Privacy Policy

FirstSales ('we', 'us' or 'our') runs the FirstSales platform at firstsales.io. It is a business-to-business (B2B) cold email product that offers AI-assisted email sequences, automatic mailbox and domain warm-up, deliverability tools, prospect list management and campaign analytics.

This Privacy Policy explains how we collect, receive, use, store, share, transfer and protect personal data when you use the FirstSales website and platform (together, the 'Service'). It applies to everyone who visits firstsales.io, every account holder and trial user, and anyone whose data passes through our systems.

For the personal data of our own users and website visitors, FirstSales is the data controller: we decide why and how the data is processed. For personal data that users upload about their own prospects and contacts (recipient lists, enrichment data, CRM imports), FirstSales is a data processor. We act on the instructions of the user, who is the data controller for that data.

If you received a cold email sent through FirstSales and want to know why you were contacted, or want to be removed from the sender's list, reply to that email or contact the sender directly. You can also write to us at firstsales@support.communicate.so and we will help pass your request on.

When you create an account, start a trial or use any part of the Service, you confirm that you have read and understood this Privacy Policy. If you do not agree with any part of it, do not use the Service.

The personal data we collect depends on how you use FirstSales.

Account and profile data: when you sign up, we collect your name, email address and any optional profile details you add, such as company name, role or website. If you invite team members, we collect their email addresses to send the invitations.

Billing and payment data: when you start a paid subscription or the $1 trial, you give billing details such as the cardholder name and payment card information. Our outside payment processors (currently Stripe) handle the payments. We never receive or store your full card number, CVV or full card expiry date on our own servers. We receive and store a payment token, the last four digits, the card brand and the billing country, to manage your subscription and prevent fraud.

Connected mailbox and domain data: to send email for you, you let FirstSales access your email account through OAuth (Google, Microsoft or similar providers) or through SMTP/IMAP credentials. This lets us send email from your address, read the delivery status of sent mail and, if you turn on warm-up, exchange warm-up messages within our network. We store OAuth tokens (encrypted), your email address, display name, provider identity and sending settings. We access email metadata (subject, time, message-id, recipient addresses) and, in some cases, limited email body content, only to run warm-up, track opens and clicks, and give you deliverability analytics.

Prospect and contact data that users upload: you can upload CSV files, connect CRM integrations or add contacts by hand. These records can include names, business email addresses, job titles, company names, LinkedIn URLs and other prospecting details. This data belongs to you. You are the data controller, and you alone must make sure you have a lawful basis to process and contact each person.

Usage and product data: we collect information about how you use the Service, such as pages visited, features turned on, sequences created, campaigns launched, emails sent and tracked, opens and clicks, and session length. This data is mainly linked to your account, not tracked across other sites.

Device and log data: our servers automatically record your IP address, browser type and version, operating system, referring URL and timestamps when you use the Service. We use these logs for security monitoring, fixing bugs and preventing abuse.

• Cookies and similar tools: we use essential cookies to keep you signed in and to protect against CSRF attacks. We may use analytics cookies to understand overall product usage. Preference cookies remember settings such as time zone and language. For full details on cookies, tracking tools and how to opt out, see our Cookie Policy.

We use the information we collect for these purposes:

• Running the Service: signing you in, sending email and running warm-up for you, managing campaigns and sequences, storing and showing your prospect lists, and showing analytics dashboards.
• Account management and billing: handling subscriptions, trial activations and renewals, and telling you about plan changes, invoices and payment problems.
• Deliverability and warm-up: looking at sending patterns, reputation signals, bounce rates and inbox placement to advise you and adjust warm-up schedules automatically.
• AI-assisted writing: using your campaign context (who you are writing to, your product description, your tone choices) to write personalised email copy. We do not train shared AI models on your private prospect data or email content without your explicit consent.
• Customer support: answering your requests, fixing problems and helping you get set up.
• Safety and abuse prevention: detecting fake accounts, spam sent from our platform, attempts at unauthorised access and breaches of our Terms of Service.
• Legal and compliance duties: keeping records the law requires, responding to valid legal requests and enforcing our agreements.
• Improving the product: studying overall, de-identified usage trends to improve features, fix bugs and decide what to build next.

