Privacy Policy

FirstSeat (“FirstSeat,” “we,” “us,” or “our”) operates the lead-intelligence and customer-relationship-management platform at https://firstseat.io(the “Service”). This Privacy Policy explains what information we collect, how we use it, how we protect it, and the choices you have. FirstSeat is operated from British Columbia, Canada. By using the Service, you agree to this Privacy Policy. Questions? Contact us at hello@firstseat.io.

1. Who this policy is for

FirstSeat is a business tool used by food-and-beverage distributors and suppliers to find, enrich, and manage restaurant leads and to conduct sales outreach. Our customers are businesses and their sales representatives (“you,” “users”). This policy covers the data of our account holders and users.

2. Information we collect

Account and billing information. Your name, business name, email address, and authentication credentials. Billing details are processed by our payment provider; we do not store full payment card numbers.

Lead and CRM data you add. The prospecting data you create or import — restaurant leads, contact details, notes, deal stages, tasks, and activity history. You are responsible for ensuring you have the right to input this data.

Google / Gmail data (optional integration). If you connect your Google or Google Workspace account to send outreach email from your own address, we access a strictly limited set of Google user data:

• Your email address (via the openid and userinfo.email scopes), to display which account is connected and send from the correct address; and
• Permission to send email on your behalf (via the gmail.send scope), so emails you compose in FirstSeat are delivered from your own Gmail / Workspace mailbox.

We request only the minimum, send-only scopes needed for this feature. We do not request, and cannot use, any scope that reads, lists, downloads, or stores the contents of your inbox or mailbox. FirstSeat never reads your incoming mail, sent-mail history, contacts, or labels. The only Google user data we retain is the connected email address and the OAuth tokens required to send on your behalf.

Usage and technical data. Standard log and device information (IP address, browser type, pages accessed) to operate, secure, and improve the Service.

3. How we use information

• Provide, operate, maintain, and secure the Service and authenticate you;
• Send outreach emails that you compose from your connected Gmail / Workspace account, and log those sends to your CRM activity feed (recording that a message was sent, to whom, and when);
• Provide AI-assisted drafting of email content at your request;
• Process billing, respond to support, prevent fraud/abuse, and comply with legal obligations.

We do not use your Google user data for advertising, and we do not sell it. We do not use Gmail data to train generalized or non-personalized AI/ML models.

4. Google API Services — Limited Use

FirstSeat’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically, with respect to data accessed through Google APIs:

• We use Gmail access only to send email on your behalf — to deliver messages you compose within FirstSeat — and to identify the connected email address. This use is visible and prominent in the FirstSeat user interface.
• We do not use Google user data to serve advertisements.
• We do not sell Google user data.
• We do not transfer Google user data to others except as necessary to provide or improve the Gmail-sending feature (to the processors in Section 5, acting on our behalf), to comply with applicable law, or as part of a merger or acquisition with notice to affected users.
• We do not allow humans to read your Google user data, except with your explicit consent, where necessary for security, or to comply with applicable law.

We request only send-only scopes and do not access the contents of your mailbox.

5. Third-party service providers

We share data with a limited set of vendors who process it on our behalf, under contract, solely to provide the Service:

• Supabase — database and storage of account, CRM, and encrypted token data.
• Vercel — application hosting and delivery.
• Anthropic — AI-assisted generation of outreach content you request.
• Stripe — subscription billing and payment processing.

These providers act as our processors and may not use your data for their own purposes. We do not send your Gmail mailbox contents to any AI provider, because we never access them.

6. Storage, security, and data location

• Encryption at rest. OAuth access and refresh tokens are encrypted at rest using AES-256-GCM before being written to the database.
• Access controls. Tokens are stored in an access-locked table protected by row-level security and used only server-side to send on your behalf — never exposed to the browser or other tenants.
• Encryption in transit. All communication with the Service occurs over TLS.

Data may be stored and processed on infrastructure in Canada, the United States, or other jurisdictions where our processors operate. Where data is transferred outside Canada, we take reasonable steps to ensure it receives a comparable level of protection.

7. Data retention and deletion

We retain account and CRM data while your account is active. For the Gmail integration, your OAuth tokens and connected-email record are deleted when you disconnect Gmail in FirstSeat and when you delete your account. You may also revoke access anytime from your Google Account at myaccount.google.com/permissions. Once revoked, FirstSeat can no longer send on your behalf.

8. Your rights

Depending on your jurisdiction (including British Columbia’s Personal Information Protection Actand Canada’s PIPEDA), you may have the right to access, correct, or delete your personal information, withdraw consent, and make a complaint. Contact hello@firstseat.io to exercise these rights.

9. Children

The Service is a business tool and is not directed to individuals under the age of majority. We do not knowingly collect personal information from children.

10. Changes to this policy

We may update this policy from time to time. Material changes will be reflected in the “Last updated” date above and, where appropriate, notified through the Service.

11. Governing law and contact

This policy is governed by the laws of the Province of British Columbia and the applicable federal laws of Canada. The courts of British Columbia have jurisdiction over any dispute arising from it.

FirstSeat
Email: hello@firstseat.io
Website: https://firstseat.io