpose: analytics reporting on website and product usage trends.
Data processed: pseudonymous device/browser data, page views, events, and high-level usage patterns. Google Analytics loads only after analytics consent.
Formspree
Purpose: delivery of contact submissions and data-rights requests from our website forms.
Data processed: name, email address, form content, and request metadata you submit through the Contact or Data Rights forms.
We do not sell your personal data to third parties.
International Data Transfers
Our primary infrastructure is hosted in the AWS eu-west-2 region (London). Some sub-processors (including OpenAI) operate in the United States. Where data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent safeguards to protect your data.
Data Retention
We retain your personal data for as long as your account is active. If you close your account, we will delete your personal data within 30 days, except where we are required to retain it for legal or compliance purposes (such as financial records, which we retain for 7 years). Document and chat data can be deleted by you at any time from within the app.
Your Rights (GDPR / UK GDPR)
You have the following rights regarding your personal data:
- Access: Request a copy of the data we hold about you.
- Rectification: Correct inaccurate or incomplete data.
- Erasure: Request deletion of your data ("right to be forgotten").
- Restriction: Ask us to limit how we process your data.
- Portability: Receive your data in a machine-readable format.
- Objection: Object to processing based on legitimate interest.
You can exercise these rights via our Data Rights page or by emailing privacy@firstmate.ai. We will respond within 30 days.
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.
Cookies
We use essential cookies to operate the service (authentication, session management) and optional analytics cookies to understand usage patterns. See our Cookie Policy for full details.
Contact
For privacy questions or to exercise your rights, contact us at privacy@firstmate.ai.