We do not sell your personal data, your connected mailbox content or your prospect lists to anyone for advertising.

If you are in the European Economic Area (EEA), the United Kingdom or Switzerland, we process your personal data on one or more of these legal bases under the General Data Protection Regulation (GDPR) and the national law that applies:

• Contract (Article 6(1)(b)): processing we need to carry out our contract with you, such as running your account, sending email, handling billing and giving support.
• Legitimate interests (Article 6(1)(f)): processing for our legitimate business interests, where your rights do not outweigh them. Examples are fraud detection, security monitoring, product analytics, telling existing customers about related features, and improving deliverability tools.
• Consent (Article 6(1)(a)): where we rely on your consent, such as for optional analytics cookies or marketing emails to people FirstSales itself contacts. You can withdraw consent at any time. This does not affect processing that happened before.
• Legal obligation (Article 6(1)(c)): processing the law requires, such as keeping tax records or responding to court orders or regulators.

If special categories of personal data appear by accident in uploaded prospect lists, we process them only with explicit consent or where the law allows. We strongly advise users not to upload sensitive data of this kind to the Service.

Connecting your mailbox is what lets FirstSales send email for you. We control access to your email account strictly, and we use it only as far as needed to run the features you turn on.

When you connect a Google Workspace or Microsoft 365 mailbox through OAuth, you give FirstSales specific OAuth scopes. For Google, we ask for scopes to send email (gmail.send), to read labels and metadata needed for delivery tracking (gmail.readonly or similar), and, if warm-up is on, to add and manage warm-up messages. We do not ask for access to your whole inbox or contacts beyond what the features you turn on need.

We store OAuth tokens encrypted at rest with industry-standard encryption. Access tokens refresh automatically and are kept only while your mailbox stays connected. If you revoke the OAuth grant in your Google or Microsoft account settings, our access ends at once.

• We read email metadata (sender, recipient, subject, message-id, time) to match sent messages with open and click tracking events.
• For warm-up, our system sends and receives short, human-like messages between connected accounts in our warm-up network. These messages are clearly machine-written for warm-up and do not contain your real campaign content.
• We do not read, index or analyse the full content of the emails in your inbox beyond what you send through the Service.
• We do not share or sell the content of your email, or use it for advertising, data brokering or training shared AI models, without your explicit consent.
• We access your mailbox only on your instructions. You remain responsible for making sure your use of connected mailboxes follows your email provider's terms of service.

If you disconnect a mailbox from FirstSales, we stop accessing it at once. We keep metadata linked to past campaign activity (send logs, analytics events) under our data retention rules, so your campaign reports stay complete.

FirstSales is a tool for business-to-business outreach. Users upload lists of business contacts, usually people who work at companies, to run cold email campaigns. When you upload prospect data, you are the data controller for it and FirstSales is your data processor.

You alone must make sure you have a lawful basis to process and contact each person on your prospect list. You must follow every law that applies, including CAN-SPAM, GDPR, CASL and any other rules in your recipients' countries.

As the controller of prospect data, you must:

• Get your contacts in legitimate ways (for example, publicly available professional information, opt-in forms or lists bought from compliant vendors) and confirm you have a lawful basis for B2B outreach.
• Make sure every email campaign clearly names the sender, has an honest subject line and includes a working opt-out or unsubscribe option, as CAN-SPAM and similar laws require.
• Act on opt-out and suppression requests quickly. FirstSales provides suppression list features, and you must use them when a contact asks to be removed.
• Not upload special categories of personal data (health, financial, political, biometric or other sensitive data) into the prospect database.
• Not upload data that you have no lawful right to process or to use for commercial email.

