Legal
Privacy policy
Last updated 2 Nov 2026
Sample text for the template. Replace it with wording reviewed by your own lawyer before you publish.
1. What this policy covers
This policy explains how Firstpass, Inc. handles personal data when you visit our website, create an account or use the Firstpass app on your code host. It does not cover the code host itself, which has its own policy.
2. Data we collect
We collect only what the service needs:
—
Account data: your name, work email address and the organisation you belong to.
—
Usage data: which repositories are connected, how many reviews run and how comments are resolved.
—
Billing data: the billing contact and address. Card details are held by our payment provider, not by us.
—
Website data: pages visited and an approximate location derived from your IP address.
3. Source code
Source code is processed to produce a review and deleted when the review is posted. We do not use it to train models and we do not sell or share it. Build snapshots are kept for up to 7 days to speed up the next review; you can switch them off.
4. How we use data
—
To run reviews and show their results to you and your team.
—
To send service messages, such as a failed payment or a security notice.
—
To measure and improve the product, using aggregated figures.
—
To meet legal duties, such as tax records.
5. Who we share data with
We use a small number of suppliers for hosting, payments, email and support. Each one is bound by a data processing agreement and may only act on our instructions. The current list is available on request. We disclose data to authorities only when the law requires it, and we tell you unless we are forbidden to.
6. How long we keep it
Data
Kept for
Then
Source code
The length of a review
Deleted
Build snapshots
7 days
Deleted
Review text and audit records
The life of the account
Deleted 30 days after closure
Billing records
7 years
Deleted
7. Your rights
You can ask for a copy of your personal data, have it corrected or deleted, and object to how we use it. Account owners can export or delete an organisation’s data from Settings. We answer requests within 30 days.
8. Contact
Questions about this policy go to the privacy team through the contact form in your account. If you are not satisfied with the answer, you may complain to the data protection authority where you live.