FirstSales processes prospect data only to run your campaigns, show records in your dashboard and give you analytics on your sends. We do not compare your prospect lists with other customers' lists, sell prospect data or use it for anything other than the campaign work you ask for.

When your account ends, we delete prospect data on the retention schedule in Section 8.

We do not sell personal data. We share personal data only in the limited cases below.

Subprocessors and service providers: we use carefully chosen outside companies to help run the Service. These subprocessors may process personal data for us, but their contracts require them to use it only for the purposes we set and to keep it secure. The main types of subprocessors are:

• Cloud infrastructure: hosting and database services that store account data, campaign data and logs in secure cloud environments.
• Email sending infrastructure: SMTP relay and deliverability services that help route and monitor outgoing email.
• Payment processors: Stripe (and similar services) that handle card payments. These processors are PCI-DSS compliant.
• Analytics and error monitoring: tools that collect overall product usage data and application error logs, to help us improve reliability and performance.
• Customer support tools: helpdesk and chat platforms we use to answer your tickets and questions.
• Sign-in providers: OAuth identity providers (Google, Microsoft) whose sign-in servers you use when you connect mailboxes.

Legal and safety disclosures: we may disclose personal data if the law, a regulation, legal process or a valid government request (such as a court order or subpoena) requires it. Where the law allows, we will tell you before we hand over data in response to such a request. We may also disclose data to protect the rights, property or safety of FirstSales, our users or the public.

Business transfers: if we go through a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of our assets, the personal data we hold may pass to the new owner. We will tell you about any such transfer and any choices you have.

With your consent: we share your data with other third parties when you clearly tell us to, for example when you approve a built-in integration with your CRM.

We keep personal data while your account is active and for a set period afterwards, or as long as the law requires.

• Active accounts: we keep your profile, billing records, campaign data and connected mailbox metadata for as long as your account exists.
• After your account ends or you cancel: we keep core account records and billing history for up to 7 years to meet financial and legal duties. We keep campaign analytics (overall metrics, send logs) for up to 2 years after the account ends, to settle disputes.
• Prospect and contact data: deleted within 90 days of the account ending, unless you ask for earlier deletion.
• OAuth tokens: revoked and deleted at once when you disconnect a mailbox or delete your account.
• Server and security logs: kept for up to 12 months for security monitoring and abuse prevention, then deleted or anonymised.
• Backups: encrypted backups may hold data for up to 60 more days after the normal retention period before they are wiped.

You can ask us to delete your account and its personal data at any time by writing to firstsales@support.communicate.so. We handle deletion requests within 30 days, unless the law requires us to keep certain records.

Deleting your account permanently removes your campaigns, sequences, prospect lists, connected mailbox settings and profile data. You cannot undo this. We keep billing records that tax law requires, in anonymised or minimal form, for the period the law sets.

Protecting your data and your mailbox access is central to our product. We use technical and organisational security measures that fit how sensitive the data is.

• Encryption in transit: all traffic between your browser or email client and our servers uses TLS 1.2 or higher. API endpoints accept HTTPS only.
• Encryption at rest: databases, file storage and backups are encrypted at rest with AES-256 or equivalent. OAuth tokens and SMTP credentials are also encrypted in the application before they are stored.
• Access controls: only authorised staff can reach production systems and customer data, and each person gets the least access they need. We log and review all production access. Admin access requires multi-factor authentication.
• Token handling: we never log or show OAuth tokens in plain text. Refresh tokens change each time they are used. We store only the minimum scopes each mailbox integration needs.
• Vulnerability management: we audit our dependencies regularly, apply security patches quickly and review code changes for security issues.
• Incident response: we keep an incident response plan. If a personal data breach happens, we will tell affected users and the relevant supervisory authorities within the time the law requires.

Even with these measures, no internet transmission or storage system is 100% secure. If you think someone has accessed your FirstSales account without permission, write to firstsales@support.communicate.so straight away and change your password and OAuth grants.

FirstSales works worldwide and may process your personal data in countries other than the one you live in. In particular, our infrastructure is mainly hosted in the United States. If you are in the EEA, the UK or Switzerland, your personal data may be sent to and processed in the United States or other countries that may not protect data as strongly as your home country.

When we send personal data from the EEA, the UK or Switzerland to a country without an adequacy decision, we rely on proper safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, included in our agreements with subprocessors and data importers.
• The UK International Data Transfer Agreement (IDTA), or the UK addendum to the SCCs, for transfers from the United Kingdom.
• Transfer impact assessments where required, with extra technical measures (encryption, pseudonymisation) where appropriate.

By using the Service, you acknowledge that your data may be transferred abroad as described above. For questions about the safeguards that apply to your data, write to firstsales@support.communicate.so.

Depending on where you are, you may have certain rights over your personal data. We will respect these rights quickly and without unnecessary obstacles.

Rights under GDPR (people in the EEA, the UK and Switzerland):

• Right of access: you can ask for a copy of the personal data we hold about you and how we process it.
• Right to rectification: you can ask us to correct personal data that is wrong or incomplete.
• Right to erasure ('right to be forgotten'): you can ask us to delete your personal data when we no longer need it for the purpose we collected it for, when you withdraw consent (and no other legal basis applies), or when the processing is unlawful.
• Right to data portability: you can ask for your personal data in a structured, common, machine-readable format to move it to another controller, where the processing is based on consent or contract and is automated.
• Right to object: you can object to processing based on our legitimate interests, including direct marketing. We will stop unless we show compelling legitimate grounds that outweigh your interests.
• Right to restriction of processing: you can ask us to limit how we process your data in certain cases, for example while a dispute about its accuracy is settled.
• Rights about automated decisions: we do not make decisions about you that have legal or similarly significant effects by automated means alone, without a person involved.

Rights under CCPA/CPRA (California residents):

• Right to know: you can ask us to tell you the categories and specific pieces of personal information we have collected about you, where it came from, why we use it and which third parties we share it with.
• Right to delete: you can ask us to delete personal information we have collected, with some exceptions.
• Right to correct: you can ask us to correct personal information that is wrong.
• Right to opt out of sale or sharing: we do not sell or share personal information for cross-context behavioural advertising. You do not need to opt out, but you can contact us to confirm this.
• Right to non-discrimination: we will not treat you unfairly for using your privacy rights.

How to use your rights: send a request to firstsales@support.communicate.so with the subject line 'Privacy Rights Request'. We will confirm your identity before we act on your request, and reply within 30 days (or 45 days where the law allows and we tell you). One request per 12-month period is free.

If you are in the EEA or the UK and think we have not handled your data lawfully, you have the right to complain to your local supervisory authority (for example, the Irish Data Protection Commission, the UK ICO or the authority in your member state). We encourage you to contact us first at firstsales@support.communicate.so so we can try to solve the problem directly.

Children's privacy: the Service is only for business professionals and is not aimed at children under 16 (or the age of digital consent where you live). We do not knowingly collect personal data from children. If you think a child has given us personal data, write to firstsales@support.communicate.so and we will delete it promptly.

Changes to this policy: we may update this Privacy Policy from time to time to reflect changes in our practices, the law or product features. When we make important changes, we will tell you by email (to the address on your account) and with a clear notice in the product at least 14 days before the change takes effect. The 'Last updated' date at the top of this page always shows the date of the latest version. If you keep using the Service after an updated policy takes effect, you accept the changes.

We can provide earlier versions of this Privacy Policy on request.

How to contact us: if you have any questions, concerns or requests about this Privacy Policy or how we handle data, contact us:

• Email: firstsales@support.communicate.so
• Subject line for privacy matters: 'Privacy Inquiry' or 'Privacy Rights Request'
• We aim to answer every privacy question within 5 business days and to complete rights requests within 30 days.

If a data protection matter cannot be solved through our support channel, people in the EEA and the UK can take it to their national data protection supervisory authority. California residents can contact the California Privacy Protection Agency (CPPA).